Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did iptables-save followed by iptables -F and the application started working.) There are way too many rules to sort through manually. Can I do something to show me which rule is dropping the packets?

share|improve this question
    
fedorahosted.org/dropwatch might also be helpful in the future. –  Shawn J. Goff Jul 25 '13 at 18:41
    
To see the counters update in real time use<br/> <code> watch iptables -L -v -n </code> –  Chris Gibb Jul 13 at 13:35
add comment

3 Answers 3

up vote 8 down vote accepted

You could add a TRACE rule early in the chain to log every rule that the packet traverses.

I would consider using iptables -L -v -n | less to let you search the rules. I would look port; address; and interface rules that apply. Given that you have so many rules you are likely running a mostly closed firewall, and are missing a permit rule for the traffic.

How is the firewall built? It may be easier to look at the builder rules than the built rules.

share|improve this answer
    
I figured out after asking this question that the rules are from APF, and I was able to fix that. I love the TRACE target, though. That would have been very effective. –  Shawn J. Goff Mar 26 '11 at 19:21
add comment

Run iptables -L -v -n to see the packet and byte counters for every table and for every rule.

share|improve this answer
    
This is good, I'm hoping for something better since there are 1000 rules and 1000s of dropped packets. –  Shawn J. Goff Mar 26 '11 at 17:49
    
Use sort to sort rules by packet counter. –  ninjalj Mar 26 '11 at 17:53
add comment

Since iptables -L -v -n has counters you could do the following.

iptables -L -v -n > Sample1
#Cause the packet that you suspect is being dropped by iptables
iptables -L -v -n > Sample2
diff Sample1 Sample2

This way you will see only the rules that incremented.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.