?????? 23 ???? 2016 05:56,? "Mike" <1100100 at gmail.com> ???:>> > After using iptables for a long time, I can't figure out where this syntax > comes from. > Can anyone point me in the right direction to understand the proper syntax > necessary in /etc/sysconfig/iptables? >The syntax comes from the output of the 'iptables-save' command. You can configure 'iptables' from the command line as you normally would and then run iptables-save > /etc/sysconfig/iptables On centos<=6 the init.d script also included a 'save' command to do it for you, I'm not sure about the systemd unit file though. HTH, Barak _______________________________________________> CentOS mailing list > CentOS at centos.org > https://lists.centos.org/mailman/listinfo/centos
On Sun, May 22, 2016 at 11:55 PM, Barak Korren <bkorren at redhat.com> wrote:> ?????? 23 ???? 2016 05:56,?> The syntax comes from the output of the 'iptables-save' command. > You can configure 'iptables' from the command line as you normally would > and then run > > iptables-save > /etc/sysconfig/iptables > > On centos<=6 the init.d script also included a 'save' command to do it for > you, I'm not sure about the systemd unit file though. > > HTH, > Barak _______________________________________________ >Hi Barak, If I'm understanding correctly, write out all rules in a bash terminal and run them, and then do /usr/sbin/iptables-save --- ~#/usr/sbin/iptables rule; ~#/usr/sbin/iptables rule; ~#/usr/sbiniptables rule; ~#/usr/sbin/iptables rule; ~#/usr/sbin/iptables rule; ~#/usr/sbiniptables rule; ~#/usr/sbin/iptables rule; ~#/usr/sbin/iptables rule; ~#/usr/sbiniptables rule; ~#/usr/sbin/iptables rule; ~#/usr/sbin/iptables rule; ~#/usr/sbiniptables rule ~#/usr/sbin/iptables-save > /etc/sysconfig/iptables
> > If I'm understanding correctly, write out all rules in a bash terminal and > run them, and then do /usr/sbin/iptables-save --- > > ~#/usr/sbin/iptables rule; > ~#/usr/sbin/iptables rule; > ~#/usr/sbiniptables rule; > ~#/usr/sbin/iptables rule; > ~#/usr/sbin/iptables rule; > ~#/usr/sbiniptables rule; > ~#/usr/sbin/iptables rule; > ~#/usr/sbin/iptables rule; > ~#/usr/sbiniptables rule; > ~#/usr/sbin/iptables rule; > ~#/usr/sbin/iptables rule; > ~#/usr/sbiniptables rule > > ~#/usr/sbin/iptables-save > /etc/sysconfig/iptablesYep. And you can copy '/etc/sysconfig/iptables' around if you have identical machines and no machine-specific rules... (Note, you can even port the rules from other Linux distros as iptables-save exists there as well) -- Barak Korren bkorren at redhat.com RHEV-CI Team