Linux Firewall (ii)--iptables syntax

First, the syntax:

iptables [-t table name] option [link name] [match condition] [-j control type]

When a table name is not specified, the filter table is used by default, the chain name is uppercase, and the matching condition must be specified unless the default policy is set, and all chains in the default table when the chain name is not specified.

Ii. Common types of control

Accept: Allow packets to pass

Drop: Drop the packet directly without a response

REJECT: Reject the packet pass, and if necessary, send a response message to the packet

LOG: Logging information is logged in the/var/log/messages file, and the package is passed to the next rule, and the "match-and-stop" firewall rule is a special case for log operations because log is a secondary action and does not really handle the package.

Iii. Common Options

-a adds a new rule at the end of the chain

-I inserts a new rule that defaults to the first rule when no ordinal is specified

-D Delete a rule in the chain to specify a rule number or specific content

-l lists the rules in the chain

-F clears the rules in the chain

-N Displays the result in numerical form, such as displaying an IP address instead of a host name

-P Set default rules for a specified chain

-V Show More information

--line-numbers the sequence number of the rule in the chain when viewing the rule table

Iv. examples of rules additions and deletions

1. Add rules

~] #iptables-t filter-a input-p tcp-j ACCEPT (adds a new rule after the last rule in the INPUT chain of the filter table)

~] #iptables-I INPUT 2-p tcp--dport 80-j ACCEPT (insert a rule in the second row of the filter table INPUT chain, allowing TCP port 80 to pass)

2. Delete Rule

~] #iptables-D input 3 (delete the third rule of the INPUT chain in the filter table)

~] #iptables-T Raw-f (clears rules in all chains in the raw table)

~] #iptables-F output (clears all rules in the filter table output chain)

3. Query rules

~] #iptables-nl INPUT--line-number (View all rules in the filter table input chain numerically, and display the rule sequence number)

V. Setting the Default policy

The default policy is the last link in the rule match, and the default policy is executed when no rule is found to match the packet. Whether it is a host-type firewall or a gateway-type firewall, the default policy for setting the filter table input chain and the forward chain is drop so that the hacker cannot attack the host or use the host as a springboard to attack other hosts.

-P Option: Set default rules for a specified chain

For example: ~] #iptables-t filter-p FORWARD ACCEPT

　　

　　

Linux Firewall (ii)--iptables syntax