18

I have this iptable rules:

-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -i lo -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -j DROP
-A fail2ban-ssh -s xx.xxx.xx.xx/32 -j REJECT --reject-with icmp-port-unreachable
-A fail2ban-ssh -j RETURN
-A fail2ban-ssh -j RETURN

The lines

-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh

and

-A fail2ban-ssh -j RETURN

seems to be duplicated or written twice. How can I remove the duplicate?

  • Open up the file in your favourite editor, go to the line in question, hold down the delete key until all of the characters disappear. Am I missing something obvious about why this is difficult? – Ladadadada Sep 15 '14 at 14:19
17

List with line numbers and delete by number.

iptables --line-numbers --list

Then delete one rule using it's line number. Then repeat (line numbers change for following rules when one is deleted so re-list before deleting another).

iptables -D INPUT 6
  • 2
    Thanks for this buddy! Will accept this in a matter of minutes. – Leandro Garcia Sep 15 '14 at 13:48
  • Will this remain persistent after a reboot? – Native Coder Nov 16 '16 at 17:05
10
iptables-save | uniq | iptables-restore

That is all you need really.

  • 2
    AFAICT, this will only remove adjacent duplicates. It will fail to remove non-adjacent duplicates. – sampablokuper Jan 16 '18 at 3:36
4

If you only want to delete double lines that are directly one after another you can export, unify and reimport it with

mkdir ~/tmp
iptables-save > ~/tmp/iptables.conf
uniq /tmp/iptables.conf > ~/tmp/iptables_new.conf
iptables-restore < ~/tmp/iptables_new.conf

If you want to delete other lines use an editor on ~/tmp/iptables.conf before you reimport it the same way.

Check your new rules with

iptables-save
  • If stripping adjacent duplicates is what you seek, then Ricky Neff's answer is more secure, because it avoids exposing firewall the rules to other users who have access to /tmp. – sampablokuper Jan 16 '18 at 18:10
  • 1
    thx, you are right, you shouldn't use /tmp cause it is world-readable. I changed it to ~/tmp – rubo77 Jan 16 '18 at 19:17
2

A comment to fail2ban: fail2ban seems to add its iptables rules itself. So you should not store these rules with e.g. iptables-save. Then after a reboot the rules will be doubled (your saved rule + the rule added by fail2ban).

2

Delete all duplicated lines except COMMIT

/sbin/iptables-save | awk '!COMMIT||!x[$0]++' | /sbin/iptables-restore
0

I am using such a small bash script which runs through cron.

     #!/bin/bash 
         readarray -t tabl_lines <<< "$(iptables -nL INPUT --line-number | grep "fail2ban-ssh")"
            i=''
            for tline in "${tabl_lines[@]}"
            do 
            #skip the first result
            if [ -n "$i" ]; then
            sudo iptables -D INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
            # if necessary, you can erase and other rules, 
            # because they usually repeat the same number of times
            # sudo iptables -D INPUT -p tcp -m multiport --dports 21 -j fail2ban-vsftpd
save_iptables=yes
            else 
            i=start_remove
            fi
            done
if [ "$save_iptables" == "yes" ]; then
/sbin/service iptables save
fi

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.