picoIRV

picoIRV - Tested on Debian and SuSE Linux

linux-logo


FEATURES
picoIRV is a small (as the prefix 'pico' implies) tool, allowing to view the rules you have set for the firewall based on iptables (IRV=IptablesRulesViewer).
Basically, it converts the output of the command iptables -L -v into an easier to read web-page.
If you have installed the picoFIREWALL, it creates an additional webpage containing information of your configuration files.

EXAMPLE
The output of the command iptables -L -v looks as follows (only a part of the output is given):


Chain INPUT (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
15046  786K ACCEPT     all  --  lo     any     anywhere             anywhere
    0     0 ACCEPT     all  --  vmnet8 any     anywhere             anywhere
57191   10M ACCEPT     all  --  eth0   any     anywhere             anywhere           state RELATED,ESTABLISHED
    0     0 DROP       udp  --  eth0   any     anywhere             anywhere           udp dpt:6970 state INVALID,NEW,RELATED,ESTABLISHED
    0     0 DROP       tcp  --  eth0   any     anywhere             anywhere           tcp dpt:4662 state INVALID,NEW,RELATED,ESTABLISHED
    0     0 LOG        all  --  eth0   any     129.132.40.56        anywhere           state NEW limit: avg 1/day burst 1 LOG level warning tcp-options ip-options prefix `P-Fw-DROP-noise_log-in: '
    0     0 DROP       all  --  eth0   any     129.132.40.56        anywhere           state NEW
    0     0 DROP       all  --  eth0   any     129.132.40.56        anywhere           state RELATED,ESTABLISHED
    0     0 LOG        all  --  eth0   any     vpn-1-outside.ethz.ch  anywhere           state NEW limit: avg 1/day burst 1 LOG level warning tcp-options ip-options prefix `P-Fw-ACCEPT-open_log-in: '
    0     0 ACCEPT     all  --  eth0   any     vpn-1-outside.ethz.ch  anywhere           state NEW
    0     0 ACCEPT     all  --  eth0   any     vpn-1-outside.ethz.ch  anywhere           state RELATED,ESTABLISHED

-----------> This output is translated by picoIRV into the following format:
Host: kavo - picoirv Version: V0.4 
Last Update: Mar 27 01:00:47 2004

List all rules of all chains - Output of the command:       iptables -L -v

picoIRV stands for pico-Iptables-Rules-Viewer - view the rules and verify critical entries
Rules in the INPUT chain, accepting packets from anywhere or to anywhere
with no state or state=NEW should be verified
Rules in the INPUT chain, accepting packets from anywhere to anywhere
with no state or state=NEW should be carefully verified
-------------------

Chain INPUT  (policy DROP 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
14292  747K ACCEPT     all  --  lo     any     anywhere             anywhere
    0     0 ACCEPT     all  --  vmnet8 any     anywhere             anywhere
54961 9739K ACCEPT all -- eth0 any anywhere anywhere state RELATED,ESTABLISHED 0 0 DROP udp -- eth0 any anywhere anywhere udp dpt:6970 state INVALID,NEW,RELATED,ESTABLISHED 0 0 DROP tcp -- eth0 any anywhere anywhere tcp dpt:4662 state INVALID,NEW,RELATED,ESTABLISHED 0 0 LOG all -- eth0 any 129.132.40.56 anywhere state NEW limit: avg 1/day burst 1 LOG level warning tcp-options ip-options prefix `P-Fw-DROP-noise_log-in: ' 0 0 DROP all -- eth0 any 129.132.40.56 anywhere state NEW 0 0 DROP all -- eth0 any 129.132.40.56 anywhere state RELATED,ESTABLISHED 0 0 LOG all -- eth0 any vpn-1-outside.ethz.ch anywhere state NEW limit: avg 1/day burst 1 LOG level warning tcp-options ip-options prefix `P-Fw-ACCEPT-open_log-in: '
    0     0 ACCEPT     all  --  eth0   any     vpn-1-outside.ethz.ch  anywhere           state NEW
0 0 ACCEPT all -- eth0 any vpn-1-outside.ethz.ch anywhere state RELATED,ESTABLISHED

As shown above, the HTML-output is much better readable and helps to identify 'weak' or possibly dangerous definitions using iptables (such as leaving a port open for any host). picoIRV produces this output in the file picoirv.html.

Users having picoFIREWALL installed, also get an additional file picofirewall_config.html, where the essential part of picoFIREWALL's configuration files are nicely displayed. However, picoIRV also works, if you use any other firewall based on iptables.

PART OF THE CHANGELOG

V0.4   25Mar2004 If picofirewall is installed, create a file
       picofirewall_config.html with the configuration in /etc/picofirewall
V0.3   22Mar2004 Modified to run also on Debian
V0.2   21Mar2004 Added some comments about picoIRV on the resulting webpage
V0.1   20Mar2004 First version if picoirv - tested under Linux SuSE 9.0

DOWNLOAD
Download and save picoirv.tar.gz to your computer.

INSTALLATION
Go to your directory, below which picoIRV should be installed (e.g. /app ) and enter the following:
You have to enter the commands (as root, in order to be able to run iptables):

su -
(enter root-password)
gunzip picoirv.tar.gz
tar xvf picoirv.tar
cd picoirv
./install
(enter the command appearing on the screen - varies between SuSE and Debian)

The program will then be run every full hour as cron-job.

And: let me know, if you like the program (and also, if you do not like it...).


Last Update: 01Aug2004 uk --- Created: 26Mar2004 uk