Analysis of Iptables Principles and Applications

Analysis of Iptables Principles and Applications

I. Iptables principles

Currently, firewalls are divided into three types: packet filtering, application proxy, and status detection.

Packet Filtering Firewall: the static packet filtering firewall is no longer available in the market. Instead, it is replaced by the dynamic packet filtering firewall ~

Proxy firewall: WAF protection can be easily broken through because of some special packet attacks, such as SYN attacks and ICMP flood attacks that everyone knows, therefore, the application proxy firewall that uses the proxy server as a dedicated data forwarding channel for user confidentiality or access restrictions has emerged ~ It uses a new technology for application protocol analysis.

Status detection firewall: developed based on the dynamic packet filtering technology, it adds a status detection module and develops the session filtering function. The retention of session states is time-limited, this firewall can also analyze the package content to avoid opening too many ports.

The netfilter/iptables IP packet filtering system consists of two components: netfilter and iptables. Netfilter is a part of the integration in the kernel. It defines and stores the corresponding rules. iptables is a tool used to modify Information Filtering Rules and other configurations, we can use iptables to set rules that suit our enterprise's needs ~, These rules are stored in the kernel space.

Netfilter is a general architecture in the Linux kernel. It provides a series of tables (tables). Each table is composed of several chains (chains, each chain can be composed of one or more rules. In fact, netfilter is a table container, a table is a chain container, and a chain is a rule container.

Iptables built-in chain

PREROUTING: Before a data packet enters the Local Machine

INPUT: the destination is the local machine after the route table is passed

FORWARDING: After the route table is passed, the destination is not the Local Machine

OUTPUT: generated by the local machine and forwarded externally

POSTROUTIONG: After the route table is passed, before the interface is sent to the NIC

The following are the mappings between tables and chains:

-------------------------------------- Split line --------------------------------------

Iptables examples

Iptables-packet filtering (Network Layer) Firewall

Linux Firewall iptables

Iptables + L7 + Squid implements a complete software firewall

Basic use of iptables backup, recovery, and firewall scripts

Detailed description of firewall iptables usage rules in Linux

-------------------------------------- Split line --------------------------------------

Ii. Basic iptables usage

Basic Syntax:

Iptables [-t table] command chain cretiria-j TARGET

-T table:

Net, mangle, raw, filter

The default value is filter.

COMMAND:

Chain:

-F: (flush) Clear the rule chain

-N :( new) self-built a chain

-X: (delete) delete a custom empty chain.

-Z: (zero) The counter returns to zero.

-P :( policy) set the Default policy. For the filter table, the default rule is ACCEPT or DROP.

-E: rename a custom chain

CHAIN: Specifies the CHAIN on which your next rule operates.

CRETIRIA: Specify matching criteria

ACTION: Specifies how to process

Common commands

DROP: quietly discarded. Generally, we use DROP to hide our identity and our linked list.

REJECT: explicitly deny

ACCEPT: ACCEPT

DNAT: explicitly declares that the destination address translation operation is required.

SNAT: explicitly declares that the source address translation operation is required.

MASQUERADE: Source Address disguise

REDIRECT: Redirection: Mainly used for port redirection

MARK: marked by the firewall

RETURN: returns the original rule chain after the custom chain is executed.

Rules in the chain

-A: (append) add one or more rules at the end of the selected chain.

-I: (insert) insert one or more rules to the selected Chain Based on the given rule sequence number.

-D: (delete) delete one or more rules from the selected chain.

-R: (replace) replace a rule from the selected chain.

Common query commands

-L

-N: Host address port displayed in digital format

-V: displays detailed format information.

-Vv

-Vvv: the more data is displayed, the more detailed the data is.

-- Line-numbers: displays the rule number.

-X: exactly. Do not convert the counter count result to an exact value.

Pkts bytes target prot opt in out source destination

Pkts: packets, number of packets matched by this rule

Bytes: The sum of the sizes of all packets matched by this rule. unit conversion is performed.

Target: The target, that is, the processing mechanism.

Prot: Protocol, generally {TCP | UDP | ICMP}

Opt: Optional

In: Inbound interface of data packets

Out: the outbound interface of the Data Packet

Source: source Address

Destination: destination Address

For more details, please continue to read the highlights on the next page:

1 2 3 Next Page