Package: iptables-stats
OverviewPeriodically gathers stats about iptables rules and sends them to different sinks (while currently only MQTT is supported). It is possible to count rules in chains, count number of packets/bytes processed by a rule and to count unique IPs in a ipset.UsageStartiptables_statand it will run constantly, generate readings periodically and publish them to configured sinks.ConfigurationThe program is configured using a configuration file in YAML format. Default location is/etc/iptable_stats.ymlbut a different location can be configured using the command line parameter--config.The config file consists of the sectiongeneraland a variable number of configuration sections for input modules and output sinks.Example:general:
  interval: 120

mqtt:
  host: myHost
  topic_root: home/myHost/iptables_stats

iptables_pkg_count:
  firehol_level1:
    chain: FIREHOL_BLACKLIST
    rule_regex: .*match-set.firehol_level3.src.*

  firehol_level2:
    chain: FIREHOL_BLACKLIST
    rule_regex: .*match-set.firehol_level2.src.*

  firehol_level3:
    chain: FIREHOL_BLACKLIST
    rule_regex: .*match-set.firehol_level3.src.*

ipset_count:
  firehol_level1:
    setname: firehol_level1

  firehol_level2:
    setname: firehol_level2

  firehol_level3:
    setname: firehol_level3

iptables_rule_count:
  f2b-traefik-auth:
    chain: f2b-traefik-auth
    offset: -1

  f2b-traefik-botsearch:
    chain: f2b-traefik-botsearch
    offset: -1This configuration contains threeiptables_pkg_countobjects that will report iptables counters for the rules matching the given regular expressions. Also threeipset_countobjects that count the number of unique IPs in the ipsetsfirehol_level1,firehol_level2andfirehol_level3.
Last but not least twoiptables_rule_countobjects that count the rules in the chainsf2b-traefik-authandf2b-traefik-botsearch.fail2baninjects rules into these chains in case of a IP ban. Each rule represents a single IP. Both objects use anoffsetof-1cause both chains contain a fixedDROPrule that should not be counted.Output SinksCurrntly only one sink is implementedMQTTExample:mqtt:
  host: myHost
  port: 1883
  topic_root: home/myhost/iptables_statshostport(optional) - defaults to 1883topic_root- string that defines the root topic that is used for publishing readingsReading ModulesEvery module has a section in the configuration. In each of these sections object configurations can be defined using a user-defined object name. Every object configuration can override the gobalintervalparameter so it is possible to configureintervalfor objects individually.iptable_pkt_countReads counter statistics for a given rule and chain fromiptablesand generates the readingspacket_countandbyte_count. Those represent the number of blocked packets and bytes.Configuration:chain- Name of the chainrule_regex- Regex that matches the rule in question. It is matched against a string as the rule appears in the output ofiptables-save. The regex is not allowed to match more than one rule.iptables_rule_countCounts the number of rules in a given chain and generates the readingrule_count.Configuration:chain- Name of the chainoffset(optional) - An integer that is added to the value before publishing. This is useful to account for rules that should be ignored. E.g. there might be a drop rule which should not account towards the value. Setoffsetto-1to adjust to that.