0

Is there a tool for monitoring that iptables (or shorewall or similar) is up and running with a core set of important rules? I need something which alerts me either if the firewall goes donw completely, or if one of a number of rules isn't active anymore, for whatever reason.

I don't want to try the functionality of the firewall by connecting to the ports or (worse) checking if others are connecting.

Server: debian wheezy, standard install. Let's say I want to check that port 80 rule is open for the world and port 8080 only for a certain ip a.b.c.d.

One way would be to save the working rules as a textfile and then have a daily cron job which compares the current rules with this original one, but I'm hoping there's something else that I can use. Is it possible to achieve this in munin or nagios?

2 Answers 2

1

You can use nmap tool for basic or hping3 for more advanced security auditing of your firewall rules. This nmap command run remotely against your firewall can test your firewall's rulesets:

nmap -p 0-65535 -Pn FIREWALL_HOST

Or you can implement a kind of auditing with iptables LOG target extension to log everything what wasn't matched with previous rules:

# firewal rulesets
iptables -A INPUT -s 1.2.3.4 -j ACCEPT
iptables -A INPUT -s 1.2.3.5 -j ACCEPT
....
....
....
# this rule will log everything suspicious not matched before
iptables -A INPUT -j LOG 
iptables -A INPUT -j DROP

Finally, your idea to compare a dump of rulesets is not bad as well. You can use diff for it and then to check return code of the command:

iptables -L -n > RULESET_FILE


if ! diff RULESETS_FILE <(iptables -L -n) > RULESETS_CHANGES; then
   echo "Rulesets changed"
fi
3
  • Thanks! Of your three answers, I like nmap most and the third with the diff.
    – bitbox
    Sep 6, 2013 at 11:52
  • Bitbox, welcome to SF. I hope you'll forgive me mentioning that local etiquette is that, when you're happy with an answer, you accept it by clicking the tick outline next to it; this drives the SF reputation system both for you and the author of your preferred answer. My apologies if you already knew that.
    – MadHatter
    Sep 6, 2013 at 12:11
  • @MadHatter no worries :)
    – bitbox
    Sep 6, 2013 at 12:57
-1

try to compare

iptabes-save 

and startup config (/etc/sysconfig/iptables, etc). If all ok - this should be identical.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .