On 06/14/10 12:23, Curby wrote:
Just a quick note that you might want to look at iptables-save
instead of vanilla iptables if you aren't already. The former
command gives the rules in a sort of canonical form that is used for
restoring rulesets. You'll have fewer spacing issues and such.
Hopefully others will have more to add. =)
(iptables-save) Agreed.
I'd also recommend that you apply your rule and see how iptables-save
will regurgitate the same rule back at you. Especially if you are doing
a textual comparison of the rule.
If you aren't doing a textual comparison of the rule and are actually
breaking it out in to its individual elements (like command line
argument processing) you will have a better chance of matching the rule
on more systems. Something as simple as a different interface name will
throw off your textual match. I.e. "eth0" is actually "eth1".
Depending on how system agnostic you are trying to bee, processing the
rule as if it were a command line (looking for individual pieces) will
probably be the easiest to do.
Grant. . . .
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
