Some explorations in determining whether iptables is running

You need to determine whether iptables is enabled. It is difficult to start at first, so you can think about how to start iptables. in RedHat, it is easy to think of/etc/init. d/iptabes start.

Let's take a look at the startup script:

Start (){
# Do not start if there is no config file.
[! -F "$ iptables_data"] & Return 6

# Check if IPv6 module load is deactivated
If ["$ {_ IPV}" = "IPv6"] \
& Amp; grep-qise "^ install [[: Space:] + $ {_ IPV} [[: Space:] +/bin/(true | false) "/etc/modprobe. conf/etc/modprobe. d/*; then
Echo $ "$ {iptables }:$ {_ IPV} is disabled ."
Return 150
Fi

Echo-N $ "$ {iptables}: Applying firewall rules :"

Opt =
["X $ iptables_save_counter" = "xyes"] & OPT = "-c"

$ Iptables-Restore $ opt $ iptables_data
If [$? -EQ 0]; then
Success; echo
Else
Failure; ECHO;
If [-F "$ iptables_fallback_data"]; then
Echo-N $ "$ {iptables}: Applying firewall fallback rules :"
$ Iptables-Restore $ opt $ iptables_fallback_data
If [$? -EQ 0]; then
Success; echo
Else
Failure; ECHO; return 1
Fi
Else
Return 1
Fi
Fi

# Load additional modules (helpers)
If [-n "$ iptables_modules"]; then
Echo-N $ "$ {iptables}: loading additional modules :"
Ret = 0
For mod in $ iptables_modules; do
Echo-n "$ MOD"
Modprobe $ mod>/dev/null 2> & 1
Let RET + =$ ?;
Done
[$ Ret-EQ 0] & Success | failure
Echo
Fi

# Load sysctl settings
Load_sysctl

Touch $ var_subsys_iptables
Return $ RET
}

The core of this function is iptables-Restore, which does not start a daemon program in the background, because iptables is a Linux kernel module. This makes it difficult to judge, because we cannot use the so-called PS Query Process Method. Of course, there is a lock file at the end to judge, but if it is not started using a STARTUP script, directly iptables-Restore, the lock file will not be generated.

So far, it is in a difficult situation.

Some explorations in determining whether iptables is running