You can just unload iptables
' modules from the kernel:
modprobe -r iptable_raw iptable_mangle iptable_security iptable_nat iptable_filter
UPD Unfortunately, too good to be true. As long as there's a rule or a user-defined chain in a table, corresponding module's reference count is 1, and modprobe -r
fails. You might delete rules and user-defined chains like so:
echo $'*raw\nCOMMIT\n*mangle\nCOMMIT\n*security\nCOMMIT\n*nat\nCOMMIT\n*filter\nCOMMIT' | iptables-restore
or:
iptables-save | awk '/^[*]/ { print $1 "\nCOMMIT" }' | iptables-restore
Also, you might want to unload modules this way (no hardcoding module names):
lsmod | egrep ^iptable_ | awk '{print $1}' | xargs -rd\\n modprobe -r
On the bright side, after this iptables-save
produces nice empty output :)