Linuxiptables firewall tutorial 2

Netfilter (packet filtering mechanism): analyzes the network packets that enter the host, captures the packet header data for analysis, and determines the online connection as a mechanism for release or resistance. 1. the table is an iptables building block, which describes its functions, such as packet filtering or network address translation (NAT ). Iptables has four tables: 1. filter (through

Netfilter (packet filtering mechanism): analyzes the network packets that enter the host, captures the packet header data for analysis, and determines the online connection as a mechanism for release or resistance.

1. table

Table isIptablesBuild block, which describes the thunder of its functions, such as packet filtering or network address translation (NAT ).

Iptables has four tables:

1. filter: mainly related to packets entering the Linux host.

INPUT: mainly related to packets that want to enter the Linux host.

OUTPUT: mainly related to the packets sent from the Linux host.

FORWARD: this has nothing to do with the Linux host. it can "transfer packets" to the backend computer, which is highly correlated with the nat table.

2. nat (address translation): Network AddressTranslation, which is mainly used to convert the source and destination IP addresses or ports, and has nothing to do with Linux machines, it is mainly related to computers in the local area network after the Linux host.

PREROUTING: used to modify the packet header before the kernel performs IP route computing.

POSTROUTING: used to modify the packet header after the kernel performs IP route computing.

3. mangle: This table is mainly related to the routing flag of special packets. Mangle is rarely used in a simple environment.

4. raw: rules independent of the netfiler connection tracing subsystem are applied to raw tables.

2. chain

Each table has its own set of built-in chains.

Chain in the filter table: INPUT, OUTPUT, and FORWARD

INPUT: when a data packet is determined to point to the local linux system (that is, the data packet points to a local socket) by the route computing in the kernel, it will pass the INPUT chain inspection

OUTPUT: reserved for data packets generated by the linux system.

FORWARD: manages data packets routed through the linux system (that is, when the iptables firewall is used to connect two networks, and the data packets between the two networks must flow through the firewall)

Links in nat tables: PREROUTING and POSTROUTING

3. match

Iptables matching refers to the condition that a data packet must match. only when a data packet meets all the matching conditions can iptables process the data packet according to the action specified by the target of the rule.

Each match is specified in the command line of iptables.

-- Source (-s) -- match the source IP address or network

-- Destination (-d) -- match the target IP address or network

-- Protocol (-p) -- match IP value

-- In-interface (-I) -- inbound interface (for example, eth0)

-- Out-interface (-o) -- outbound interface

-- State -- match a group of connection statuses

-- String -- match the data byte sequence at the application layer

-- Comment -- Associate up to 256 bytes of comment data for a rule in the kernel memory

4. target

Used to send an action when a packet matches a rule.

ACCEPT -- allow data packets to pass through

DROP -- discard the data packet and do not further process the data packet. for the receiving stack, it is as if the data packet has never been received.

LOG -- record data packet information to syslog

REJECT -- discard data packets and send appropriate response packets

RETURN -- continue to process data packets in the call chain