First glance at iptables

Iptables is a firewall that works on the Linux kernel. The firewall is divided into the network layer and the application layer firewall according to the working level, while iptables is the network layer firewall because it works on the network layer of the OSI model, according to the status classification of the firewall, it can be divided into packet filtering firewall, status detection firewall, and application proxy firewall, while iptables is a packet filtering firewall.

After Linux kernel version 2.4 is integrated into the kernel, ipfwadm is used in kernel 2.0, ipchains is used in kernel version 2.2, and firewalls usually work at the junction between the Intranet and the periphery, iptables matches the source IP address, target IP address, source port, and target port of the TCP/IP and UDP data packets to allow or forward the data packets that pass through, and discards the rejected data packets, this guarantees the maximum security of the Intranet or server.

Iptables supports table and chain classification. data packets are classified into raw, mangle, Nat, and filter based on the inbound mode from the external to the internal. Raw is rarely used, mangle is mainly used to modify the data packet header and TTL, and Nat is used to perform address translation on the data packet. The filter mainly controls the data packets entering and exiting the local machine. In order to better process the data packets, the preceding three tables have different links: prerouting, postrouting, input, output, and forward. The ing between tables and chains is as follows:

Input: filter, mangle

Output: filter, Nat, mangle

Forwarf: filter, mamgle

Postrouting: mangle, Nat

Prerouting: mangle, Nat

Shows the relationship between links:

650) This. width = 650; "src =" http://s3.51cto.com/wyfs02/M01/4D/B9/wKiom1RYS_nDgSr0AADgnW7FE_c662.jpg "Title =" 1.jpg" alt = "wkiom1rys_ndgsr0aadgnw7fe_c662.jpg"/>

It can be seen that each table has a fixed position and function. Its functions are as follows:

Input: request to enter the Local Machine

Output: requests sent from the Local Machine

Foreard: requests from the local machine do not enter the Local Machine

Prerouting: Before routing, the target address is converted. For example, if a company publishes a server to the Internet, it can modify the IP address of the target server that accesses the internet,

Postrouting: Source Address Translation after Routing

The relationships between these tables and links are as follows:

Filter: input, forward, output

NAT: postrouting, output, postrouting

Mangle: postrouting, prerouting, output, input, forward

This article is from the "Linux" blog, please be sure to keep this source http://zhangshijie.blog.51cto.com/806066/1571622

First glance at iptables