How can I check the hit count for each rule in iptables?

linux firewall iptables
apps picture apps · Jul 9, 2013 · Viewed 79.1k times · Source

I want to know how can I find out which rule was accessed and how many times, from the access list I have created using iptables.

My firewall has over 1000 input and output rules in iptbales; I want to find how many times each of them were accessed.

For example, suppose I have the following rules:

iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT

iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT

I want to find out how many times each of the rules 1, 2, 3, 4, 5 and 6 were hit.

Answer

scai picture scai · Jul 9, 2013

iptables will list packet and byte counters if you specify option -v for verbose, e.g. iptables -vL. Likewise iptables-save will list all entries including the mentioned counters for each chain, but not for each table entry (on some systems iptables-save requires option -c to include counters).

Related questions

How can I remove specific rules from iptables?

I am hosting special HTTP and HTTPS services on the ports 8006 and 8007 respectively. I use iptables to "activate" the server; i.e. to route the incoming HTTP and HTTPS ports: iptables -A INPUT -i eth0 -p tcp --dport 80 -j ACCEPT …

Read More
Connection refused to MongoDB errno 111

I have a Linode server running Ubuntu 12.04 LTS and MongoDB instance (service is running and CAN connect locally) that I can't connect to from an outside source. I have added these two rules to my IP tables, where < ip …

Read More
How to use iptables in linux to forward http and https traffic to a transparent proxy

I have a Ubuntu linux system acting as a gateway system with two interfaces on it. One interface is for the local network and one interface is for the internet. I am able to route traffic through it with no …

Read More