Shorewall stop script which backs up Kubernetes and Cilium iptables chains

etc_shorewall_stop

#
# the idea is not mine:
#
# https://blog.discourse.org/2015/11/shorewalldocker-two-great-tastes-that-taste-great-together/#
#

BACKUP=/etc/shorewall/kubernetes_rules

# Kubernetes adds its own chains e.g. KUBE-SERVICES
if iptables -t filter -L KUBE-SERVICES >/dev/null 2>&1; then

    echo Backup Kubernetes specific rules

    # nat table
    echo '*nat' > $BACKUP
    # k8s rules start with KUBE-
    iptables -t nat -S | grep -- '-[AN] KUBE-' >> $BACKUP

    # Cilium rules start with CILIUM
    iptables -t nat -S | grep -- '-[AN] CILIUM' >> $BACKUP

    echo 'COMMIT' >> $BACKUP

    # filter table
    echo '*filter' >> $BACKUP
    # k8s rules start with KUBE-
    iptables -t filter -S | grep -- '-[AN] KUBE-' >> $BACKUP
    # Cilium rules start with CILIUM
    iptables -t filter -S | grep -- '-[AN] CILIUM' >> $BACKUP

    echo 'COMMIT' >> $BACKUP

    # now Cilium mangle (Kubernetes doesn't seem to use mangle)
    echo '*mangle' >> $BACKUP
    iptables -t mangle -S | grep -- '-[AN] CILIUM' >> $BACKUP

    echo 'COMMIT' >> $BACKUP

    # and Cilium raw (Kubernetes doesn't seem to use raw)
    echo '*raw' >> $BACKUP
    iptables -t raw -S | grep -- '-[AN] CILIUM' >> $BACKUP

    echo 'COMMIT' >> $BACKUP

fi