Neutron Security Group Logging

#!/bin/bash
# This script looks in iptables to see if Neutron security groups have been initalised and then adds
# the following rule if it does not already exist:
# -I neutron-openvswi-sg-fallback -m limit --limit 6/min -j LOG --log-prefix "Neutron-Dropped: " -m comment --comment "Log rule for unmatched traffic"
CHAINNAME=neutron-openvswi-sg-fallback
RULE='-m limit --limit 6/min -j LOG --log-prefix "Neutron-Dropped: " -m comment --comment "Log rule for unmatched traffic"'

# Find out where iptables is
if IPTABLES=$(which iptables)
then
    # Confirm the neutron-openvswi-sg-fallback chain exits
    if $IPTABLES -S | grep -q "\-N $CHAINNAME"
    then
        # See if the LOG entry exists in that chain
        if ! $IPTABLES -S | grep "\-A $CHAINNAME" | grep -q LOG
        then
            # Create the rule
            eval $IPTABLES -I $CHAINNAME $RULE
        fi
    fi
fi