how to check iptables status in centos 7.6

Question

When I check iptables status in CentOS Linux release 7.6.1810 (Core) like this:

[[email protected] ~]$ service iptables status
Redirecting to /bin/systemctl status iptables.service
Unit iptables.service could not be found.

how to successfully check status?

Solution 1

If you are only interested in determining the current firewall status, it's likely that the firewalld systemd service is handling that for you in CentOS 7 (unless you changed some defaults in the installation).

To query the status of the service you can do:

# systemctl status firewalld

To stop the firewall, you can do:

# systemctl stop firewalld

And to permanently disable it you can do (replace disable with enable to do the reverse):

# systemctl disable firewalld

You can also use the firewall-cmd command to poke around and find more specific information on the current firewall configuration. For example, to find out if the firewall is running

# firewall-cmd --state

The RedHat firewall docs have a nice diagram showing how iptables or firewalld services are both (but not simultaneously) connected to the iptables command. The docs also have a page describing the differences between the two and how to configure your system to use the iptables service instead of firewalld.

Solution 2

iptables.service is part of the iptables-services package:

# yum whatprovides /usr/lib/systemd/system/iptables.service 
[...]
iptables-services-1.4.21-34.el7.x86_64 : iptables and ip6tables services for iptables
Repo        : base
Matched from:
Filename    : /usr/lib/systemd/system/iptables.service

However, with just the iptables package installed, you can still have an active iptables configuration. You can check that with iptables --list.

Comments

[Danny]

how to disable iptables?[[email protected] ~]$ systemctl stop iptables.service ==== AUTHENTICATING FOR org.freedesktop.systemd1.manage-units === Authentication is required to manage system services or units. Authenticating as: miaoyou Password: ==== AUTHENTICATION COMPLETE === Failed to stop iptables.service: Unit iptables.service not loaded.

[Wieland]

You need to run systemctl daemon-reload after installing iptables-services for systemd to pick up the new unit files.

[number9]

This is not totally accurate. I just jumped on a CentOS 7 box, and sudo systemctl status iptables returns Unit iptables.service could not be found. While at the same time sudo iptables -L returns a BOATLOAD of rules that are in effect.

[everyt4u]

@number9 Question is "how to check iptables status in centos 7.6" , and below is what I am getting after systemctl status iptables shell command : ` systemctl status iptables ● iptables.service - IPv4 firewall with iptables Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled) Active: active (exited) since Fri 2021-03-12 19:56:09 CET; 11h ago Main PID: 13550 (code=exited, status=0/SUCCESS) CGroup: /system.slice/iptables.service Mar 12 19:56:09 myserver.com systemd[1]: Starting IPv4 ....`

[everyt4u]

@number9 what a nice welcome in my first answer , you are downvoting me. I can not do any thing if your server is misconfigured , the OPs question was how to check iptables status in centos 7.6 and this is my working answer (yes if you need I can take screen shot too) . It seem to be I am not welcomed here..

[Mathias Weidner]

@everyt4u There are multiple packages that can alter iptables rules, some of them don't use the iptables service. The Question is a little bit misleading here because it is not clear whether the service was meant or the program iptables.

[number9]

@everyt4u You were down voted because your solution required a package that OP may not have, but I do in fact know that the iptables command is installed by default on Cent 7.6.

[everyt4u]

@MathiasWeidner Thank you Dear Mathias for kindly answering. This is the way I am looking for in an online community, and even you stated question can be misleading , and i wanted add my contribution innocently .But suddenly a problem kid comes and destroys all your willing to continue in your first msg.. Even he is stating but I do in fact know that the iptables command is installed by default on Cent 7.6.. Best regards to you and others. sorry been sensible against such people..