matching -d to a given interface without specifying ip address

Danny Rathjens gmane at
Wed Sep 6 20:11:08 CEST 2006

Dmitri wrote:
> The problem with specifying an IP is that it may change, which breaks 
> the rules and requires an update (and detection as well). Event for a 
> static IP, that's an extra dependency to watch out for.
That's what variables in your firewall script are for.
Just re-run it when your network connection restarts:
EXTIP=`ifconfig $EXTIF |perl -ne'print $1 if /inet addr:([\d.]+)/'`
iptables -A INPUT -j ACCEPT -i $EXTIF -p tcp -d $EXTIP --dport 80
     _.,-*~`^'~*-,._ Danny Rathjens _.,-*~`^'~*-,._
FireCast: Rock solid kiosk software:

More information about the netfilter mailing list