On 02/28/2013 07:26 AM, Donghua Liu wrote:
Hi,
Say if I set a netfilter rule by "iptables -t nat -A custom_chain -p
tcp -dport 80 -j DNAT --to-destination 127.0.0.1:1234" for some
requirement.
I also have a LKM which will check the availablity of service
"127.0.0.1:1234" and how can I cancel the rule's operation(Do NOT
delete this rule), let the packet go as usual ignore the nat.
man iptables says there is a -R command to replace rules:
----
-R, --replace chain rulenum rule-specification
Replace a rule in the selected chain. If the source
and/or destination names resolve to multiple addresses, the command will
fail. Rules are numbered starting at 1.
----
Assuming you know which rulenum must be changed, you can do this:
iptables -t nat -R custom_chain 1 -p tcp -dport 80
IOW, lose the -j parameter from the rule, keeping the others. The result
is that the rule will still be there, but effectively won't do anything
except for matching and updating packet/byte counting.
--
Rob
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
