29

I have a system that came with a firewall already in place. The firewall consists of over 1000 iptables rules. One of these rule is dropping packets I don't want dropped. (I know this because I did iptables-save followed by iptables -F and the application started working.) There are way too many rules to sort through manually. Can I do something to show me which rule is dropping the packets?

19

You could add a TRACE rule early in the chain to log every rule that the packet traverses.

I would consider using iptables -L -v -n | less to let you search the rules. I would look port; address; and interface rules that apply. Given that you have so many rules you are likely running a mostly closed firewall, and are missing a permit rule for the traffic.

How is the firewall built? It may be easier to look at the builder rules than the built rules.

14

Run iptables -L -v -n to see the packet and byte counters for every table and for every rule.

  • This is good, I'm hoping for something better since there are 1000 rules and 1000s of dropped packets. – Shawn J. Goff Mar 26 '11 at 17:49
  • Use sort to sort rules by packet counter. – ninjalj Mar 26 '11 at 17:53
12

Since iptables -L -v -n has counters you could do the following.

iptables -L -v -n > Sample1
#Cause the packet that you suspect is being dropped by iptables
iptables -L -v -n > Sample2
diff Sample1 Sample2

This way you will see only the rules that incremented.

9

In my company we use watch -n 2 -d iptables -nvL, it shows changes between requests

5
watch -n1 -d "iptables -vnxL | grep -v -e pkts -e Chain | sort -nk1 | tac | column -t"

Keep in mind, this will only show stuff for the table filter.

Add -t nat (or whichever table you use besides filter) to your iptables call, to check the rules there.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.