As you may have already wondered, can iptables-restore
handle any kind of scripting? So far, no, it cannot and it will most
probably never be able to. This is the main flaw in using
iptables-restore since you will not be able to
do a huge set of things with these files. For example, what if you have a
connection that has a dynamically assigned IP address and you want to
grab this dynamic IP every-time the computer boots up and then use that
value within your scripts? With iptables-restore, this
is more or less impossible.
One possibility to get around this is to make a small script which grabs
the values you would like to use in the script, then sed the
iptables-restore file for specific keywords and replace
them with the values collected via the small script. At this point, you
could save it to a temporary file, and then use
iptables-restore to load the new values. This causes a
lot of problems however, and you will be unable to use
iptables-save properly since it would probably erase
your manually added keywords in the restore script. It is, in other words, a
clumsy solution.
Another solution is to load the iptables-restore
scripts first, and then load a specific shell script that inserts more
dynamic rules in their proper places. Of course, as you can understand,
this is just as clumsy as the first solution.
iptables-restore is simply not very well suited for
configurations where IP addresses are dynamically assigned to your
firewall or where you want different behaviors depending on configuration
options and so on.
Another drawback with iptables-restore and
iptables-save is that it is not fully functional as of
writing this. The problem is simply that not a lot of people use it as of
today and hence there are not a lot of people finding bugs, and in turn
some matches and targets will simply be inserted badly, which may lead to
some strange behaviors that you did not expect. Even though these
problems exist, I would highly recommend using these tools which should
work extremely well for most rule-sets as long as they do not contain some
of the new targets or matches that it does not know how to handle
properly.
