How to check if iptables is empty from a script

Question

I am writing a script that needs to check if iptables is empty.

The only idea I have is to do "iptables-save" and compare it with a "iptables-save" of an empty iptables.

However, I'm not sure whether I can count on it that "iptables-save" produces the same result on every host for empty iptables.

Any idea?

iptables -L and parse if necessary?

Sobrique
– Sobrique

2015-02-09 23:12:02 +00:00
Commented Feb 9, 2015 at 23:12 — Sobrique
– Sobrique, Commented Feb 9, 2015 at 23:12

Tiago Lopo · Accepted Answer · 2015-02-09 23:19:19Z

3

You can use iptables-save and grep for lines starting with -:

Empty iptables:

sudo iptables-save | grep '^\-' | wc -l
0

Non empty:

sudo iptables-save | grep '^\-' | wc  -l 
13

answered Feb 9, 2015 at 23:19

Tiago Lopo

8,0291 gold badge39 silver badges53 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Jose Martinez · Accepted Answer · 2015-02-09 23:28:34Z

Have you tried the --list (-L) argument?

$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

That output shows that there are no firewall entries.

If it did output you would see something like this...

$ sudo iptables -n -L -v --line-numbers
Chain INPUT (policy DROP)
num  target     prot opt source               destination
1    DROP       all  --  0.0.0.0/0            0.0.0.0/0           state INVALID
2    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
4    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
Chain FORWARD (policy DROP)
num  target     prot opt source               destination
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
2    DROP       all  --  0.0.0.0/0            0.0.0.0/0           state INVALID
3    TCPMSS     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp flags:0x06/0x02 TCPMSS clamp to PMTU
4    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
5    wanin      all  --  0.0.0.0/0            0.0.0.0/0
6    wanout     all  --  0.0.0.0/0            0.0.0.0/0
7    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination
Chain wanin (1 references)
num  target     prot opt source               destination
Chain wanout (1 references)
num  target     prot opt source               destination

EDIT: Here is a one liner you can use: echo "$(sudo iptables -n -L -v --line-numbers)" | egrep "^[0-9]". Then just test if $? is 1 or 0. If its 0 then there are active firewall rules, if 1 then no active rules.

$ echo "$(sudo iptables -n -L -v --line-numbers)" | egrep "^[0-9]"
1        0     0 DROP       all  --  *      *       202.54.1.2           0.0.0.0/0
$
$ echo $?
0
$
$ sudo iptables -D INPUT 1
$
$ echo "$(sudo iptables -n -L -v --line-numbers)" | egrep "^[0-9]"
$ echo $?
1

EDIT: Or using wc -l might be better....

echo "$(sudo iptables -n -L -v --line-numbers)" | egrep "^[0-9]" | wc -l

Collectives™ on Stack Overflow

How to check if iptables is empty from a script

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related