Home / server / Questions / 970392
Accepted
philippe
Asked: 2019-06-07 06:47:20 +0800 CST

get iptables rules from kernel or from /proc

  • 772

I need to get iptables rules from a Linux Debian server. i know about iptables -L -n -v command for instance but as the server may be compromised i can't rely on local commands which may be corrupted. Instead, I need in my binary to load utilities statically compiled in order to get a fingerprint of the server without using local commands.

Most thinks can be retrieved from /proc pseudo filesystem. However, nothing seems to be accessible regarding iptables configuration.

Is it possible to get iptables rules without using iptables related commands ?

linux

1 Answers

  1. Best Answer
    1. The active firewall rule set is stored in the kernel memory.
    2. You cannot get the rule set through the /proc filesystem, because it isn't implemented.
    3. Theoretically you can get the dump of the rule set through any own program with corresponding permits. But the result will be in blob, not human readable format.
    4. Anyway, if you server has been compromised in such way, that the attacker can replace or change only root accessible files, you have more serious issue else the incorrect firewall listing.
    5. If this issue is very important for you, read about methodology for rootkit detection.
    • 2