Adding new iptables

Shell Programming and Scripting
1

Hi, I basically want to create a shell script that reads in the /etc/sysconfig/iptables. When it sees the line "-A INPUT -j REJECT --reject-with icmp-host-prohibited" it will create a new line before it and add in the line from another file which will have "-A INPUT -p udp -m udp --dport 27020 -j ACCEPT"
So it will look like:
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p udp -m udp --dport 27020 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

2

Should be something like:

line=`grep your line from the file here`

awk -v var="$line" '/-A INPUT -j REJECT --reject-with icmp-host-prohibited/{print var}1' /etc/sysconfig/iptables

Regards

3

Or with sed:

sed '/-A INPUT -j REJECT --reject-with icmp-host-prohibited/i\
-A INPUT -p udp -m udp --dport 27020 -j ACCEPT' file >newfile

There are different dialects of sed so you might need to experiment a bit -- the backslash might or might not be necessary.

4

Wierd...since I tried both examples and still didnt work :frowning:

5

Did you get errors, no output or wrong output?

Regards

6

I'm guessing you might have multiple spaces in your input file, but we can't see those because you didn't use code tags -- please post again with those tags around the sample so we can see the spaces if you can't solve this on your own.

7

Yup, in both cases the output is the same as the original iptables file with no modification being done into a new file.

line=`cat ports | grep 27020`
*** the cat grabs the line -A INPUT -p udp -m udp --dport 27020 -j ACCEPT ***
awk -v var="$line" '/-A INPUT -j REJECT --reject-with icmp-host-prohibited/{print var}1' iptables >newiptables

sed '/-A INPUT -j REJECT --reject-with icmp-host-prohibited/i\
-A INPUT -p udp -m udp --dport 27020 -j ACCEPT' iptables >newiptables

This seems to be interesting. you may be right that it could be a spaces issue.

8

It seems that the line "-A INPUT -j REJECT --reject-with icmp-host-prohibited" don't match exactly with line you want to replace in the file iptables.

Regards