IPTABLES Custom list (-L)

Hi, I was wondering if there is way to customize the output of the IPTABLES -L to certain format. So for example it list the results in the format of  SIP/SMash, DIP/DMask, Protocol, Action.

If maybe someone can tell me how tokenize the IPTABLES -L output that would help too.

Thanks,

Zenrov
LVL 1
haszanAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Artysystem administratorCommented:
There is very usefull script 'iptables-save' that prints everything in a common format. Also it's output may be used ny 'iptables-restore' to restore firewall configuration.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Artysystem administratorCommented:
Oops, that's not a script, that's a binary, but it is standard and comes with any Linux :-)
0
haszanAuthor Commented:
Thank Nopius, that still doesn't really answer my question...My question is really how to customize format of the printed rulesets, I want the rules to be printed out in a certain format, and not the common format.
0
Artysystem administratorCommented:
Yes, I didn't answer your question, but I suppose you will use iptables-save instead of iptables -L. It's output can be easily parsed. Did you test it?

Suppose my output of iptables-save:
...
:OUTPUT ACCEPT [16267792:2558906548]
-A INPUT -s 1.1.1.0/255.255.255.0 -d 2.2.2.2 -p tcp -m tcp --sport 25 -j ACCEPT
...

What is after -s is your SIP/SMASK
What is after -d is a DIP/DMASK, if no mask, then /32
-p tcp -m tcp  --sport is a Protocol SMTP (You can match --sport --dport numeric value with /etc/services to get a string)
-j ACCEPT means ACTION.

Parsing of iptables -L output also can be done, but more difficult since, parameters are positional and not well structured, other parameters (such as -i or -o) are skipped:
target     prot opt source               destination
ACCEPT     tcp  --  1.1.1.0/24           2.2.2.2             tcp spt:smtp

You can assume that field 1 is an Action, field 4 is a SIP/SMASK, field 5  is DIP/DMASK and everything after spt: or dpt: is your Protocol (but when both, you don't know which one).
Rules for each chain goes after "Chain XXX" and one line skipped until empty line.
What else do you like to know about how to parse this output?
0
haszanAuthor Commented:
Thank you for the info.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Linux

From novice to tech pro — start learning today.