17

Is there a way to move a rule in the iptables and change it position ? I'm aware i can use -I to insert a rule in a specific position, but i also like to keep the counters.

7

No, you cannot move a rule. However, you can set the counter for any rule you add/insert/replace (using the -c or --set-counters parameter). So you could check the current count, delete the rule and reinsert it with the old count value.

27

You can also do following

  1. Write the output of iptables-save to a file: iptables-save > /tmp/iptables.txt
  2. Edit this file with a text editor, move whichever line you want.
  3. Reload the file: iptables-restore < /tmp/iptables.txt
4

To see what you have and what you want to change you first need to do some examination.

1) Check for counters and write these somewhere so you can enter them later.

iptables-save -c

2) Check for the line you want to replace / reposition using

iptables -L -v -n --line-n

3) Write the rule in the designated CHAIN and add the counters explained in step on. For example.

iptables -R INPUT 5 -i virbr0 -p udp -m udp -c 3441 472271 --dport 53 -j ACCEPT -m comment --comment "Some comment"

Meaning of -c

-c [packets:bytes]

The above iptables rule will be entered on line 5.

Note. Save iptables rules using iptables-save -c /somepath/iptrules-$(date +%F) which will preserve counters.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.