Y'all may remember me fighting this a few weeks back. I did finally succeed, and thought that my awk script might be helpful to others. Yes, it's really simple, it uses the build-in FORWARD chain. The line where I skip the definition of those chains is because it *is* built in. To use it, I did an iptables-save on the firewall that's currently in use, changed the physdev devices to match the ones on the new box (I *loathe* that idiot varying name convention, it is *not* helpful, and then ran it through this script. I piped the o/p into a file, then sh scriptname did the actual install. Following that, I did firewall-cmd --reload, and all was wonderful, and I could ping the system inside the firewall, and from the subnet in our building (the new one's in the datacenter), but not from anywhere else, so the rules worked.
Note that I did the work, I work for a US gov't federal contractor, so this was done on tax dollars, and should be free of any encumberment.
Hope it helps, folks.
BEGIN { priority = 1; } { if ( $0 ~ /^-A/ ) { if ( $2 ~ /^INPUT|^FORWARD/ ) { next; } else { rule = substr( $0, index($0, $3)); } print "firewall-cmd --permanent --direct --add-rule ipv4 filter FORWARD " priority++ " " rule; } }
mark