How to programmatically access iptables?

Question

Is there a way we can request iptables tools without using a shell script? I have no way to use shell script to run iptables command and grep output. Is there access to source (API) iptables access levels using GNU C? At the minimum minimum, I would like to request a default policy for iptables.

I was hoping to use the / proc file system, but I don't think it is implemented.

Answer 1

So it looks like this is not the case, and this has been confirmed by the Netfilter team.

See the SO question, How can I programmatically manage iptables rules on the fly?

Answer 2

You can interact with the iptables library named libiptc .

How I created my Perl interface for iptables : CPAN IPTables :: libiptc

But the libiptc library gives you an API for the main chains. Accessing and analyzing individual rules is somewhat more complicated, as it depends on dyn-loading shared libraries of individual target / match modules.

My approach in my CPAN module is that I contacted do_command() with iptables.c to change the rules.

Another thing you need to know is :

To make a single iptables call, follow these steps:

• Copy the entire rule set from the kernel to user space
• Separate it with libiptc
• Make one or more changes (usually one change through iptables cmd)
• Convert it to kernel blob format, by libiptc
• Copy the entire (new) set of rules from user space to the kernel.

Thus, a difficult process if you make only one change each time. But you can also take advantage of this and make several changes at once, and they appear as one atomic change, / for the kernel.

Answer 3

As I said in a comment, ltrace -ing iptables -L , I would say that on my Debian / Sid there is an iptables-dev package with libipq and related libraries. You might want to use it.

Answer 4

I would use the proc-fileystem in / proc / net / See http://www.netfilter.org/documentation/FAQ/netfilter-faq-3.html#ss3.9 and find proc (in different questions)

Answer 5

Why doesn't he look at iptables sources to get an idea? I don’t understand why strace can be used to figure this out if the sources just contain the right code.