Newbie Necro-post:
Lately, I'm finding that nf/iptables reports it's busy so whatever --delete,
--flush, or -X argument that was issued with the iptables command simply has no effect. Thereby, I sometimes do end up with some mixture of new configuration rules, along with some unwanted artifact rules from a previous iptables configuration, getting saved with iptables-save.
While it's not a 100% cure, I suffix any iptables commands with --wait, along with whatever other arguments I intend, such as -X.
I think it's still worthwhile to augment
-X precautions with --flush, --delete and maybe make a null-firewall .rules file to restore with iptables-restore.
I can check in a bash shell script, using awk, if there's more than the default 38 lines resulting from an iptables --list command showing an empty configuration
EXITCOND1=0
iptables --list | awk '{ ++cnt; /
if (cnt < 40 ) exit level 1: /
print } '
EXITCOND1=$(echo $?)
if [ $EXITCOND1 == 0 ];
then
echo "There are firewall rules"
else
echo "There are no firewall rules"
fi
Obviously you all know to replace the "echo" statements with your own handling code. You can also use similar code to check line length and --log-prefix content
in case you coincidentally do have only 38-40 lines of code in your iptables configuration.
(I'm typing this on my phone. I hope spell check didn't help me screw this up.)
Great ideas in your posts folks. Thanks.