iptables-save gives weird results [closed] - iptables

Question

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about a specific programming problem, a software algorithm, or software tools primarily used by programmers. If you believe the question would be on-topic on another Stack Exchange site, you can leave a comment to explain where the question may be able to be answered.
Closed 3 years ago.
Improve this question
on an empty iptables I did:
$iptables -P INPUT DROP
$iptables -P OUTPUT DROP
$iptables -P FORWARD DROP
and a few rules for SSH, HTTP and TEAMSPEAK
and when I did iptables-save I got that result that allows some IP
# Generated by iptables-save v1.4.8 on Thu Feb 20 23:55:32 2014
*raw
:PREROUTING ACCEPT [6299:1141558]
:OUTPUT ACCEPT [6172:2577934]
COMMIT
# Completed on Thu Feb 20 23:55:32 2014
# Generated by iptables-save v1.4.8 on Thu Feb 20 23:55:32 2014
*nat
:PREROUTING ACCEPT [328:23247]
:INPUT ACCEPT [170:9752]
:OUTPUT ACCEPT [1190:168880]
:POSTROUTING ACCEPT [717:89971]
COMMIT
# Completed on Thu Feb 20 23:55:32 2014
# Generated by iptables-save v1.4.8 on Thu Feb 20 23:55:32 2014
*mangle
:PREROUTING ACCEPT [6299:1141558]
:INPUT ACCEPT [6299:1141558]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6172:2577934]
:POSTROUTING ACCEPT [5699:2499025]
COMMIT
# Completed on Thu Feb 20 23:55:32 2014
# Generated by iptables-save v1.4.8 on Thu Feb 20 23:55:32 2014
*filter
:INPUT DROP [17:1024]
:FORWARD DROP [0:0]
:OUTPUT DROP [76:11042]
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p udp -m udp --dport 9987 -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCE\
PT
-A OUTPUT -p tcp -m tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT\
-A OUTPUT -p udp -m udp --sport 9987 -j ACCEPT
COMMIT
The question is, is it normal? Am I hacked?

Answer 1

If your question is referring to the numbers in square brackets i.e.
*nat
:PREROUTING ACCEPT [328:23247] <-- these numbers
Then no, you haven't been hacked.
Those are packet and byte counters.
A very good tutorial on iptables by Oskar Andreasson is found at: http://www.faqs.org/docs/iptables/index.html
with a page covering what you are asking about at: http://www.faqs.org/docs/iptables/iptables-save.html

Answer 2

Note that iptables-save is made to be used by iptables-resture, hence the complex formatting. Use iptables -S for a more simple form.
Furthermore, I would suggest using a more simple rules such as:
Allow outgoing traffic and continue any already established connections
iptables -F
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -P FORWARD DROP
Specific port you want to use for input
iptables -A INPUT -p TCP --dport 22 -m state --state ESTABLISHED,NEW -j ACCEPT
iptables -A INPUT -p TCP --dport 80 -m state --state ESTABLISHED,NEW -j ACCEPT
iptables -A INPUT -p TCP --dport 443 -m state --state ESTABLISHED,NEW -j ACCEPT
iptables -A INPUT -p TCP --dport 9987 -m state --state ESTABLISHED,NEW -j ACCEPT
Of course, run those in a script, otherwise the 'iptables -f' would disconnect your current SSH session.