I am working with a product on CentOS that occasionally needs to automatically add and remove rules from the iptables configuration. For example, during an update, we want to explicitly refuse inbound service traffic until the update is complete. Currently, the approach being used in the update code is to use
sed and other text-handling utilities to comment out the relevant lines in the configuration file, restart the
iptables service with the new configuration file, and then reverse the process at the end of the update, and restart the service once again.
It seems to me that a better approach would be to use the
iptables -D table rule-specification command at the start of the process, and then
iptables -A table rule-specification at the end of the update.
The biggest problem I see with automatically manipulating the configuration file is fragility: there are system tools that rewrite the configuration file, and may reorder parameters etc, possibly breaking the text parsing (
service iptables save is an example).
What is the recommended approach to making system configuration changes like this from within code, and why?