For complex setups you sooner or later have to dynamically add/remove rules, based on values only known at runtime (such as an IP address obtained by DHCP). The

For complex setups you sooner or later have to dynamically add/remove rules, based on values only known at runtime (such as an IP address obtained by DHCP). Then, a simple list of rules doesn't suffice, and some kind of programming is needed. To solve such problems elegantly I designed my "NCD programming language" (link: https://code.google.com/p/badvpn/wiki/NCD https://code.google.com/p/badvpn/wiki/NCD ). The language has built-in backtracking, so in the case of iptables, the language itself makes sure any iptables rule that was added is also removed when that is necessary, in a manner not unlike exception handling in C++ etc. Link to iptables module: https://code.google.com/p/badvpn/source/browse/trunk/ncd/modules/net_iptables.c https://code.google.com/p/badvpn/source/browse/trunk/ncd/mod...