in last few weeks i noticed that firewall on my server is stopped few times.

when i start it it works for a few days, but after that i found it stopped. i run it again, few days after it is stopped again.

i use iptables.

i have enough memory, enough free space on hard drives.

what can be a case? i am worried that i have "somebody" on my server.

please advice me...


Please try to do a simple scan of your machine, and check if your box is not hacked, or carrying out a rootkit, there are many package that can help you for example :

chkrootkit:  rootkit detector
rkhunter  :  rootkit, backdoor, sniffer and exploit scanner
unhide    :  Forensic tool to find hidden processes and ports

| improve this answer | |

Keep in mind, just because the "service" is saying it's stopped doesn't mean the firewall is actually gone. At least on CentOS, the "service" seems to just be a wrapper for saving and restoring rulesets. There's no actual userspace daemon required for iptables to work; it's just a series of CLI tools that talk to the kernel to actually set the rules. The real way to tell if the iptables rules are still present is to run "iptables -L"

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.