netfilter - iptables-restore file format documentation

Question

What is the file format expected by iptables-restore? Does a description of the format exist?

Answer 1

I found my answer, sort-of...
As best as I can tell, there is no document. However, in reading the source code I've uncovered how it works.

Lines starting with # are for comments and are not parsed.
Blank lines are ignored.
* marks the table name.
: marks the chain, followed by the default policy and optionally the packet and byte counters.
byte counters can precede a rule.
Rules are exactly as given on the command line less the table name.
Each table section must end with COMMIT.

The good news is that the syntax for the actual rules is just as it says in man iptables.

# iptables-restore format
*<table>
:<chain> <policy> [<packets_count>:<bytes_count>]
<optional_counter><rule>
... more rules ...
COMMIT

-

# iptables-restore example
*filter
:INPUT DROP [0:0]
-A INPUT -s 127.0.0.1 -p tcp -m tcp --dport 9000 -J ACCEPT
-A INPUT -p tcp -m tcp --dport 9000 -j REJECT --reject-with icmp-port-unreachable
COMMIT