Basic network knowledge ---------- iptables, ---------- iptables

Basic network knowledge ---------- iptables, ---------- iptables
IptablesCommands are commonly used in linux, and are part of the netfilter project. You can configure the syntax directly or through the graphical interface.

Iptables (option) (parameter)

Option

-T <Table>: Specifies the table to be manipulated.-A: adds an entry to the rule chain.-D: deletes an entry from the rule chain.-I: insert entries into the rule chain.-R: Replace the entries in the Rule chain.-L: display the existing entries in the Rule chain.-F: Clear the existing entries in the Rule chain; -Z: clears the data packet calculator and byte counter in the Rule chain.-N: Creates a custom rule chain.-P: defines the default target in the Rule chain.-h: displays help information.-p: Specifies the protocol type of the data packet to be matched.-s: Specifies the source IP address of the data packet to be matched.-j <target>: Specifies the target to be redirected; -I <Network Interface>: Specifies the network interface for the data packet to enter the local machine;-o <Network Interface>: Specifies the network interface used by the local machine to exit the data packet.

Iptables Command Option input sequence:

Iptables-t table name <-A/I/D/R> rule chain name [Rule number] <-I/o Nic Name>-p protocol name <-s source IP address/ source subnet> -- sport source port <-d target IP Address/target subnet> -- dport target port-j action

Table names include:

• Raw: Advanced features, such as URL filtering.
• Mangle: Packet modification (QOS), used to achieve service quality.
• Net: Address translation, used for Gateway Router.
• Filter: Packet filtering, used for firewall rules.

Rule chain names include:

• INPUT chain: Process input data packets.
• OUTPUT chain: Process output data packets.
• PORWARD chain: Process forwarded data packets.
• PREROUTING chain: Used for destination address translation (DNAT ).
• POSTOUTING chain: Used for SNAT conversion ).

Actions include:

• Accept: Receives data packets.
• DROP: Discard data packets.
• REDIRECT: Redirection, ing, and transparent proxy.
• SNAT: Source address conversion.
• DNAT: Destination Address conversion.
• MASQUERADE: NAT, used for ADSL.
• LOG: Log record.

Instance

Clear existing iptables rules

iptables -Fiptables -Xiptables -Z

 

Open the specified port

Iptables-a input-s 127.0.0.1-d 127.0.0.1-j ACCEPT # Allow the local loopback interface (that is, run the local machine to access the local machine) iptables-a input-m state -- state ESTABLISHED, RELATED-j ACCEPT # Allow established or connected access iptables-a output-j ACCEPT # Allow all hosts to access iptables-a input-p tcp -- dport 22-j ACCEPT # Allow access to port 22 iptables-a input-p tcp -- dport 80-j ACCEPT # Allow access to port 80 iptables-a input-p tcp -- dport 21-j ACCEPT # allow ftp port 21 of the Service iptables-a input-p tcp -- dport 20-j ACCEPT # Allow Port 20 of the FTP service iptables-a input-j reject # prohibit other unpermitted rules from accessing iptables -a forward-j REJECT # prohibit access by other unpermitted rules

 

Blocked IP Address

Iptables-I input-s 123.45.6.7-j DROP # command iptables-I INPUT-s 123.0.0.0/8-j DROP # command iptables from 123.0.0.1 to 123.20.254 -I input-s 124.45.0.0/16-j DROP # an IP address segment is the command iptables-I INPUT-s 123.45.6.0/24-j DROP # an IP address segment from 123.45.0.1 to 123.45.254. the command from 123.45.6.1 to 123.45.6.254 is

 

View added iptables rules

iptables -L -n -vChain INPUT (policy DROP 48106 packets, 2690K bytes) pkts bytes target     prot opt in     out     source               destination          5075  589K ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0            191K   90M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:221499K  133M ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:804364K 6351M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 6256  327K ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 3382K packets, 1819M bytes) pkts bytes target     prot opt in     out     source               destination          5075  589K ACCEPT     all  --  *      lo      0.0.0.0/0            0.0.0.0/0  

 

Delete an added iptables rule

Display All iptables with serial numbers. Run the following command:

iptables -L -n --line-numbers

For example, to delete the rule with serial number 8 in INPUT, execute:

iptables -D INPUT 8