Home / server / Questions / 571120
Accepted
Scott Forsyth
Asked: 2014-01-31 12:40:43 +0800 CST

Dynamically remove iptables policy by IP address

  • 772

I would like to remove some NAT POSTROUTING rules in an automated fashion based on the source or destination IP address.

I know the source and destination IP but I don't necessarily know which policies are already there.

For example, I may have this:

-A POSTROUTING -s 10.10.10.10/32 -p tcp -m tcp --dport 80 -j SNAT --to-source 1.2.3.4
-A POSTROUTING -s 10.10.10.10/32 -p tcp -m tcp --dport 443 -j SNAT --to-source 1.2.3.4
-A POSTROUTING -s 10.10.10.10/32 -j ACCEPT

or I may just have this:

-A POSTROUTING -s 10.10.10.10/32 -j SNAT --to-source 1.2.3.4

I want to unassign that NAT address from the old computer and assign it to a new computer. This is all automated so I can't manually look for it.

What's the best way to remove the old polices for just that IP? Could I use a list + grep command? I normally hang out in the Windows world so I'm not sure the best way to handle this here.

iptables

2 Answers

  1. Best Answer

    You can match a rule for deletion by specifying it precisely and using -D (--delete) instead of -A. For instance:

    iptables -t nat -D POSTROUTING -s 10.10.10.10/32 -p tcp -m tcp --dport 80 -j SNAT --to-source 1.2.3.4

    To script this, matching a specific IP address, and not losing any rules due to race conditions, let's try something like this. This will delete any rule in the nat table containing a given IP address:

    IFS=$'\n'
for rule in `iptables-save -t nat | grep -w $IP_ADDRESS | sed -e 's/-A/-D/'`; do
    echo $rule | xargs iptables -t nat
done

    Some notes on this: We use grep -w to ensure that IP addresses match exactly, and e.g. a given address that ends in 25 doesn't match 250. The transform from -A to -D is done by sed in the loop. And we use xargs to expand each rule into parameters.

    • 2

  2. iptables -t nat -L POSTROUTING -n --line-numbers | grep -w 1.2.3.4 | awk '{print $1}'

    That would grep IP that you want and grab the line number of the firewall rule. Then use iptables -t nat -D POSTROUTING 1 to delete rule 1, or whatever number you want.

    • 1