Cybersecurity Triage

Changes system state

Show iptables INPUT Rules

You need a concise view of the iptables INPUT chain policy and rules.

Command

iptables -S INPUT

Before you run this

System impact: Changes system or application state. Needs inspection, scoping, and rollback notes before production use.

When not to use it: Do not assume iptables output covers nftables-native rules on every modern distribution.

Expected output

INPUT policy and append rules for accepted or dropped traffic.

System impact

Changes system state. Nothing changes. iptables prints the INPUT chain in a reusable rule format, but firewall policy can be distro- and stack-specific.

Recovery / rollback: no state is changed.

When to use it

Use on systems where iptables rules may still be active or where tooling reports iptables syntax.

When not to use it

Do not assume iptables output covers nftables-native rules on every modern distribution.

Watch this command run

Command transcript

This sanitized transcript shows the commands and output shape without exposing host details.

demo@lab:~$

$ iptables -S INPUT

-P INPUT DROP
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -s 203.0.113.0/24 --dport 22 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 5432 -j DROP

$ iptables -S INPUT | grep -- '--dport'

-A INPUT -p tcp -s 203.0.113.0/24 --dport 22 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 5432 -j DROP

View commands shown

These are the commands shown in the sanitized transcript.

Commands shown

iptables -S INPUT
iptables -S INPUT | grep -- '--dport'

next steps

Related commands

Cybersecurity Triage Read-only

Show the nftables Input Chain

The packet path was hiding below UFW.

nft list ruleset | sed -n '/chain input/,/}/p'

Cybersecurity Triage State change

Read UFW Policy Verbosely

The firewall was active, but the defaults mattered more than the rule list.

ufw status verbose

Cybersecurity Triage State change

List Numbered UFW Rules

Numbered rules make firewall review less ambiguous.

ufw status numbered

Cybersecurity Triage Sensitive output

Review sudo Grants

Privilege paths should be visible before you remove or approve access.

awk -F: '$1=="sudo" {print "sudo group: " $4}' fixtures/user-access-audit/etc/group; grep -RhnE '^[^#].*ALL=' fixtures/user-access-audit/etc/sudoers fixtures/user-access-audit/etc/sudoers.d