3

I'm trying to see a list of all the rules in IPtables in a Debian 7 server. when I try:

iptables -L -n

I only get one rule (which I entered 5 minutes ago).

I have many others, for port 80, mysql and others which all work, but I can't see them anywhere.

Any idea how could that be done? Thanks

/* edit */

I'm adding some input I get from the different commands

iptables -t nat -L -n

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

When I try

iptables -L -v -n --line-n

Chain INPUT (policy ACCEPT 43535 packets, 58M bytes)
num   pkts bytes target     prot opt in     out     source               destination
1      126 56529 ACCEPT     tcp  --  eth0   *       0.0.0.0/0            0.0.0.0/0            tcp spt:443 state ESTABLISHED

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 30151 packets, 7365K bytes)
num   pkts bytes target     prot opt in     out     source               destination


iptables-save


# Generated by iptables-save v1.4.14 on Thu Oct 23 08:58:32 2014
*raw
:PREROUTING ACCEPT [17972:25607074]
:OUTPUT ACCEPT [12416:1953400]
COMMIT
# Completed on Thu Oct 23 08:58:32 2014
# Generated by iptables-save v1.4.14 on Thu Oct 23 08:58:32 2014
*mangle
:PREROUTING ACCEPT [19071:27028289]
:INPUT ACCEPT [19071:27028289]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [13114:2110189]
:POSTROUTING ACCEPT [13114:2110189]
COMMIT
# Completed on Thu Oct 23 08:58:32 2014
# Generated by iptables-save v1.4.14 on Thu Oct 23 08:58:32 2014
*security
:INPUT ACCEPT [19514:27565428]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [13405:2178341]
COMMIT
# Completed on Thu Oct 23 08:58:32 2014
# Generated by iptables-save v1.4.14 on Thu Oct 23 08:58:32 2014
*nat
:PREROUTING ACCEPT [141:11461]
:INPUT ACCEPT [141:11461]
:OUTPUT ACCEPT [11:1030]
:POSTROUTING ACCEPT [11:1030]
COMMIT
# Completed on Thu Oct 23 08:58:32 2014
# Generated by iptables-save v1.4.14 on Thu Oct 23 08:58:32 2014
*filter
:INPUT ACCEPT [43596:58181078]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [30216:7394285]
-A INPUT -i eth0 -p tcp -m tcp --sport 443 -m state --state ESTABLISHED -j ACCEP                                                                                        T
COMMIT
# Completed on Thu Oct 23 08:58:32 2014
|improve this question
  • 1
    You need to illustrate this problem by showing via cut and paste an example of you adding a sequence of rules to a table and then what iptables -L outputs. Otherwise it just sounds like you have made a mistake and are not adding the rules properly, which would explain the problem. I've never seen any inconsistencies from iptables -L. – goldilocks Oct 23 '14 at 13:08
  • 1
    @goldilocks In more complicated firewalls which include PREROUTING and POSTROUTING built-in chains, iptables -L is not able to give you any detail about these chains. However iptables-save -c will give you all rules availiable including e.g counters and so on. – Valentin Bajrami Oct 23 '14 at 13:19
5

Netfilter encourages to use iptables-save command since it will provide you a detailed view of your built-in chains and those you've defined yourself. If you want to get a human readable view you can use iptables -L -v -n --line-n

|improve this answer
  • 1
    Thank you, I tried the commands above and still only one rule. – Yanipan Oct 23 '14 at 12:46
  • 1
    @Yanipan can you update your question and show us what you are getting when you run the command? – Valentin Bajrami Oct 23 '14 at 12:48
  • @va0x00ff Thanks for your time - I added two commands that might give some relevant info - I'm not sure if those are the one you wanted – Yanipan Oct 23 '14 at 12:58
  • 1
    I added the iptables-save command and I think it did list everything. Still making sure - Thank you very much! – Yanipan Oct 23 '14 at 13:01
  • 1
    @Yanipan Those are the only rules you have then. Mind you, the policy of your INPUT chain is set to ACCEPT. By default everything is accepted no matter what. You can set your CHAIN policy to DROP and allow only traffic you want to allow. – Valentin Bajrami Oct 23 '14 at 13:01
5

Your command only lists the default filter table. There are a total of five tables: filter, nat, mangle, raw and security. These can be selected using the -t option:

iptables -t nat -L -n
|improve this answer
  • Odd, I tried them all, only one rule... 443. Maybe I should restart the server. I'll update, thanks for the help – Yanipan Oct 23 '14 at 12:49
1

This is an alias I put in my ~/.bashrc (fw means "firewall" which is descriptive enough for me, change it if you'd like):

Set up /etc/sudoers to allow you to run the iptables command with no password or only run it as root.

alias fw='clear ; sudo iptables --line-numbers -nvL ; echo ; echo '\''nat:'\'' ; echo ; sudo iptables -t nat --line-numbers -nvL ; echo ; echo '\''mangle:'\'' ; echo ; sudo iptables --line-numbers -t mangle -nvL'
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.