A Plumber's Wish List for Linux

I'm hardly an expert on iptables, but it seems that, apart from using iptables-restore, you could also use an intermediate chain as a sort of "function pointer" to switch from the old rules to the new ones with a single update:

# set up the initial rules
iptables -N real-chain-1
iptables -A real-chain-1 ...

# create the indirect chain
iptables -N replaceable-chain
iptables -A replaceable-chain -g real-chain-1

# use it
iptables ... -j replaceable-chain

# later...

# set up the new rules
iptables -N real-chain-2
iptables -A real-chain-2 ...

# switch to the new rules
iptables -R replaceable-chain 1 -g real-chain-2

# clean up
iptables -F real-chain-1
iptables -X real-chain-1