Home / server / Questions / 623126
In Process
mighq
Asked: 2014-08-22 09:42:21 +0800 CST

is iptables-save rule dump deterministic?

  • 772

is the order of the parameters of iptables rule line deterministic in the iptables-save output?

-A CHAIN1 -m mod1 -m mod2 -j CHAIN2 will be always the same, or I can expect it to be -A CHAIN1 -m mod2 -m mod1 -j CHAIN2 sometimes?

I don't want to dig into sources, maybe someone here already knows.

iptables

1 Answers

  1. The match extensions (-m) will definitely always have the same order, because the rule pattern you show:

    -A CHAIN1 -m mod1 -m mod2 -j CHAIN

    may not have the same meaning and may not have the same behavior as

    -A CHAIN1 -m mod2 -m mod1 -j CHAIN2

    For the parameters of each match extension (I mean the param in : -m matchext1 --param1 val1 --param2 val2), it is more a supposition made according to a repeated observation, but the order will always be the same, the output order does not reproduce the order the parameters were given on the command line but seems to be the same as the order in which they appear in manpage of iptables.

    • 0