1

EXAMPLE:

iptables

:internet - [0:0] -A internet -m mac --mac-source 48:5D:60:FC:29:B0 -j RETURN

COMMIT

[root@localhost:~ ] $ arp

Address HWtype HWaddress Flags Mask Iface

10.2.0.1 ether 48:5D:60:FC:29:B0 C br0

i would like to delete the iptable rule (-D internet -m mac --mac-source 48:5D:60:FC:29:B0 -j RETURN) if the mac on ARP list is not present.

dannymagat
  • 13
  • 4
  • Could you provide some data (source) sample because it is OS/system dependant. Some few f/e/grep should solve the problem (eventually a sed) – NeronLeVelu Dec 17 '13 at 08:28
  • EXAMPLE: **iptables** :internet - [0:0] -A internet -m mac --mac-source 48:5D:60:FC:29:B0 -j RETURN COMMIT [root@localhost:~ ] $ arp Address HWtype HWaddress Flags Mask Iface 10.2.0.1 ether 48:5D:60:FC:29:B0 C br0 i would like to delete the iptable rule (-D internet -m mac --mac-source 48:5D:60:FC:29:B0 -j RETURN) if the mac on ARP list is not present. – dannymagat Dec 17 '13 at 08:54
  • is there any approach in iptables to delete the line it self if there is not packet passing through? that consider as an IDLE – dannymagat Dec 17 '13 at 09:00
  • (update your question, unluckily comment are missing the format) – NeronLeVelu Dec 17 '13 at 09:06

1 Answers1

1

In what language would you like that script to be? Any? Because with a shell script that's tedious to say the least...

You could otherwise save the result of your arp + grep and iptables -L in 2 different files, then load those two files in an array. Then it becomes pretty easy, you go through one of the array and if it exist / does not exist in the other, then delete.

arp |grep br0 | perl -nle '/her   ([^ ]+)/ && print $1' >file1.txt
iptables -t mangle -L -v -n |grep MAC | perl -nle '/MAC ([^ ]+)/ && print $1' >file2.txt
php do-delete.php

And the do-delete.php could be loading the files and run a system() call to delete the entries:

<?php
$f1 = file("file1.txt");
$f2 = file("file2.txt");
$to_delete = array_diff($f2, $f1);
foreach($to_delete as $mac)
{
  system('iptables -t mangle -D internet -m mac --mac-source ' . $mac . ' -j RETURN');
}

Something like that... (NOTE TESTED!) Notice how the array_diff() call is easy! Nothing of the sort that I know of in a shell script.

You could also print out the resulting table back in a file.

file_put_contents('file3.txt', join($to_delete, "\n") . "\n");

Then use that to do the delete from the shell...

Also you could use PHP to generate the first two files using popen().

Alexis Wilke
  • 2,210
  • 1
  • 20
  • 37
  • Thanks Alexis... the idea of using array_diff() is good.. i will try this function... how about is bash script... – dannymagat Dec 17 '13 at 09:24
  • Thank guys it works now... i basically during the login save the mac in database and start the cron to check each time to see if still exist in arp table if not the delete the iptables rule with the user mac – dannymagat Dec 17 '13 at 10:09
  • What I call the shell is bash or sh. There is easy equivalent to the array_diff(). The only way I know of is using grep on each IP and that would be terribly slow. – Alexis Wilke Dec 17 '13 at 10:34
  • Typed too fast I guess, I meant to say "there is NO easy equivalent". – Alexis Wilke Dec 17 '13 at 23:11