Re: iptables-save output using dotted quad netmask rather than CIDR

Tim Connors writes:

-A RH-Firewall-1-INPUT -s 12.3.4.5/16 -p tcp -m tcp -j ACCEPT

One gotcha, which applies at -restore time, but not at -save time: Like IPv6, in IPv4 you can omit .0 segments: 1.4 --> 1.0.0.4 1.2.4 --> 1.2.0.4 (I think - might be 1.0.2.4) iptables-restore understands this. However, if there is a CIDR it expands differently: 1.4/24 --> 1.4.0.0/24 1.2.4/24 --> 1.2.4.0/24