Re: [gentoo-user] IPTABLES syntax change?

[Kerin Millar <kerframil@fastmail.co.uk>]

Walter Dnes wrote:
> On Fri, Dec 28, 2012 at 01:07:11AM -0500, Michael Orlitzky wrote
>> On 12/27/2012 10:59 PM, Walter Dnes wrote:
>>>    Here's my revised "Paranoia Plus" ruleset.  Any comments?  Because I'm
>>> behind a NAT-ing ADSL router/modem, many of my rules rarely see hits.
>>> However, I do have a backup dialup connection in case of problems, so
>>> most of my rules don't specify the network interface.  A couple of
>>> notes...
>>>
>> I did a bunch of inline comments below as I was trying to understand the
>> rules. At the end I give the tl;dr, but maybe the inline comments are
>> useful too.
>
>    Thanks.  My ruleset has accumulated years of cruft.  I should really
> sit down and rewrite the thing from square 1.  I have one comment.  You
> show what appears to be a bash script for setting up the rules.  I work
> with the contents of file /var/lib/iptables/rules-save instead.
>

Calling iptables repeatedly from a shell script is not advisable. A 
better approach is described by Jan Engelhardt in his "Towards the 
perfect ruleset" document:

http://inai.de/documents/Perfect_Ruleset.pdf

The method of working with /var/lib/iptables/rules-save is very similar 
to that which he describes.

Cheers,

--Kerin