Can I remove multiple matching rules with the iptables --delete command

Question

The iptables --append (-A) command allows you to add multiple identical rules, and you seem to have to run the same number of --delete (-D) commands to remove them again.

The iptables manpage says that the --delete command can delete one or more rules from the selected chain. How do I get the --delete command to remove all matching rules in a single operation?

In a script I can loop calling --delete until I get a non-zero exit status, but this seems crufty.

$ # Add two identical rules.
$ /sbin/iptables --append OUTPUT --protocol tcp --destination example.com --jump DROP
$ /sbin/iptables --append OUTPUT --protocol tcp --destination example.com --jump DROP
$ /sbin/iptables -L OUTPUT -v
Chain OUTPUT (policy ACCEPT 6 packets, 780 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       tcp  --  any    any     anywhere             93.184.216.119
    0     0 DROP       tcp  --  any    any     anywhere             93.184.216.119

$ # Delete a single rule - can this remove all rules?
$ /sbin/iptables --delete OUTPUT --protocol tcp --destination example.com --jump DROP
$ /sbin/iptables -L OUTPUT -v
Chain OUTPUT (policy ACCEPT 6 packets, 716 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 DROP       tcp  --  any    any     anywhere             93.184.216.119

I'm using iptables v1.4.18 on Amazon Linux (their EC2 base image)

Answer 1

I'm afraid you can't do it using just the iptables command line options. What you can do instead is use shell capabilities and xargs:

$ iptables [-t table] -S [chain] | grep [your pattern] | cut -d " " -f 2- | xargs -rL1 iptables [-t table] -D

For example, using your numbers above:

$ iptables -S OUTPUT | grep 93.184.216.119 | cut -d " " -f 2- | xargs -rL1 iptables -D

You can use it also for different tables:

$ iptables -t nat -S | grep 93.184.216.119 | cut -d " " -f 2- | xargs -rL1 iptables -t nat -D

I know this is an old question and probably won't be very helpful to OP, but maybe someone else will stumble upon this problem.