Home / server / Questions / 493238
In Process
mighq
Asked: 2013-03-29 07:29:41 +0800 CST

clever way to update iptables firewall without clearing the counters

  • 772

can I somehow reload firewall rules using iptables-save definition, without clearing the current runtime version counters? I want some way to only add and remove different rules and keep the old ones in place with counters intact. iptables-restore -n is not clever enough.

has anyone solved this issue before?

my monitoring is bound to firewall rules and counters and clearing them makes big spike in rrdtool charts, because rrdtool thinks it is integer overflow, not firewall update.

iptables

1 Answers

  1. There are many options, you just need to change how to manage the firewall.

    A couple ideas

    • Don't 'reload' the firewall. Issue commands to add/insert/remove rules as required.
    • Re factor your firewall so the counters are in a separate chain from the filtering rules. Don't flush/update that particular chain.
    • Use iptables-save to export the current rules, update the exported rule set, and restore them.
    • As @gparent suggested use the something to save the counters, and then use the -c option to restore them during a reload.
    • 1