iptables baseline

iptables -L -n -v --line-numbers

Shows iptables rules with packet and byte detail, the review of the host firewall baseline.

Run it when you need to see the host firewall: iptables -L -n -v lists the rules of each chain with the packet and byte counters — the snapshot of what is allowed, what is denied, and how much traffic has passed through each rule. In hardening and IR, reviewing the rules answers 'what does this host have open?' — the open port that shouldn't be, the rule the attacker added for their C2 (the packet counter of that rule grows). The firewall baseline is compared: new or modified rules are the finding.

Don't use it as a full network inventory: iptables shows host rules — the network firewall (router/cloud) is another layer. On modern systems with nftables or firewalld, iptables shows compatibility or the translated view: for the real state, use nft list ruleset or firewall-cmd. And watch out: rules without a clear default policy (the ACCEPT all) make the list irrelevant — the base policy is reviewed before the rules. Packet counters are the signal: the C2 rule with growing traffic reveals the attacker's communication, but without the previous baseline you can't distinguish it from legitimate rules — comparison with the documented baseline is the method.