The iptables of the Linux firewall

Linux has two firewall mechanisms, one is selinux and the other is netfilter.

SELinux This mechanism is too restrictive, the configuration is particularly cumbersome, so very few people to apply it, we generally have to turn selinux off, so as not to cause unnecessary trouble. SELinux can use the command: Setenforce 0 temporarily shut down or modify the configuration file Vim/etc/selinux/config change selinux=enforcing to selinux=disabled permanent shutdown.

The following main talk about NetFilter firewall: everyone used to call it Iptables,iptables is a unique firewall mechanism on Linux, the function is very powerful.

iptables There are rules under the table table,table under the chain Chain,chain.

Table has Filter,nat and mangle three kinds of tables, the most common is the filter table, we can use the command: Iptables-t FILTER-NVL View the filter table: Filter table has input,forward and output three chain , the input chain acts on the package that enters the machine, and the output acts on the native packet, and the forward chain is used for the package that is not related to the machine. We can use the command: iptables-t filter-i input or iptables-t filter-a input to add the rules for input:

-I indicates that the insert rule will take effect first at the top of all rules under input;

-A indicates that the add rule will take effect at the bottom of all rules under input.

For example, we can use the following command to filter out the IP-220.115.241.20 terminal into the server package:

Iptables-t filter-i input-p tcp--dport 80-s 220.115.241.20-j REJECT

We can also delete this rule with-D:

Iptables-t filter-d input-p tcp--dport 80-s 220.115.241.20-j REJECT

Here are some commands to use:

IPTABLES-F//temporarily clears all rules

Iptables-z//can set the number and size of packages that match the rule to 0

Service iptables stop//can temporarily empty all rules

Service iptables start/reload config file/etc/sysconfig/iptables the rules inside

Service Iptables save//can write rules to configuration file/etc/sysconfig/iptables Restart rule is still in effect

Iptables-save > 1.ipt//redirect rules to 1.ipt files that is backup

Iptables-restore < 1.IPT//Regular backup Restore

Iptables-i input-p tcp-s 192.168.1.101-j DROP//host and virtual machine disconnected, and the host is unable to log on to the VM via terminal (192.168.1.101 Master intranet IP)

Iptables-i input-p icmp-s 192.168.1.101-j DROP//host and virtual machines ping each other

Iptables-i input-p ICMP--icmp-type 0-j DROP//Only physical machine can ping the virtual machine
Iptables-i input-p ICMP--icmp-type 8-j DROP//Only virtual machine can ping through physical machine

This article is from the "Linux operation and Maintenance" blog, reproduced please contact the author!

The iptables of the Linux firewall