Iptables rules deduplication script (with ipv6 support) **v6 only lightly tested**

ipt-dedup.sh

#!/bin/sh

ipt="iptables -w"
ip6t="ip6tables -w"

dedup() {
    iptables-save | sed -n "/$1/,/COMMIT/p" | grep "^-" | sort | uniq -dc | while read l
    do
        c=$(echo "$l" | sed "s|^[ ]*\([0-9]*\).*$|\1|")
        rule=$(echo "$l" | sed "s|^[ ]*[0-9]* -A\(.*\)$|-t $1 -D\1|")
        while [ ${c} -gt 1 ]; do
            echo "iptables $rule"
            eval "${ipt} ${rule}"
            c=$((c-1))
        done
    done
}

dedup6() {
    ip6tables-save | sed -n "/$1/,/COMMIT/p" | grep "^-" | sort | uniq -dc | while read l
    do
        c=$(echo "$l" | sed "s|^[ ]*\([0-9]*\).*$|\1|")
        rule=$(echo "$l" | sed "s|^[ ]*[0-9]* -A\(.*\)$|-t $1 -D\1|")
        while [ ${c} -gt 1 ]; do
            echo "ip6tables $rule"
            eval "${ip6t} ${rule}"
            c=$((c-1))
        done
    done
}

dedup "filter"
dedup "nat"
dedup "mangle"
dedup6 "filter"
dedup6 "nat"
dedup6 "mangle"