Is there a way to find which iptables rule was responsible for dropping a packet?

Question

I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did iptables-save followed by iptables -F and the application started working.) There are way too many rules to sort through manually. Can I do something to show me which rule is dropping the packets?

Answer 1

You could add a TRACE rule early in the chain to log every rule that the packet traverses.

I would consider using iptables -L -v -n | less to let you search the rules. I would look port; address; and interface rules that apply. Given that you have so many rules you are likely running a mostly closed firewall, and are missing a permit rule for the traffic.

How is the firewall built? It may be easier to look at the builder rules than the built rules.

Answer 2

Since iptables -L -v -n has counters you could do the following.

iptables -L -v -n > Sample1
#Cause the packet that you suspect is being dropped by iptables
iptables -L -v -n > Sample2
diff Sample1 Sample2

This way you will see only the rules that incremented.

Answer 3

Run iptables -L -v -n to see the packet and byte counters for every table and for every rule.

Answer 4

In my company we use watch -n 2 -d iptables -nvL, it shows changes between requests

Answer 5

watch -n1 -d "iptables -tfilter -vnxL | grep -vE 'pkts|Chain' | sort -nk1hr | column -t"

Keep in mind, this will only show stuff for the table filter.

If you want all tables, try this:

watch -n1 -d "(iptables -tfilter -vnxL;iptables -tnat -vnxL;iptables -tmangle -vnxL;iptables -traw -vnxL;iptables -tsecurity -vnxL) | grep -vE 'pkts|Chain' | sort -nk1,1hr | column -t"