Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have an ASUS RT-N16 router that I've flashed with the open-source DD-WRT firmware. According to my ssh login, I'm running:

DD-WRT v24-sp2 mega (c) 2010 NewMedia-NET GmbH
Release: 08/07/10 (SVN revision: 14896)

I'd like to be able to customize the iptables rules, but before I do that, I'd like to see the output of the built-in rules that get configured when manipulating the browser/GUI interface settings. I am aware of the firewall script tab in the browser interface for entering custom firewall rules, but I can't find someplace to see the output.

On a full-blown Linux system, the iptables rules would be stored somewhere like /etc/sysconfig/iptables. Where would I find these on a DD-WRT filesystem? I can do

iptables -L -vn --line-numbers

and see them output, but what I'm looking for is more of what the iptables-save command might output... so that I can incorporate the appropriate rules into my custom script.

I understand that this build does not have an iptables-save command. I don't necessarily want the command itself, just output that it generates. If there was something like /etc/sysconfig/iptables, I wouldn't care about having iptables-save. I've seen that there may be different builds of DD-WRT that give something like iptables-save, but I'm not at the point where I'm ready or willing to flash the router again. Maybe as a last resort.

EDIT: The usual Linux locations for startup scripts and the like, (e.g., /etc/init.d, /etc/rc, ...) do not seem to have anything useful (at least in the build of DD-WRT that I have installed). For example, taking a look in /etc/init.d:

[/etc/init.d]# ll
-rwxr-xr-x    1 root     root           84 Aug  7  2010 rcS
-rwxr-xr-x    1 root     root           10 Aug  7  2010 S01dummy
[/etc/init.d]# cat rcS
#!/bin/sh
for i in /etc/init.d/S*; do
  $i start 2>&1
done | logger -s -p 6 -t '' &
[/etc/init.d]# cat S01dummy
#!/bin/sh
share|improve this question
    
Hmmm ... I withdrew my answer. Is there an rc.local? What does a **grep -ril iptables /etc/. ** yield? –  tink May 14 '13 at 20:25

2 Answers 2

There are many *WRT distribution variants, and different devices are set up in different ways, so I'm not sure whether this applies to your configuration, but it probably does.

The basic *WRT configuration has a read-only root filesystem, so it cannot save customizations in the filesystem. Instead, the startup loads various (variant-dependent) settings from NVRAM, which is organized as a simple list of key-value pairs. The firewall rules are stored in variant-dependent NVRAM entries. Look for one whose name contains firewall or whose value contains iptables, or some such.

Run ssh ROUTER_HOSTNAME nvram export --dump >nvram.txt to explore your router's NVRAM content at your leasure.

share|improve this answer
    
Thanks! I tried the exact command you gave, but got no output. After a little more Googling, I think the nvram command for this variant is nvram show. Replacing export --dump with show gives a pretty rich output of stuff. Unfortunately, it doesn't have the built-in SPI firewall rules in there anywhere. The closest I seem to see is rc_firewall, which contains the custom rules that I can supply via the browser interface. This is a start, though. I suppose the stock/default iptables rules are generated by script more-or-less 'on-the-fly' at boot-up based on other values? Maybe? –  PattMauler May 15 '13 at 3:25
up vote 1 down vote accepted

Looking in

/tmp/.ipt
/tmp/.rc_firewall

gives exactly what I was looking for: the iptables rules as they would normally be in a file like /etc/sysconfig/iptables.

I had earlier found this:

dd if=/dev/mem | strings | grep -i iptables

...and fortunately, it works on the pared-down DD-WRT filesystem. It didn't give precisely what I was looking for, but it output quite a bit of info I hadn't been able to pinpoint any other way (or at least not with a single command).

Still have to determine which things are actually in effect by comparing with the output of

iptables -L -vn --line-numbers
iptables -L -vn -t nat --line-numbers
iptables -L -vn -t mangle --line-numbers

I also discovered that the grep command actually does work [my apologies for initially stating that it didn't-- I would've sworn it didn't work the last times I had tried. Mea maxima culpa.] Using grep, I found that the

/lib/services.so

also has a wealth of iptables configuration in it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.