6

What is the file format expected by iptables-restore? Does a description of the format exist?

  • 1
    I am not sure that the file created by iptables-save and consumed on stdin by iptables-restore is really considered an open API for Iptables. If you want to change the file, you are probably better off using iptables itself, not modifying the dump file. – 111--- Oct 24 '17 at 17:00
  • The trouble is, I am going to be using iptables-apply to safely make changes over ssh. Some changes cannot be made with iptables without risking being locked out. – mjb2kmn Oct 24 '17 at 17:04
  • Was that edit meant to be helpful, or just boring, @jeff-schaller? – mjb2kmn Oct 30 '17 at 14:07
  • Both; by not including links or quotes to the research you've already done, saying "I've searched everywhere" doesn't add anything to the question. Ditto the "you're my only hope" -- as you appear to have made some good progress on your own! The tour page and other meta discussions suggest a minimum of chit-chat in the question; instead, focus on the technical details. – Jeff Schaller Oct 30 '17 at 14:28
  • OK, I get it now. Thanks for being patient, @JeffSchaller. ;) – mjb2kmn Dec 5 '17 at 17:50
14

I found my answer, sort-of...
As best as I can tell, there is no document. However, in reading the source code I've uncovered how it works.

Lines starting with # are for comments and are not parsed.
Blank lines are ignored.
* marks the table name.
: marks the chain, followed by the default policy and optionally the packet and byte counters.
byte counters can precede a rule.
Rules are exactly as given on the command line less the table name.
Each table section must end with COMMIT.

The good news is that the syntax for the actual rules is just as it says in man iptables.

# iptables-restore format
*<table>
:<chain> <policy> [<packets_count>:<bytes_count>]
<optional_counter><rule>
... more rules ...
COMMIT

-

# iptables-restore example
*filter
:INPUT DROP [0:0]
-A INPUT -s 127.0.0.1 -p tcp -m tcp --dport 9000 -J ACCEPT
-A INPUT -p tcp -m tcp --dport 9000 -j REJECT --reject-with icmp-port-unreachable
COMMIT
  • 1
    Ha, now how about documentation on the extensions... – mjb2kmn Oct 24 '17 at 20:00
  • can you explain why :INPUT DROP [0:0] does not flush INPUT but :DOCKER-USER - [0:0] does flush DOCKER-USER, with iptables-restore --noflush? – Jayen Mar 22 at 11:15
  • Not off the top of my head, sorry. Might be worth posting a new question. – mjb2kmn Mar 24 at 17:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.