How might one version control Linux kernel firewall rules?

Question

Our router is CentOS but we just use iptables to modify Linux kernel firewall rules. There is a script that's under version control which resets all the chains/rules, but in doing so drops all existing connections and generally causes havoc if run during office hours. This means the usual method for altering the firewall rules is using iptables 'on-the-fly'. This can result in modifications to the firewall not making it back to version control.

What I'm trying to work out is how to check if there have been any modifications to the firewall since a particular version of the script in Subversion.

The output from iptables --list is quite different from a line in the script which typically look something like iptables -A chain -j ACCEPT -s 192.168.1.100.

Is there an easier/better way of keeping Linux kernel firewall rules under version control?

I'm open to suggestions of alternative tools or operating systems so long as they're open source and well established.

Answer 1

I realised as soon as I asked this that there are iptables-save and iptables-restore. However I'm not sure at this point how that would work. I'll post it as an answer but I think the real solution is going to be a bit more complicated.

One could use iptables-save which prints the currently loaded chains to stdout. You can also use the -t switch to specify user defined chains. So you could output each chain to a file one by one and version control those. However I can't see an easy way of reloading chains one-by-one as the equivalent iptables-restore doesn't have the an equivalent switch (-t means test instead).

The other limitation of this method I noticed was there is no way to save the built-in chains individually (i.e. INPUT, OUTPUT, and FORWARD). The only way to get those out is by not using the -t switch and dumping everything.

It would need some scripting to wrap this all up into something one could easily save and reload.