Iptables details
Iptables principlesCurrently, firewalls are divided into the following types:
Packet filtering, application proxy, and status detection
Packet Filtering Firewall:The static packet filtering firewall is no longer available in the market. Instead, it is replaced by the dynamic packet filtering firewall ~
Proxy firewall:Because of some special packet attacks, you can easily break through the protection of the packet filtering firewall, such as SYN attacks and ICMP flood attacks, therefore, the application proxy firewall that uses the proxy server as a dedicated data forwarding channel for user confidentiality or access restrictions has emerged ~ It uses a new technology for application protocol analysis. Status detection firewall: developed based on the dynamic packet filtering technology, it adds a status detection module and develops the session filtering function. The retention of session states is time-limited, this firewall can also analyze the package content to avoid opening too many ports. The netfilter/iptables IP packet filtering system consists of two components: netfilter and iptables. Netfilter is a part of the integration in the kernel. It defines and stores the corresponding rules. iptables is a tool used to modify Information Filtering Rules and other configurations, we can use iptables to set rules that suit our enterprise's needs ~, These rules are stored in the kernel space. Netfilter is a general architecture in the Linux kernel. It provides a series of tables (tables). Each table is composed of several chains (chains, each chain can be composed of one or more rules. In fact, netfilter is a table container, a table is a chain container, and a chain is a rule container.
Filter tableNat table
Mangle table
Iptables built-in chain
PREROUTING: Before the route table
INPUT: The destination is the local machine after the route table is passed
FORWARDING: After the route table is passed, the destination is not the Local Machine
OUTPUT: Generated by the local machine and forwarded externally
POSTROUTIONG: After Routing
Relationship between five netfilter chains, that is, iptables packet forwarding Flowchart
Iptables WorkflowIptables has three tables and five links.
Basic Iptables syntax
Iptables [-t table name]-command-match-j action/TargetIptables has three built-in tables: filter, nat, and mangle. We can use the-t parameter to set which table is effective ~ You can also omit the-t parameter. The filter table is operated by default. For specific command parameters, you can use
Man iptablesQuery ~
Configure the basic syntax of the SNAT command
Iptables-t nat-a postrouting-o network interface-j SNAT -- to-source IP address
Configure the DNAT command syntax
Iptables-t nat-a prerouting-I network interface-p protocol -- dport-j DNAT -- to-destination IP address.
(1) deletion policy
Iptables-F: Clears the rules in the selected chain. If no chain is specified, all the chain rules in the specified table are cleared.
Iptables-X: Clear the rules in the User-Defined chain in the filter of the preset table.
Iptables-Z: Clear the rules in the User-Defined chain in the filter of the preset table.
2. Set the loopback addressSome services need to use the loopback address for testing. To ensure the normal operation of each service, you need to allow loopback address communication. If the loopback address is not set, some services cannot be started ~.
Iptables-a input-I lo-j ACCEPT
3. Connection status settingsTo simplify firewall configuration and improve inspection efficiency, you need to add connection status settings.
Iptables-a input-m state -- state ESTABLISHED, RELATED-j ACCEPT
Connection Tracing has four data packet statuses
NEW: The data packet for which you want to create a connection
INVALID: Invalid data packets, such as corrupted or incomplete data packets
ESTABLISHED: Data packets with established connections
RELATED: Data packet associated with the sent data packet
4. Configure port 80 forwardingThe company's website needs to be open to the outside world, so we need to open port 80
Iptables-a forward-p tcp -- dport 80-j ACCEPT
5. DNS settingsIn order for the client to access the Internet normally using the domain name, we also need to allow data forwarding between the Intranet computer and the external DNS server. Enable DNS to use UDP and TCP ports 53
Iptables-a forward-p tcp -- dport 53-j ACCEPT
Iptables-a forward-p udp -- dport 53-j ACCEPT
6. SSH access to the serverThe Administrator performs remote management over the internet, so we need to enable TCP port 22 used by SSH.
Iptables-a input-p tcp -- dport 22-j ACCEPT
7. NAT port ing settingsBecause the LAN address is a private address, it is invalid on the Internet ~ Therefore, you must convert the private IP address to the external IP address of the server for address ing ~ The connection to the Internet interface is ppp0.
Iptables-t nat-a postrouting-o ppp0-s 192.168.0.0/24-j MASQUERADE
MASQUERADE works the same as SNAT ~ It is similar to the operation that provides source address translation. However, MASQUERADE sets a drop for a dynamic IP address for an external interface and does not need to use -- to-source to specify the IP address to be converted. If the network uses dial-up access to the Internet without external static IP addresses (mainly used for dynamic access to IP addresses, such as ADSL dial-up and DHCP connections), we recommend that you use MASQUERADE ~
Note: MASQUERADE is a special filtering rule. It can only map data from one interface to another ~
8. WEB sites are released on Intranet machines.The IP address of the Intranet WEB server is 192.168.0.3. We need to configure the following ~, When a public network client accesses the server, the firewall maps requests to port 80 of 192.168.0.3 on the Intranet.
Iptables-t nat-a prerouting-I ppp0-p tcp -- dport 80-j DNAT -- to-destination 192.168.0.3: 80
9. Save and restore the iptables configuration
Save: iptables-save
Iptables-save [-c] [-t table name]-C: Save the value of the package and byte counter. This prevents packet and byte statistics from being lost after the firewall is restarted-t: The rule used to save the table, if the-t parameter is not followed, all tables can be saved using the redirection command to save these rule sets.
Iptables-save>/etc/iptables-save
Restore: iptables-restore
Iptables-restore [-c] [-n]-C: If the-c parameter is added, the package and byte counter-n are required.-n indicates that the rules in the existing table or table are not overwritten, by default, all existing rules are cleared and redirection is used to restore the Rule Set saved by iptables-save.
Iptables-restore>/etc/iptables-save
If it takes effect after the service or system restart
Service iptables save
