Restore iptables Rules that have been saved with iptables-save

tiuz · 08-14-2010, 12:47 PM

Hello,

A while ago i have saved iptables Rules with iptables-save to a file.

Now i need to do some modifikations and i would like to know if there is a way to get the contents of the file that has been saved with iptables-save back to "Human Readable form again"

For example: THIS form:

# Generated by iptables-save v1.3.5 on Sat Oct 28 15:10:09 2006
*mangle
:PREROUTING ACCEPT [40511857:54699979328]
:INPUT ACCEPT [40485221:54677480953]
:FORWARD ACCEPT [26394:22470203]
:OUTPUT ACCEPT [22521741:1599930162]
:POSTROUTING ACCEPT [22544591:1622118540]
COMMIT
# Completed on Sat Oct 28 15:10:10 2006
# Generated by iptables-save v1.3.5 on Sat Oct 28 15:10:10 2006
*filter
:INPUT ACCEPT [40479586:54675697556]
:FORWARD ACCEPT [26385:22469703]
:OUTPUT ACCEPT [22515275:1599136686]
-A INPUT -i eth1 -j DROP
COMMIT
# Completed on Sat Oct 28 15:10:10 2006

Into this form (how you enter the rules with iptables):

iptables -A INPUT -i ppp0 -p tcp --dport 21 -j DROP

etc etc.....

Thanks,
tz

unSpawn · 08-14-2010, 02:45 PM

It's human readable form already and you only have one filtering rule (which kind of fails to make sense anyway). Your new line you can add to the "*filter" table section below or instead of the "-A INPUT -i eth1 -j DROP" as "-A INPUT -i ppp0 -p tcp --dport 21 -j DROP".

tiuz · 08-14-2010, 05:05 PM

Erm, well it´s only a part of the iptables-saved file (not the full one) and the line with A INPUT -i eth1 -j DROP was where just examples. I just want to know if it´s possible to get rules that have been saved with iptables-save back into a form as you give with iptables.

I mean you don´t enter
:PREROUTING ACCEPT [40511857:54699979328]
:INPUT ACCEPT [40485221:54677480953]
:FORWARD ACCEPT [26394:22470203] etc...etc...

in the command line

tz

unSpawn · 08-14-2010, 06:33 PM

Here's a kludge:

Code:

cat /path/to/iptables-save | while read LINE; do
 case "${LINE}" in
  \**) export TABLE="${LINE:1}";;
  :*)  LINE=(${LINE}) ; echo "/sbin/iptables -t "${TABLE} -P ""${LINE[0]:1:255}" "${LINE[1]}"";;
  -A*) echo "/sbin/iptables -t ${TABLE} ${LINE}";;
 esac
done

YMMV(VM)

tiuz · 08-14-2010, 06:50 PM

Nice one ! THANKS !!