First knowledge of Linux iptables 1

Default firewall rules

Deny and deny a packet

IPFirewall data packet transmission

In the IP firewall, three built-in filter rule chains are used. All data packets arriving at the interface are filtered according to the input rule chain. If a data packet is accepted, it is sent to the routing module. The routing function determines whether a data packet is sent locally or forwarded to another outbound interface.

If the data packet is forwarded, the forwarding rule chain filters the data packet for the second time. If a packet is accepted, it is sent to the output rule chain.

Both the locally generated outbound data packets and the data packets to be forwarded must go through the output rule chain. If the packet is accepted, it is sent out through the interface.

The loop path contains two rule chains, as shown in. Each loop data packet needs to pass the output rule chain before the outbound loop interface, where it will be sent to the input interface of the loop, and then the input rule chain will be applied.

NetfilterData packet transmission

In netfilter (iptables), use the built-in input, output, and forward filter rule chains. All inbound data packets must pass through the routing function. It is up to you to decide whether to send the data packets to the input rule chain or the forwarding rule chain of the local host.

If the destination address is a local data packet accepted by the rules of the input rule chain, the data packet will be transmitted locally. If the destination address is a data packet accepted by the forward rule chain rule, the data packet will be sent out of the corresponding interface.

Outgoing packets processed locally are sent to the output rule chain. If the packet is accepted, the corresponding interface is sent. Therefore, each data packet is filtered once (two outgoing loop data packets are filtered ).

IptablesBasic syntax

Creating a firewall with netfilter is to use the iptables firewall management command. Run the iptables command to execute the firewall policy you have created to manage the firewall behavior. The netfilter firewall has three tables: filter, Nat, and mangle. With these tables, the firewall can be established by the rule chain. Each item in the Rule chain is an iptables command.

The default filter table contains a rule chain for processing input or data about to enter the firewall, and a rule chain for processing output or data about to exit the firewall, A rule chain for processing data forwarded or sent through the firewall, and a rule chain named and configured by other users, usually called a custom rule chain. Nat and mangel tables have special rule chains. Currently, the filter table is the default table used to implement the Basic firewall. The NAT table is used to provide Nat and related functions, and the mangle table is sufficient when the data packet is modified by the firewall.

The basic syntax of the iptables command starts with iptables, followed by one or more options, a rule chain, a matching standard level, and a target or deployment. The command design depends largely on the operation to be executed. You can refer to this syntax:

Iptables <option> <chain> <matching criteria> <target>

IptablesFeatures

Iptables uses different rule tables when processing different types of data packets. These rule tables are implemented by functional independent table modules. The three main modules are filter tables, Nat tables, and mangel tables that specially process data packets. All three table modules have their own extension modules, which will be dynamically loaded during the first application, unless directly compiled into the kernel.

The filter table is the default table. Other tables are defined using the command line option. The basic features of a filter table include:

(Unfinished, To be continued ...)