Actually, I do have the question of why you have to change your iptables ruleset all the time.
However, if you just want to test-out some new rules, here's how:
Do iptables-save > iptsave.sh
(the .sh is to enable the nice vim highlighting)
vi iptsave.sh
and do your changes
iptables-apply -t 600 iptsave.sh
= 600 seconds of testing time, after which iptables-apply
automatically reverts to the prior ruleset. Or, you can press y and the new ruleset becomes permanent. DO NOT USE <
THERE!! iptables-apply
accepts a file name as an argument, not as a STDIN.
mv iptsave.sh /etc/iptables.rules
And within the main iptables conf file another iptables rules file can be linked which can be made editable by users who have less privileges.
But why??
The iptables ruleset is meant to be made once, and modified only every now and then. If you have to keep changing it all the time, I think you're not implementing iptables in the most efficient/effective way.
Customizable & Updatable MAC rules
First of all, ensure that MAC testing branches off to a different chain. I suggest also 'splitting' the INPUT chain (I drop the iptables
command for brevity)
-N MAC_admins
-N MAC_users
-N INPUT_2
-A INPUT -j MAC_admins
-A INPUT -j MAC_users
-A INPUT -j DROP
... rest of -A INPUT is put into -A INPUT_2 ...
MAC_admins
is for the admins' MAC addresses, so it won't get hosed (and thus locking you out):
-A MAC_admins -m mac --mac-source 11:11:11:11:11:11 -g INPUT_2
-A MAC_admins -m mac --mac-source 22:22:22:22:22:22 -g INPUT_2
-A MAC_admins -m mac --mac-source 33:33:33:33:33:33 -g INPUT_2
Users whose MAC does not match anything there will be returned to the INPUT chain, and endure the 2nd MAC-checking chain. Now, to populate this chain, let's make a script. Assume it's /etc/firewall/UpdateMAC.sh
#!/bin/bash
readonly CONFDIR="/etc/firewall/maclists"
readonly IPT="/sbin/iptables"
readonly WORKCHAIN="MAC_users"
readonly NEXTCHAIN="INPUT_2"
readonly MACPATTERN="^([a-f0-9]{2}:){5}[a-f0-9]{2}$"
# Flush the chain (i.e., remove all rules in the chain)
$IPT -F $WORKCHAIN
for f in $CONFDIR/*
do
while read mac; do
[[ -z $mac ]] && continue # Skip empty lines
[[ ${mac:0:1} == "#" ]] && continue # Skip comments (if any)
# A regex check to ensure that $mac indeed contains a MAC address
if [[ $mac =~ $MACPATTERN ]]; then
$IPT -A $WORKCHAIN -m mac --mac-source $mac -g $NEXTCHAIN
fi
done < $f
done
exit 0
# Tested on bash v4
Now do some magic with chmod
and chown
. Have your subadmins edit one (or more) files under /etc/firewall/maclists/
, and whenever they've edited their file(s), you just execute the script.