Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a bash script for initializing iptables.

#!/bin/sh

EXTIF="eth0"
INTIF="eth1"

INTIP="192.168.0.1/32"
EXTIP=$(/sbin/ip addr show dev "$EXTIF" | perl -lne 'if(/inet (\S+)/){print$1;last}');

UNIVERSE="0.0.0.0/0"
INTNET="192.168.0.1/24"

/sbin/iptables-restore -v < iptables.rules

I have iptables.rules file containing something like this:

-A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j REJECT

How can I pass those variables from bash script to iptables.rules or evaluate them?

share|improve this question
    
Cross-posted from here. –  Dennis Williamson Mar 14 '11 at 4:18

3 Answers 3

up vote 3 down vote accepted

Something like this:

while read line; do eval "echo ${line}"; done < iptables.rules | /sbin/iptables-restore -v

or more nicely formatted:

while read line
  do eval "echo ${line}"
done < iptables.rules | /sbin/iptables-restore -v

This forces the variable expansion stuff. You definitely need to be sure you understand what's in those variables; I suspect that if somebody could set a variable to an arbitrary value they could use it to execute arbitrary code.

share|improve this answer
    
This works well for me –  Michael Mar 14 '11 at 8:28

I would not want to trust this in general execution without a lot of content tests, at which point it becomes easier to feed it through a macro processor instead of trying to substitute shell variables into it. I strongly recommend going that way instead. That said, something like this should work:

f="$(mktemp)" || exit 1
{echo '/sbin/iptables-restore <<__EOF'; cat iptables.rules; echo '__EOF'} >"$f"
. "$f"
rm "$f"
share|improve this answer
    
In Bash (note that the question is tagged [bash], but the shebang is #!/bin/sh), you can source something on the fly without a temporary file: source <(echo '...'; echo "$(<iptables.rules)"; echo '...') –  Dennis Williamson Mar 14 '11 at 4:26

If iptables.rules contains:

RULES="-A OUTPUT -o $EXTIF -s $UNIVERSE -d $INTNET -j REJECT"

And your script sources that file, then the variables will be evaluated.

#!/bin/sh

EXTIF="eth0"
INTIF="eth1"

INTIP="192.168.0.1/32"
EXTIP=$(/sbin/ip addr show dev "$EXTIF" | perl -lne 'if(/inet (\S+)/){print$1;last}');

UNIVERSE="0.0.0.0/0"
INTNET="192.168.0.1/24"
. iptables.rules

/sbin/iptables-restore -v < $RULES
share|improve this answer
    
no, unfortunately... –  Michael Mar 14 '11 at 2:23
    
That wouldn't work anyway: $RULES isn't the name of a file. echo "$RULES" | /sbin/iptables-restore -v would work if iptables.rules were set up correctly. –  geekosaur Mar 14 '11 at 3:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.