/dev/rob0 wrote:
On Monday 2005-November-28 11:15, Derick Anderson wrote:
I think you should manually check the existence of possible
duplicate before adding rule. Also you can do somethig like:
iptables -D INPUT -d 192.168.0.2/32 -i eth1 -j DROP
iptables -A INPUT -d 192.168.0.2/32 -i eth1 -j DROP
Then you will never get duplicates.
But the first way is more correct.
Just don't use that method remotely.
Sure, just do them as a single command separated by ";".
It occurs to me that some rules may indeed be present multiple times in
a table. For instance VOIP QOS where you regularily take an action
based on TOS fields on input and later alter the TOS fields and perhaps
take that action again based on the same TOS field data in which case
the above might cause one to remove the wrong rule! IpTables is
essentially a computer program, it is a sequence of events not just a
unordered list of rules. For myself, I would take much greater steps in
the handling of rule insertion than just seeing if that rule exists
somewhere in the INPUT table. It may work fine for even the majority of
iptable sets but it's definately not a universal solution. The
universal solution is to not put the extraneous rules in the table in
the first place and, to do that programmatically, the iptables sets and
the program altering the sets need to agree upon a structure that allows
this.
