iptable: obtaining list of tables?

Besides looking in /proc, can one get iptable to list the names of the firewall tables?

Won't iptables -L do this?

Andy

As far as I can tell - no. Docs says it just list chains. sample try, suggests that only the default table is used to list a -t "" .

BTW: if u dont use -L -n, the chain is silently ignored - ;-(

===========================================
[root@MyLaptop gat]# /sbin/iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

[root@MyLaptop gat]# /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

[root@MyLaptop gat]# /sbin/iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

[root@MyLaptop gat]# /sbin/iptables -t nat -L -n

Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

[root@MyLaptop gat]# /sbin/iptables -t nat -L

Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@MyLaptop gat]#
===========================================

I agree with you George, atleast it seems there is no mechanism to list the tables.

Apologies for my ignorance, but could you tell me the reason why you would need to list the tables. As far as I know netfilter provides a static list of tables - filter, mangle & nat.

Regards,
Karthik

-----Original Message-----
From: [email protected] [mailto:[email protected]] On Behalf Of U. George
Sent: Thursday, February 25, 2010 6:46 PM
To: andy thomas
Cc: [email protected]
Subject: Re: iptable: obtaining list of tables?

As far as I can tell - no. Docs says it just list chains. sample try, suggests that only the default table is used to list a -t "" .

BTW: if u dont use -L -n, the chain is silently ignored - ;-(

===========================================
[root@MyLaptop gat]# /sbin/iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

[root@MyLaptop gat]# /sbin/iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

[root@MyLaptop gat]# /sbin/iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

[root@MyLaptop gat]# /sbin/iptables -t nat -L -n

Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- 0.0.0.0/0 0.0.0.0/0

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

[root@MyLaptop gat]# /sbin/iptables -t nat -L

Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
MASQUERADE all -- anywhere anywhere

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@MyLaptop gat]#
===========================================
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

______________________________________________________________________

This Email may contain confidential or privileged information for the intended recipient (s) If you are not the intended recipient, please do not use or disseminate the information, notify the sender and delete it from your system.

______________________________________________________________________

no, that's not quite right.
In the early days iptables had mangle, nat and filter tables. Then the raw table was introduced to circumvent connection tracking. Now we also have the security table for SELinux context, hocked right after the filter table.
And there is the rawpost table, available if you install the xtables-addons (used for RAWSNAT and RAWDNAT - static nat without connection tracking).

If the kernel was built with the tables compiled as modules, you can load/unload them. i.e output of lsmod:
ip_tables 7551 6
iptable_security,iptable_nat,iptable_mangle,iptable_raw,iptable_filter,iptable_rawpost

Usually the currently active tables are listed in:
/proc/net/ip_tables_names
This list is empty until you load the modules.

But there is no way afaik to tell what tables are supported without knowing their names and try to load them.

Best regards

Mart

[...]