Linux: Network Firewall principle

Linux: Network Firewall

Netfilter:frame

Iptables: Data packet filtering, Nat,mangle and other rules-generated tools

Network: IP packet header, TCP packet header

Firewall: Hardware, Software: rules (matching criteria, handling methods)

Framework:

Default rule:

Open: Blocking

Off: Pass

Rules: Matching Criteria

IP: Source IP, Destination IP

TCP: Source port, Destination port

TCP Three-time handshake: syn=1,fin=0,rst=0,ack=0;

syn=1,ack=1,fin=0,rst=0;

Ack=1,syn=0.rst=0,fin=0 (established);

UDP: Source port, Destination port

Icmp:icmp-type

Data message filtering:

Linux2.0

Ipfw/firwall

Linux2.2

Ipc

Linux2.4

Iptables/netfilter

hook function: Hook functions

Prerouting

Input

Output

Forward

Postrouting

Rule chain:

Filter (filtered): Table

INPUT

OUTPUT

FORWARD

Nat (address translation): Table

Prerouting

OUTPUT

Postrouting

Mangle (Modify message header, disassemble, modify, package): Table

Prerouting

Input

Output

Forward

Postrouting

Raw ():

Prerouting

OUTPUT

Iptables

Custom chains: can only function when called, and there should be a return mechanism if none of the rules in the custom chain match.

User can delete a custom empty chain

Default chain cannot be deleted

Each rule has a built-in counter

The number of packets to be matched

The sum of the size of the packets being matched to

Rules: Matching criteria, handling actions

iptables [-t TABLES] COMMAND CHAIN [num] matching standard-j processing method

Matching Criteria:

Generic match:

-S,--src specify the original address

-D,--dst specify Destination address

-P, {TCP|UDP|ICMP}: Specify protocol

-I, INTERFACE: Specifies the interface to which the data packet flows

Chains available for definition: Prerouting,input,forward

-O, INTERFACE: Specifies the outgoing interface of the data message

can be used for standard definition of chain Output,postrouting,forward

Extended match:

Implied extension: Do not specifically indicate which module is being extended, because the-p {tcp|udp|icmp} is used at this time

Show extensions: You must indicate which module is being extended and use the-M option in iptables to complete this function

-j TARGET

ACCEPT

DROP

REJECT

This article from "Operation and maintenance Growth Road" blog, declined reprint!

Linux: Network Firewall principle