Delete iptables rules with sed -z and xargs -0.

[Hongyi Zhao]

I want to delete some iptables rules shown as following:

$ sudo iptables-save | grep -- '--dport 53'
-A PREROUTING -s 172.17.0.0/16 -i docker0 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.53
-A PREROUTING -s 172.17.0.0/16 -i docker0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.53


So I try to construct the command using sed and xargs as follows:

$ sudo iptables-save | grep -- '--dport 53' | sed -z 's/^-A/-D/' | xargs -0 -I{} echo sudo iptables {}
sudo iptables -D PREROUTING -s 172.17.0.0/16 -i docker0 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.53
-A PREROUTING -s 172.17.0.0/16 -i docker0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.53


As you can see, this can only construct the first command correctly. Any hints for this problem?

Regards,
HY

[Hongyi Zhao]

On Monday, November 2, 2020 at 10:36:55 AM UTC+8, Hongyi Zhao wrote:
> I want to delete some iptables rules shown as following:
>
> $ sudo iptables-save | grep -- '--dport 53'
> -A PREROUTING -s 172.17.0.0/16 -i docker0 -p udp -m udp --dport 53 -j DNAT --to-destination 127.0.0.53
> -A PREROUTING -s 172.17.0.0/16 -i docker0 -p tcp -m tcp --dport 53 -j DNAT --to-destination 127.0.0.53
>
>
> So I try to construct the command using sed and xargs as follows:
>
> $ sudo iptables-save | grep -- '--dport 53' | sed -z 's/^-A/-D/' | xargs -0 -I{} echo sudo iptables {}

Based on the example given on <https://stackoverflow.com/questions/15976570/is-there-a-grep-equivalent-for-finds-print0-and-xargss-0-switches>


find /etc/passwd -print0 |
xargs -0 egrep -Z 'root|www' |
tr "\n" "\0" |
xargs -0 -n1


The commands used here for my case should have been written as the following:


$ sudo iptables-save | grep -- '--dport 53' | sed 's/^-A/-D/' | tr "\n" "\0" | xargs -0 -I{} echo sudo iptables {}

or

$ sudo iptables-save | grep -- '--dport 53' | tr "\n" "\0"| sed -z 's/^-A/-D/' | xargs -0 -I{} echo sudo iptables {}

[Chris Elvidge]

I really can't be bothered setting up iptables at the moment but:
How about:
IFS=$'\n'
for i in $(iptables-save | grep -- '--dport 53') do
echo "sudo iptables ${i/-A/-D}"
done


--

Chris Elvidge, England

[Hongyi Zhao]

Thanks for your solution. BTW, the method I suggested above can be further simplified as follows:


$ sudo iptables-save | grep -Z -- '--dport 53' | sed -z 's/^-A/-D/' | xargs -0 -I{} echo sudo iptables {}

Regards,
HY

[Chris Elvidge]

But why are you insisting on using sed and xargs? They're not needed,
and only waste processes.


--

Chris Elvidge, England

[Hongyi Zhao]

> and only waste processes.、

From the perspective of time efficiency, for most cases, my solution is more convenient for typesetting/inputting/constructing the command line code, so maybe has a smaller total time overhead.

Regards,
HY