0

I want to flush a number of related chains in IPtables. Their names like 'f2b.*' I want the entire chain gone! e.g. all this gone.

-A f2b-postfix-sasl -s 103.231.139.130/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -s 141.98.9.2/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -s 45.13.39.56/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -s 185.36.81.61/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -s 185.36.81.169/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -s 185.36.81.165/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -s 185.137.111.22/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -s 185.137.111.188/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -s 185.137.111.123/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-postfix-sasl -j RETURN
-A f2b-ssh-ddos -s 193.201.224.214/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-ssh-ddos -j RETURN

Also I would like the chain rules gone:

-A INPUT -p tcp -m multiport --dports 22,115 -j f2b-ssh-ddos
-A INPUT -p tcp -m multiport --dports 25,465,587,143,993,110,995 -j f2b-postfix-sasl

Basically something like this

iptables -F .*f2b-.*
iptables -D .*f2b-.*

How would you do this?

[Reason] is because I save the iptables on shutdown and restore on reboot. However, fail2ban adds the existing rules again without checking if they already exist. So I end up with duplicates.

[UPDATE#1] I can get the unique chain names like this:

sudo /sbin/iptables -S | grep -P '\-A f2b-.*' | cut -d ' ' -f 2 | sort -u

How do I get them deleted without building a loop?

  • Do you want to flush entire chain or just remove few rules from any particular chain? Please clarify your question, and give some examples – mrc02_kr Jun 25 at 9:48
  • Why do you need to save it on reboot? Isn't enough to save base rules one time and load them after reboot and then fail2ban will take care of its own rules? – mrc02_kr Jun 25 at 10:33
  • Do you know of a way to save rules without the f2b chains and rules, but including all else? currently I just do iptables-save > file and then restore the file. – conanDrum Jun 25 at 10:38
  • I noticed you put a couple "Answer" sections in your Question; if you're trying to self-answer, the answers should go into an Answer box, below. Thanks! – Jeff Schaller Jun 25 at 13:19
0

I can get the unique chain names like this:

sudo /sbin/iptables -S | grep -P '\-A f2b-.*' | cut -d ' ' -f 2 | sort -u

How do I get them deleted without building a loop?

[Answer#1] Delete all f2b chains

/sbin/iptables -S | grep -P '\-A f2b-.*' | cut -d ' ' -f 2 | sort -u | awk '{print "/sbin/iptables -F "$1";"}' #| /bin/sh

[Answer#2] Delete all f2b rules

/sbin/iptables -S | grep -P '\-A INPUT.*f2b-.*' | sed 's/^-A //' | awk '{print "/sbin/iptables -D "$0";"}' #| /bin/sh

Note: Uncomment the # when you are ready.

0

For your sample case you could do like:

iptables-save | sed -nE '/^(\*|COMMIT)/p;/^:/s/^:(f2b-[[:graph:]]+).*/-F \1/p;/ -[jg] f2b-[[:graph:]]+/s/^-A/-D/p' | iptables-restore -n

This takes iptables-save's output, replaces all chain information instructions (lines starting with :) regarding chains f2b-* with a respective -F <chain-name> command, as well as all -A commands referring to f2b-* chains with a respective -D command, and finally feeds these to iptables-restore -n.

It is important that you use -n option so to make this iptables-restore not flush everything.

  • Thanks for your time my friend much appreciated. – conanDrum Jun 25 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.