Two other tips: a lot of the ip commands have idempotent versions too. Look for the “replace” versions of each command. Also, if you have a complex firewall t

Two other tips: a lot of the ip commands have idempotent versions too. Look for the “replace” versions of each command. Also, if you have a complex firewall then putting your rules in your own chain and inserting that chain into a top level chain is the idempotent way: iptables -D FORWARD -j LOL || true iptables -F LOL || true iptables -X LOL || true iptables -N LOL iptables -I FORWARD -j LOL …and then add your task specific rules to your own LOL chain and leave everyone else’s alone. Much nicer than polluting the top level chains with the iptables equivalent of global variables. You can work on your own but if the firewall without clobbering all the other stuff.