linux : monit : iptables

Question

Under linux, at least centos and I think also debian, there is a "iptables" listed in the daemons. But it is really a script to load and save them, it doesn' start a process, neither write a pidfile.

How can I check iptables up and running with monit ?

Answer 1

For CentOS 6 and earlier you're correct about it using iptables. CentOS 7 uses firewalld.

To monitor either using Monit you can use PROGRAM-STATUS-TEST. There are several methods to ascertain the status of iptables.

One method to get the status of iptables in CentOS 6 is to use

$ sudo /etc/init.d/iptables status

If iptables is not running you'll get the following response:

$ sudo /etc/init.d/iptables status
iptables: Firewall is not running.

If iptables is running it will look similar to this:

$ sudo /etc/init.d/iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

Write a script to check the status and grep for Firewall is not running and provide an return code for the script then use monit to run the script.

I didn't test it but it would look something like this:

check program iptables with path "/etc/init.d/iptables status"
    if status != 0 then alert

Answer 2

An updated version of kenlukas's solution so make monit keep an eye on whether iptables is running might look like this:

check program iptables with path "/usr/bin/systemctl status iptables"
    start program = "/usr/bin/systemctl start iptables" with timeout 60 seconds
    stop program  = "/usr/bin/systemctl stop iptables"
    if status != 0 then start
    if status != 0 for 2 cycles then alert

check program ip6tables with path "/usr/bin/systemctl status ip6tables"
    start program = "/usr/bin/systemctl start ip6tables" with timeout 60 seconds
    stop program  = "/usr/bin/systemctl stop ip6tables"
    if status != 0 then start
    if status != 0 for 2 cycles then alert

Note that this won't work with Ubuntu 22.04, as iptables does not work as a service there.

Note that this may report false "not running" eventy, because iptables is "not a persistent service" (https://askubuntu.com/a/1332434/168515). It may still be a good indicator whether iptables-restore had run on boot.