iptables -Z clears the per-rule counters, but not the chain policy counters (Andy Gay <andy@andynet.net>)
https://bugzilla.netfilter.org/bugzilla/show_bug.cgi?id=502
diff --git a/libiptc/libiptc.c b/libiptc/libiptc.c
index 779df34..feb4379 100644
--- a/libiptc/libiptc.c
+++ b/libiptc/libiptc.c
@@ -1656,6 +1656,9 @@
return 0;
}
+ if (c->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
+ c->counter_map.maptype = COUNTER_MAP_ZEROED;
+
list_for_each_entry(r, &c->rules, list) {
if (r->counter_map.maptype == COUNTER_MAP_NORMAL_MAP)
r->counter_map.maptype = COUNTER_MAP_ZEROED;