firewall is stopped?

Question

in last few weeks i noticed that firewall on my server is stopped few times.

when i start it it works for a few days, but after that i found it stopped. i run it again, few days after it is stopped again.

i use iptables.

i have enough memory, enough free space on hard drives.

what can be a case? i am worried that i have "somebody" on my server.

please advice me...

Answer 1

Please try to do a simple scan of your machine, and check if your box is not hacked, or carrying out a rootkit, there are many package that can help you for example :

chkrootkit:  rootkit detector
rkhunter  :  rootkit, backdoor, sniffer and exploit scanner
unhide    :  Forensic tool to find hidden processes and ports

Answer 2

Keep in mind, just because the "service" is saying it's stopped doesn't mean the firewall is actually gone. At least on CentOS, the "service" seems to just be a wrapper for saving and restoring rulesets. There's no actual userspace daemon required for iptables to work; it's just a series of CLI tools that talk to the kernel to actually set the rules. The real way to tell if the iptables rules are still present is to run "iptables -L"