Linux Beginner-iptables article

Linux Beginner-iptables article

Iptables is a firewall, is used to set up, maintain and check the Linux kernel IP filtering rules, can complete packet filtering, packet redirection and network address translation (NAT) and other functions.

The iptables contains 3 tables and 5 chains. 3 Sheets are: Filter, mangle, Nat. 5 links are: INPUT, FORWARD, OUTPUT, prerouting, postrouting.

3 Tables represent:

Filter: General filtering function

Mangle: Used to modify a specific packet

NAT: for NAT function (port mapping, address mapping, etc.)

The present stage also joins the raw table, is generally in order to no longer let iptables do the data packet connection tracking processing, improves the performance.

Each of the 5 strands represents:

INPUT: After routing table, the destination is native

FORWARD: The destination is not native after routing table

OUTPUT: Generated by this machine, forwarded outward

Prerouting: Before packets enter the routing table

Postrouting: Before sending to Nic interface

1. Basic commands and settings for iptables

"Iptables-t filter-nl". View information for the filter table. As shown, you can see which chains are included in the filter table, and what are the strategies. Similarly, you can see other tables as well.

"Iptables-t filter-f". Empty This table all the policies, this is only temporary empty, after restarting Iptables will also appear, so you also need to enter the command "service iptables save" to save.

"Iptables-t filter-p INPUT accept| DROP ". Change the input mode in the filter table, accept, drop indicates drop packet. For example, when set to drop, other hosts cannot connect to the host via the SSH service.

"Iptables-t filter-a input-j REJECT". "-a" means that at the end of adding a policy, the policy is to reject all data. As shown, the client host cannot connect and the request is denied.

"Iptables-t filter-i INPUT 1-i lo-j ACCEPT". "-i" means to insert, plug in before the number, the policy indicates that the data of the machine can pass, as shown in, the machine can be SSH to connect to the machine, but the other host does not.

"Iptables-t filter-i INPUT 2-s 172.25.254.102-p tcp--dport 22-j ACCEPT". This policy indicates that the data of the 172.25.254.102 host can be passed through Port 22nd on this machine and Port 22nd is the port of the SSHD service.

"Iptables-t filter-i INPUT 3-p tcp--dport 80-j ACCEPT". This policy indicates that data for port 80th can be passed.

"Iptables-t filter-d INPUT 3". Delete the 3rd policy.

"Iptables-t filter-d inpunt-p tcp--dport 80-j ACCEPT". You can also delete a policy by following the conditions.

"Iptables-t filter-r INPUT 2-s 172.25.254.102-p tcp--dport 22-j REJECT". The "-R" means changing the policy to change the "ACCEPT" in the previously set policy to "REJECT".

"Iptables-t filter-n WE". Add a "WE" chain.

"Iptables-t filter-e WE REDHAT". To change the name of a custom chain, be aware that only custom chains can change the name.

"Iptables-x REDHAT". Deletes a custom chain.

2. Policy examples

Packet entry after the read policy is read from the top to bottom, if there are a lot of policies, a packet re-entry is obviously due to the read policy takes a long time, so you can set the policy, the first time the packet into the need to read whether to allow access to the policy, re-enter the direct pass. Take this as an example to briefly introduce policy application.

As shown, because the policy reads are one-by-one, it is possible to write the policy again in the first place to significantly shorten the read time. The first entry is "Iptables-t filter-a input-m State--state related,established-j ACCEPT", and this policy indicates that the incoming packets are passed directly. Then add "iptables-t filter-a input-m State--state new-i lo-j ACCEPT", which indicates that the native data can be passed directly. Later, you can add the various strategies for the first-entry packets shown in the diagram.

This is a simple application of the strategy.

However, it is important to note that in the policy setting, the FTP policy is special, because the FTP passive mode will randomly open a port greater than 1024 at the time of connection, the port is not fixed, so the policy is also different.

The steps are as follows:

Edit the FTP configuration file "/etc/vsftpd/vsftpd.conf", where you enter "pasv_max_port=1025" and "pasv_min_port=1025", the port is fixed on 1025, It can also be a different port that is greater than 1024. After restarting the service, enter "Iptables-t filter-i input 3-p tcp--dport 1025-j ACCEPT" To add the policy through this port. After the configuration is complete, you can use FTP.

3. Routing Policy

Existing 3 hosts, respectively, is a host with two cards server,ip, respectively, "172.25.254.202", "172.25.2.202", a client of the host IP for "172.25.2.102", the Gateway is "172.25.2.202", The IP of one host is "172.25.254.2".

The client host of the "2" segment now wants to connect to the host of the "254" network segment via SSH, which is not possible without any configuration. First, you can configure the Iptablse with the server host as the router, so that it can be implemented.

The configuration on the server host is as follows:

A, "sysctl-a | grep forward ". Use this command to see if the kernel routing feature "Net.ipv4.ip_forward" is turned on, 0 is off, and 1 is turned on.

B, "vim/etc/sysctl.conf". If it is not turned on, edit the file and write "Net.ipv4.ip_forward = 1" in it. When finished, enter "Sysctl-p" to load.

C, "Iptables-t nat-a postrouting-o eth0-j SNAT--to-source 172.25.254.102". Add a policy so that all packets that pass through the ETH0 network card are encapsulated as "172.25.254.102" packets.

Upon completion of the above strategy, the client host of the "2" segment can connect to the "172.25.254.2" host.

However, because the packets are encapsulated, only the hosts that are connected to "172.25.254.202" are visible on the "172.25.254.2" host and are unaware of the presence of the client host. At this time, you can join the policy on the server host, so that the "172.25.254.2" host connection to see the IP, directly connected to the "2" network segment of the host client. Enables the server host to complete the routing function.

On the server host, add the policy "iptables-t nat-a prerouting-i eth0-j DNAT--to-dest 172.25.2.102". After joining the "172.25.254.2" host Connection Server host will automatically connect to the "2" network segment of the client host.

These are just some of the commands and applications of iptables and can be studied if the reader is interested.

Linux Beginner-iptables article