3

I need to configure iptables on a linux machine with running docker containers. If I save iptables rules with iptables-save > /etc/iptables/rules.v4, rules from all chains will be written to file.

But I want to save only INPUT, OUTPUT and DOCKER-USER chains, and don't want chains DOCKER, DOCKER-ISOLATION-STAGE-1, etc to be saved, since they contain rules added by docker automatically, which will be irrelevant after reboot.

As far as I know, iptables-save can save specific tables, but not specific chains.

Currently I consider to combine iptables-save with grep to cut rules from unwanted chains. Is there any better way to achieve same result?

Improve this question
2
  • Hey, what solution did you find? Thanks!
    – RicHincapie
    Oct 7, 2021 at 13:14
  • 1
    @RicarHincapie I save rules with the following command: iptables-save | grep -e "-A FORWARD" -e "DOCKER-ISOLATION-STAGE" -e "-A DOCKER " -e "-A POSTROUTING" -e "-A PREROUTING" --invert-match > /etc/iptables/rules.v4
    – Marat Safin
    Oct 8, 2021 at 7:19

1 Answer 1

Reset to default
1

You can use the basic iptables command with option -S (--list-rules) to get similar output for a given chain and table, eg:

$ sudo iptables -t filter -S OUTPUT
-P OUTPUT DROP
-A OUTPUT -o lo -j ACCEPT
...

but you will have to repeat this for each table and chain, and perhaps munge the output a little if you want compatibility for iptables-restore, for example adding headers per table like *filter and changing the default policy -P to :, and adding a COMMIT to each table.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .