adding pos, and directly ban and allow ip

src/iptables_wrapper.rs

@@ -1,11 +1,16 @@
-pub fn ban_port(port: u16, docker: bool) {
+use iptables::IPTables;
+
+pub fn ban_port(port: u16, docker: bool, position: Option<i32>) {
     let iptables = iptables::new(false).unwrap();
 
-    let _ = iptables.append_unique(
-        "filter",
-        &get_chain(docker),
-        &format!("-p tcp --dport {} -j DROP", port),
-    );
+    let table = "filter";
+    let chain = get_chain(docker);
+    let rule = format!("-p tcp --dport {} -j DROP", port);
+    if let Some(position) = position {
+        insert_unique(&iptables, table, &chain, &rule, position)
+    } else {
+        append_unique(&iptables, table, &chain, &rule)
+    }
 
     println!("banned port {}", port);
 }
@@ -21,13 +26,18 @@ pub fn unban_port(port: u16, docker: bool) {
     println!("unbanned port {}", port);
 }
 
-pub fn allow_ip_port(ip: &str, port: u16, docker: bool) {
+pub fn allow_ip_port(ip: &str, port: u16, docker: bool, position: Option<i32>) {
     let iptables = iptables::new(false).unwrap();
-    let _ = iptables.append_unique(
-        "filter",
-        &get_chain(docker),
-        &format!("-p tcp --dport {} -s {} -j ACCEPT", port, ip),
-    );
+
+    let table = "filter";
+    let chain = get_chain(docker);
+    let rule = format!("-p tcp --dport {} -s {} -j ACCEPT", port, ip);
+    if let Some(position) = position {
+        insert_unique(&iptables, table, &chain, &rule, position)
+    } else {
+        append_unique(&iptables, table, &chain, &rule)
+    }
+
     println!("allowed {} to access {}", ip, port);
 }
 
@@ -48,3 +58,11 @@ fn get_chain(docker: bool) -> String {
         "INPUT".to_string()
     }
 }
+
+fn append_unique(iptables: &IPTables, table: &str, chain: &str, rule: &str) {
+    let _ = iptables.append_unique(table, chain, rule);
+}
+
+fn insert_unique(iptables: &IPTables, table: &str, chain: &str, rule: &str, position: i32) {
+    let _ = iptables.insert_unique(table, chain, rule, position);
+}