I want to add a rule using
iptables, but only if it does not exist already.
-C which will allow us to check if a rule specification exists already. The option is described in this Q&A as well.
From that Q&A, this specific answer says how one could use
-D (delete) option instead, which will delete the rule if exists, or it'll exit with code 1 if it doesn't. (Which is exactly what
-C does if the rule doesn't exist, so it won't be a problem).
And to me it feels more convenient to do
ip6tables -D OUTPUT -p icmpv6 --icmpv6-type destination-unreachable -j DROP ip6tables -A OUTPUT -p icmpv6 --icmpv6-type destination-unreachable -j DROP
Rather than checking if exists, deleting it if it does, and only then adding the new rule.
However, someone in the comment mentioned that it opens a hole in the firewall and I fail to see how.
Bottom line: why shouldn't I blindly delete and append the rule rather than checking before deleting & adding?