Introduction to Linux Firewall –iptables configuration policy

Netfilter/iptables Introduction

???? To really master the Linux firewall system, first of all to understand the relationship between NetFilter and Iptables, NetFilter and iptables included in the Linux2.4 after the kernel, can implement firewall, NAT and packet segmentation function. The NetFilter is modular in design and has good scalability. NetFilter is a framework, iptables is our user layer of tools, through iptables we can configure many rules, these rules are loaded into the NetFilter framework to take effect.

???? NetFilter can be a good fit with the protocol stack, 1, the bottom implementation mechanism of the protocol stack is this way, ABCDE is the point where we can configure the rules, BD we can control the packets sent to this machine, ACE can control the packets forwarded through this network card. So how do you do it in NetFilter? 2; For ABCDE Five points, NetFilter defines five hook functions, and five hook functions correspond to five chain of rules: Prerouting, INPUT, OUTPUT, FORWARD, postrouting The rules we use with iptables are in effect in these five chain of rules.

Figure 1. protocol stack bottom-level implementation

Figure 2. NetFilter implementation

Iptables Introduction

???? Iptables mainly includes four aspects of function:

???????? Filter function can be configured on the input chain, output chain, forward chain

???????? NET (address translation function) can be configured in Prerouting chain, postrouting chain, output chain

???????? Mangle (change header) can be configured on five chains

???????? Raw (RAW format) configurable in prerouting chain and output chain

???? If a rule with multiple functions configured on a chain is changed in what order? As shown in the following:

Figure 3. Rule effective sequence diagram

???? Iptables can also customize the chain, but must be called by the default of these five chains, similar to the interrupt function, if the custom chain match does not have to return, if the custom chain does not match, then return to the main chain to continue matching.

Examples of iptables rules

???? Let's take a few examples of iptables to introduce a detailed explanation of the iptables rule (maniptables can get a help document ).

?

?

iptables command Explanation

?

?

Iptables Common expansion Modules

?

?

NAT Address Translation

?

?

Layer7 Filter

?

?

?

?

?

?

?

Resources:

???? Insight into Linux netfilter&iptables: what is NetFilter?

???????? http://blog.chinaunix.net/uid-23069658-id-3160506.html

Introduction to Linux Firewall –iptables configuration policy