DNS script check

[zbugrkx]

Hi.

I'm using a script to inject iptables rules for dns/masquerade.

The issue happens that sometimes a configuration/failover will cause the UDM to reload the firewall and nuke the rules.

Is there a way (and if someone has an east to understand/copy) to run a script/cron to check for these firewall rules already exist and either re-apply or ignore and check next time.

Thanks in advance for any help, appreciated !
Regards

[m4n63]

Use the --check option to first check if it exists, like in this example:

iptables --check FORWARD -s 192.168.30.218 -d 192.168.10.203 -p tcp --dport 1883 -j ACCEPT || iptables -I FORWARD -s 192.168.30.218 -d 192.168.10.203 -p tcp --dport 1883 -j ACCEPT

[zbugrkx]

Ah! right got you. Understand now what these does.

So then, do you essentially run a cronjob with your .sh script with all your iptables and let it do its life? I'm currently doing that, just without the || so it just keeps trying to apply my rules but fails. This would be the same but "nicer" assuming the cronjob part is right :)

[zbugrkx]

My rules are like this, so i'm not sure how to do a "check" against them:

iptables -t nat -A PREROUTING -m set ! --match-set dnsipv4 src -p tcp --dport 53 -j DNAT --to 192.168.1.10

[zbugrkx]

Ok, I found that I just needed to put -C after the -t nat and it works! Thanks a ton!

Any idea if there is a way to do the same for ipset create? That being said, it won't create a duplicate just errors out as already existing so probably fine.

[m4n63]

This would be the same but "nicer" assuming the cronjob part is right :)

While a cronjob will do the job, firewall rules are usually executed early at boot using a startup script. I think most people here use the on-boot-script for these things.

[zbugrkx]

Yep! all my rules are in the boot script but on top of it, i have a cronjob runing that script every hour. Reason being that any changes or updates or failovers will cause the firewall to reload and script is gone until you reboot :).

Thanks a ton for the help and insight! everything seems to work great so far!3