是否有用于像 iptables 那样操作数据包过滤链的 Ruby API？
我一直在 netfilter/iptables 主页上崩溃并恳求 Google，但到目前为止还没有运气。
我有一个 Rails 应用程序，需要控制其 Linux 主机的数据包过滤。当然，它可以通过将规则转储到 /etc/sysconfig/iptables 并弹起 iptables 启动脚本来做到这一点。但如果它能够通过 API 无缝地进行调用，那就更好了。
该应用程序的要求实际上非常非常简单；它只需要添加和删除给定源 IP 地址到服务器上给定 TCP 端口的 ACCEPT 规则，即可控制对该服务的访问。
我发现了对 ruby-iptables 项目的引用，但该项目显然在几年前就已经停滞不前了。
如果我不得不求助于原始的 getsocketopt() 调用等，我只会采用文本文件并重新启动的方法，这会冒犯我的 Slickness 传感器，但会让我的客户微笑，因为他比真正的软件更喜欢工作软件优雅的软件很快就能运行。
I've been crashing around on the netfilter/iptables home page as well as beseeching The Google, but no luck so far.
I have a Rails application which needs to control packet filtering for its Linux host. It could do this by just dumping rules into /etc/sysconfig/iptables and bouncing the iptables startup script, of course. But it would be sweeter if it could just seamlessly make the calls via an API.
The app's requirements are actually very very simple; it only needs to add and delete ACCEPT rules for a given source IP address to a given TCP port on the server, to control access to that service.
I found references to a ruby-iptables project, but that apparently went moribund some years ago.
If I have to resort to raw getsocketopt() calls and the like, I'll just do the text-file-and-restart approach, which will offend my Slickness Sensor but make my customer smile, because he likes working software better than really elegant software that will work Very Soon Now.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您搜索“ruby netfilter”，则会发现更多内容。 NetFilter (http://netfilter.org/) 是 iptables 背后的底层框架。
http://rubyipq.rubyforge.org/（流量整形）
https://github.com/johnl/netfilter.rb (DSL)
http://rubyforge.org/projects/iptcext/ （IPTC库接口）
最后一个最像你想要什么，但是虽然有代码，但似乎没有真正的版本。
If you search for "ruby netfilter" there's more to be found. NetFilter (http://netfilter.org/) is the underlying framework behind iptables.
http://rubyipq.rubyforge.org/ (traffic shaping)
https://github.com/johnl/netfilter.rb (DSL)
http://rubyforge.org/projects/iptcext/ (IPTC library interface)
The last is most like what you want, but while there's code, there doesn't seem to be a real release.