Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm writing a script to find all the firewall details, routing information, and important network related via command line. I can fetch the firewall configuration with iptables -nvL, but I'm not sure about the rest. What commands should I use to gather everything else?

share|improve this question
add comment

4 Answers 4

up vote 4 down vote accepted

You can get the interface status by:

ifconfig

Or even better, use the "ip" command, for example:

ip addr

To get the route info, use one of these:

route
route -n #no ptr resolving
ip route

For firewall rules, use:

iptables -L # you can add -n to prevent name resolving

For IPv6 you can add "-6" to "ip" commands:

ip -6 addr
ip -6 route
...

You can also check "ethtool" to get link status and speed/duplex:

ethtool eth0 
share|improve this answer
add comment

The command to print existing iptables rules is like this:

iptables -L

share|improve this answer
add comment
routel

List lots of information, albeit in a not really readable form, but it is a full dump of all routing tables of the host, and gives enough information to reconstitute the IP configuration on the host. This information is not complete enough to reconstitute policy routing. If you happen to use that, you also need ip rule. Anyway, as an example, for IPv4 (even if IPv6 is also listed):

# list all interfaces addresses (unicast/broadcast/anycast)
routel | grep "local"
# list all (except ipv6 link-local) addresses of interfaces
routel | grep "local" | grep "host"
# list all broadcast addresses of interfaces
routel | grep "local" | grep "link"
# list all routing entries
routel | grep -v "local" | grep -v "unspec"
# list all on-link routing entries
routel | grep -v "local" | grep -v "unspec" | grep "link"
# list all on-link routing entries that are added by the kernel, 
# (which also matches the netmask of the IP addresses).
routel | grep -v "local" | grep -v "unspec" | grep "link" | grep "kernel"
# list non-on-link routes (aka gatewayed or routed)
routel | grep -v "local" | grep -v "unspec" | grep -v "link" 

Contrary to ip route or the 1999's route, routel list all routing tables, while the other only list the main table. If someone uses policy routing, you will get no clues when using ip route, while routel will spell you the name of routing tables.

Also, you may want to dump the sysctl knobs, to know if someone enabled forwarding, ARP proxying or some other funky stuff. Just dump sysctl -a

If you want more complete flags or interface informations, also dump ip addr. Really special configuration might need more, like ip link or ip tunnel.

As for firewall configuration, there is iptables-save or iptables-save -c if you also want counters. This will list all tables (and not only filter like iptables -L or iptables -S) You can even use iptables-restore that takes the output of iptables-save and restore its configuration.

share|improve this answer
add comment

You can see if there is CSF Firewall installed.

/etc/csf/csf.conf

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.
{"cc_re__cc_re__cc_by_sa_3_0": ["        <li><a href=\"http://area51.stackexchange.com\" title=\"proposing new sites in the Stack Exchange network\">Area 51</a></li>\r\n                        <li><a href=\"http://careers.stackoverflow.com\">Stack Overflow Careers</a></li>\r\n                    \r\n                </ol>\r\n            </td>\r\n    </tr>\r\n</table>\r\n                </div>\r\n            </div>\r\n\r\n            <div id=\"copyright\">\r\n                site design / logo &#169; 2014 stack exchange inc; user contributions licensed under <a href=\"http://creativecommons.org/licenses/by-sa/3.0/\" rel=\"license\">cc by-sa 3.0</a> \r\n                with <a href=\"http://blog.stackoverflow.com/2009/06/attribution-required/\" rel=\"license\">attribution required</a>\r\n            </div>\r\n            <div id=\"svnrev\">\r\n                rev 2014.7.24.1725\r\n            </div>\r\n            \r\n        </div>\r\n    </div>\r\n    <noscript>\r\n        <div id=\"noscript-warning\">Server Fault works best with JavaScript enabled<img src=\"http://pixel.quantserve.com/pixel/p-c1rF4kxgLUzNc.gif\" alt=\"\" class=\"dno\"></div>\r\n    </noscr"], "copyright__copyright__copyright": ["s (and not only filter like iptables -L or iptables -S) You can even use iptables-restore that takes the output of iptables-save and restore its configuration.\n\nshare|improve this answer\nadd comment\n\nYou can see if there is CSF Firewall installed.\n\n/etc/csf/csf.conf\n\nshare|improve this answer\nadd comment\n\nYour Answer\n\n\u00a0\ndiscard\n\nBy posting your answer, you agree to the privacy policy and terms of service.\n\nNot the answer you're looking for? Browse other questions tagged or ask your own question."]}