How would one modify the following line in iptables file (debian)?

ACCEPT     all  --  XXX.XXX.XX.X         anywhere            PHYSDEV match --physdev-in vif3.1 


ACCEPT     all  --  YYY.YYY.YY.Y         anywhere            PHYSDEV match --physdev-in vif3.1 

I looked up the https://wiki.debian.org/iptables and I'm having hard time figuring out how to exactly do this modification. Can it be done using one command, or there is a way to temporally "extract" the iptables file and modify it using nano or vi, and put it back in place?

migrated from serverfault.com Nov 8 '13 at 23:04

This question came from our site for system and network administrators.


To replace that particular rule using iptables you need to do some debugging first.

First option is replacing the rule instantly.

1) See what line-number and in what CHAIN the mentioned line is placed. e.g:

iptables -L -v -n --line-n

2) Locate the line and replace it based on the output.

iptables -R [CHAIN_NAME] [LINE_NUMBER] -s YYY.YYY.YYY.YYY -m physdev  --physdev-in vif3.1  -j ACCEPT

Second option is to save the iptables rules and modify the file and import it.

1) Save the rules.

iptables-save > my_ipt-$(date +%F).ipt

2) Modify the my_ipt-$(date +$F).ipt

3) import the my_ipt-$(date +%F).ipt

iptables-restore < my_ipt-$(date +%F).ipt

NOTE: $(date +%F) is the date you saved the file e.g: 2013-11-07

Check if everything is as expected

iptables -L -v -n --line-n

Yes it is possible : iptables -L CHAIN -n -v --line-numbers give you the index in the rules iptables -S CHAIN INDEX display the rule

Edit With -R CHAIN INDEX parameters.

Exemple : iptables -L Visioconf-OUT -n -v --line-numbers

Chain Visioconf-OUT (1 references)
num   pkts bytes target     prot opt in     out     source               destination
1     719K   49M LOG        all  --  *      *              LOG flags 0 level 4 prefix "DROP4 Visioconf-OUT "
2     719K   49M DROP       all  --  *      *  

iptables -S Visioconf-OUT 2

-A Visioconf-OUT -j DROP

iptables -R Visioconf-OUT 2 -s -j DROP

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.