similar to: [Bug 790] Normalize iptables rules

https://bugzilla.netfilter.org/show_bug.cgi?id=790 Andor <tothandor at gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|REOPENED |RESOLVED Resolution| |INVALID --- Comment #9 from Andor <tothandor at

https://bugzilla.netfilter.org/show_bug.cgi?id=790 --- Comment #5 from Andor <tothandor at gmail.com> 2013-06-24 11:34:44 CEST --- ipt1 is an output of a firewall script mainly edited by hand, where parameters order may vary. ipt2 is the output of iptables-save, where parameters are strictly ordered. As written before, the difference in parameter order spoils the comparison of two

https://bugzilla.netfilter.org/show_bug.cgi?id=790 --- Comment #7 from Andor <tothandor at gmail.com> 2013-06-24 17:05:46 CEST --- I'm keen to keep the same order for the scripts' output, but there are many modules and targets with hundreds of parameters, with immense ammount of possible combinations. How can you know the correct order for all, beyond the main parts (i.e. table,

https://bugzilla.netfilter.org/show_bug.cgi?id=790 --- Comment #8 from Phil Oester <netfilter at linuxace.com> 2013-06-28 17:45:18 CEST --- Have you considered setting up a different network namespace to achieve this? For instance: ip netns add test ip netns exec test iptables-restore < /tmp/ipts ip netns exec test iptables-save This would seem to achieve the results you are looking

https://bugzilla.netfilter.org/show_bug.cgi?id=790 Phil Oester <netfilter at linuxace.com> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |netfilter at linuxace.com --- Comment #4 from Phil Oester <netfilter at linuxace.com> 2013-06-20

https://bugzilla.netfilter.org/show_bug.cgi?id=790 --- Comment #6 from Phil Oester <netfilter at linuxace.com> 2013-06-24 16:13:49 CEST --- Since your script produces the output of ipt1, just make sure you use the same order as iptables-save does. Iptables-save will always output args in the same order. The bug appears to be in the output you are creating, which is beyond our control. --

http://bugzilla.netfilter.org/show_bug.cgi?id=759 Summary: "iptables -m recent" crashes a LXC host on lxc-stop Product: netfilter/iptables Version: linux-2.6.x Platform: x86_64 OS/Version: Ubuntu Status: NEW Severity: critical Priority: P5 Component: ip_tables (kernel) AssignedTo:

https://bugzilla.netfilter.org/show_bug.cgi?id=1117 Bug ID: 1117 Summary: Table ipv4-nat prerouting dnat doesn't accept dest IP:PORT Product: nftables Version: unspecified Hardware: x86_64 OS: All Status: NEW Severity: enhancement Priority: P5 Component: nft

https://bugzilla.netfilter.org/show_bug.cgi?id=580 Phil Oester <netfilter at linuxace.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC| |netfilter at linuxace.com Resolution|

https://bugzilla.netfilter.org/show_bug.cgi?id=580 --- Comment #5 from Phil Oester <netfilter at linuxace.com> 2013-06-24 20:07:02 CEST --- Unclear how you can say with certainty that this is impossible, but let's ignore that point for the moment. Is there some reason that iptables-save should do the sorting for userspace scripts? Another alternative would be to always load the

https://bugzilla.netfilter.org/show_bug.cgi?id=580 --- Comment #7 from Phil Oester <netfilter at linuxace.com> 2013-06-24 23:34:51 CEST --- > would you be thrilled if all the rules were in random order too? This comparison is a bit far fetched, given that ordering of rules is so important (accept before drop, etc). The order in which tables are output in iptables-save is largely

https://bugzilla.netfilter.org/show_bug.cgi?id=773 Phil Oester <netfilter at linuxace.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |RESOLVED CC|jengelh at medozas.de |netfilter at linuxace.com Resolution|

https://bugzilla.netfilter.org/show_bug.cgi?id=1335 Bug ID: 1335 Summary: iptables-restore will crash if -6 rules are present Product: iptables Version: unspecified Hardware: All OS: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component: iptables-restore

https://bugzilla.netfilter.org/show_bug.cgi?id=1150 Bug ID: 1150 Summary: Iptables fails to match rules with malloc perturberation activated Product: iptables Version: unspecified Hardware: x86_64 OS: All Status: NEW Severity: enhancement Priority: P5 Component:

https://bugzilla.netfilter.org/show_bug.cgi?id=580 Jan Engelhardt <jengelh at medozas.de> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |REOPENED Resolution|WONTFIX | --- Comment #4 from Jan Engelhardt <jengelh at

https://bugzilla.netfilter.org/show_bug.cgi?id=580 --- Comment #6 from Jan Engelhardt <jengelh at medozas.de> 2013-06-24 20:32:22 CEST --- >Unclear how you can say with certainty that this is impossible Right now, tables are output in permutations that are considered to be random. (Sure there is module load order, but that is not documented, nor is it actually a usable assumption for

https://bugzilla.netfilter.org/show_bug.cgi?id=1161 Bug ID: 1161 Summary: The lock problem causes the iptables return with exit code 0 without adding my rules to kernel. Product: iptables Version: unspecified Hardware: x86_64 OS: Ubuntu Status: NEW Severity: enhancement

https://bugzilla.netfilter.org/show_bug.cgi?id=1407 Bug ID: 1407 Summary: Segfault with iptables-nft-restore when flush rules included Product: nftables Version: unspecified Hardware: x86_64 OS: Debian GNU/Linux Status: NEW Severity: normal Priority: P5 Component:

https://bugzilla.netfilter.org/show_bug.cgi?id=580 Phil Oester <netfilter at linuxace.com> changed: What |Removed |Added ---------------------------------------------------------------------------- AssignedTo|jengelh at medozas.de |netfilter-buglog at lists.netf | |ilter.org -- Configure

http://bugzilla.netfilter.org/show_bug.cgi?id=724 Summary: Iptables doesn't delete rules matching if target is RATEEST - patch attached Product: iptables Version: unspecified Platform: All OS/Version: All Status: NEW Severity: normal Priority: P3 Component: iptables