Dotaz: iptables - zjisteni pritomnosti pravidla (grep)

[ip]

Ahoj, potrebuju zjistit, zda je v firewallu pridane urcite pravidlo. Napr. chci zjisit jestli jsem pridal:

iptables -A OUTPUT -o eth0 -s 192.168.1.5 -j REJECT --reject-with icmp-admin-prohibited

tak pouziju iptables-save:

root ~ # iptables-save
# Generated by iptables-save v1.4.10 on Fri May 11 15:49:03 2012
*filter
:INPUT ACCEPT [81:55122]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [80:55572]
-A OUTPUT -s 192.168.1.5/32 -o eth0 -j REJECT --reject-with icmp-admin-prohibited 
-A OUTPUT -s 192.168.1.7/32 -o eth0 -j REJECT --reject-with icmp-admin-prohibited 
COMMIT
# Completed on Fri May 11 15:49:03 2012
root ~ # 

kdyz ale pouziju grep, tak to nejde:

root ~ # iptables-save | grep "-A OUTPUT -s 192.168.1.5/32 -o eth0 -j REJECT --reject-with icmp-admin-prohibited"
grep:  OUTPUT -s 192.168.1.5/32 -o eth0 -j REJECT --reject-with icmp-admin-prohibited: neplatný argument délky kontextu
root ~ # 

jak se da pomoci grepu hledat cely ten retezec?

Neexistuje nejaka jednodussi metoda, ktera by overila pritomnost pravidla a vratila mi 0/1 nebo neco podobneho?

---

---

Odpovědi

[maleprase]

# iptables-save | grep -- "-A OUTPUT -s 192.168.1.5/32 -o eth0 -j REJECT --reject-with icmp-admin-prohibited"

[tuxmartin]

Pridat s komentrem:

iptables -A OUTPUT -o eth0 -s 192.168.1.5 -m comment --comment "REJECT_192.168.1.5" -j REJECT --reject-with icmp-admin-prohibited

a potom pomoci skriptu:

#!/bin/bash

if [ "`iptables -n -L | grep "$1"`" ]; then
	exit 0
else
	exit 1
fi

hledat:

martin # iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  192.168.1.5          0.0.0.0/0           /* REJECT_192.168.1.5 */ reject-with icmp-admin-prohibited 

martin # ./ipt REJECT_192.168.1.5
martin # echo $?
0

martin # ./ipt REJECT_192.168.1.6
martin # echo $?
1

[rADOn]

Stačí vyměnit jedno písmenko

iptables -C OUTPUT -o eth0 -s 192.168.1.5 -j REJECT --reject-with icmp-admin-prohibited

[xkucf03]

V jaké verzi iptables?

[Ash]

iptables 1.4.11