I'm dumb, iptables returns ufw-configured results. This is like how the chrome_extensions table can return values for multiple browsers, I should probably send a docs PR

On linux,

iptables

is a common networking tool. It was the defacto firewall. There are many third party tools that will create/manage/etc iptables rules.

ufw

is a common one. But I’m loathe to try to enumerate them, or even mention them. It feels very different than

chrome_extensions

and chromium browsers. I’d partly expect a site admin to know this. Like, if someone was using puppet to manage their iptable rules, would you expect the osquery docs to talk about puppet there?

And relatedly, there’s a pending issue where linux is moving away from iptables to nettables, and osquery doesn’t support that yet. (Not totally sure I remembered the name)