IPtables

Completely Clueless · 12-02-2013, 11:36 AM

HI all,

I've got this O'Reilly book, Linux iptables - a Pocket Reference and it's been of no use at all since the day I bought it 6 years ago. Can't find an answer to the simplest of questions in it.

Can someone tell me what the iptables command is for getting a screen dump of what rules are currently set up? Thanks.

cc.

TenTenths · 12-02-2013, 12:12 PM

Try a look at:

Code:

man iptables

And ooh...
-L List all rules in the selected chain. If no chain is selected, all chains are listed.
-S Print all rules in the selected chain. If no chain is selected, all chains are printed like iptables-save.

Completely Clueless · 12-02-2013, 12:26 PM

Quote:

Originally Posted by TenTenths

Try a look at:

Code:

man iptables

And ooh...
-L List all rules in the selected chain. If no chain is selected, all chains are listed.
-S Print all rules in the selected chain. If no chain is selected, all chains are printed like iptables-save.

Thanks for that.
Hmmm. Curious. The output from the -L option seems to indicate no firewall is in place. However, when I visit one of the firewall checker sites, it tells me all ports are operating ins stealth. Therefore I'd have expected to see the output from iptables to show 'drop' all packets rather than 'accept' as is the case here:

Code:

 # iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Should I be worried?

TenTenths · 12-02-2013, 01:06 PM

If you need/want your system firewalled then YES
if you don't need/want your system firewalled then NO

Completely Clueless · 12-02-2013, 01:15 PM

Quote:

Originally Posted by TenTenths

If you need/want your system firewalled then YES
if you don't need/want your system firewalled then NO

I see. In that case, what is the command to set all to "DROP"?

Completely Clueless · 12-02-2013, 05:32 PM

I don't understand this. The output from iptables -L indicates no firewall, yet when I check against Steve Gibson's Shields Up it shows 100% stealthing and a 'pass' result!
Anyone any ideas what's going on here?

Ser Olmy · 12-02-2013, 06:33 PM

Quote:

Originally Posted by Completely Clueless

I don't understand this. The output from iptables -L indicates no firewall, yet when I check against Steve Gibson's Shields Up it shows 100% stealthing and a 'pass' result!
Anyone any ideas what's going on here?

Shield's Up will probe the external IP address you use to access the Internet. If you're using a broadband connection of some kind, that IP address is usually assigned to the router supplied by the ISP, and not your PC.

Shield's Up is probably probing the firewall on your router.

Completely Clueless · 12-02-2013, 06:59 PM

Quote:

Originally Posted by Ser Olmy

Shield's Up will probe the external IP address you use to access the Internet. If you're using a broadband connection of some kind, that IP address is usually assigned to the router supplied by the ISP, and not your PC.

Shield's Up is probably probing the firewall on your router.

Well that makes sense, I guess.
BTW, I've found a useful page which has some nifty cut n paste rules for iptables here: http://www.thegeekstuff.com/2011/06/...ules-examples/

Just the job...

salasi · 12-03-2013, 03:53 PM

In case it helps (...and I'm not sure...) pretty much the definitive work on iptables is hosted over at frozentux. You might object that you don't really want to know that much about iptables (and networking) but when is knowing too much a big problem?

rnturn · 12-03-2013, 04:59 PM

Quote:

Originally Posted by Completely Clueless

expected to see the output from iptables to show 'drop' all packets rather than 'accept' as is the case here:

Code:

 # iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

If the default was "drop" you'd be really secure, though, you wouldn't have network access. The "drop" option is what I use on my firewall before all the other rules that allow selected packets through are issued.

--
Rick

rnturn · 12-03-2013, 05:22 PM

Quote:

Originally Posted by Completely Clueless

I've got this O'Reilly book, Linux iptables - a Pocket Reference and it's been of no use at all since the day I bought it 6 years ago. Can't find an answer to the simplest of questions in it.

I have a copy of that, too. I feel much the same way about its "usefulness". Maybe it's useful to the person who knows iptables inside and out but just needs a reminder about syntax. I found the book Linux Firewalls, by Robert L. Ziegler (New Riders, 2002) to be much more useful.

I hear that "nftables" will be the way to do Linux firewalling in the near future. It's supposed to have an iptables compatability mode to allow folks to migrate somewhat gracefully. (Dang! My firewall book will have no resale value.)

--
Rick