25 most common iptables strategies

1. Clear the existing policy
When you start to create a new policy, you may want to clear all the default policies, and the existing policies can do so:
Iptables-f or Iptables--flush
2, set the default policy
The default chain policy is accept, changing all chain policies to drop:
Iptables-p INPUT DROP
Iptables-p FORWARD DROP
Iptables-p OUTPUT DROP
3, block a specified IP
block_this_ip= "x.x.x.x"
Iptables-a input-s "$BLOCK _this_ip"-j DROP
Iptables-a input-i eth0-s "$BLOCK _this_ip"-j DROP
Iptables-a input-i eth0-p tcp-s "$BLOCK _this_ip"-j DROP
4, allow SSH
Allow all connections to the machine via the Eth0 interface using the SSH protocol:
Iptables-a input-i eth0-p TCP--dport 22-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 22-m State--state established-j ACCEPT
5, allow a network segment to connect via SSH
Iptables-a input-i eth0-p tcp-s 192.168.100.0/24--dport 22-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 22-m State--state established-j ACCEPT
6, allow HTTP and HTTPS
Allow all incoming Web traffic: Port 80 of the HTTP protocol
Iptables-a input-i eth0-p TCP--dport 80-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 80-m State--state established-j ACCEPT
Allow all incoming Web traffic: port 443 of the HTTPS protocol
Iptables-a input-i eth0-p TCP--dport 443-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 443-m State--state established-j ACCEPT
7, multiple policies are combined together
Allow Ssh,http,https:
Iptables-a input-i eth0-p tcp-m multiport--dports 22,80,443-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p tcp-m multiport--sports 22,80,443-m State--state established-j ACCEPT
8, allow SSH to connect to other hosts
Iptables-a output-o eth0-p TCP--dport 22-m State--state new,established-j ACCEPT
Iptables-a input-i eth0-p TCP--sport 22-m State--state established-j ACCEPT
9, allow SSH to connect to the specified network segment
Iptables-a output-o eth0-p tcp-d 192.168.100.0/24--dport 22-m State--state new,established-j ACCEPT
Iptables-a input-i eth0-p TCP--sport 22-m State--state established-j ACCEPT
10, allow HTTPS to go out
Iptables-a output-o eth0-p TCP--dport 443-m State--state new,established-j ACCEPT
Iptables-a input-i eth0-p TCP--sport 443-m State--state established-j ACCEPT
11, Load balance Web requests (every three packages, balanced to a specified server, need to expand iptables)
Iptables-a prerouting-i eth0-p TCP--dport 443-m State--state new-m nth--counter 0--every 3--packet 0-j DNAT--t O-destination 192.168.1.101:443
Iptables-a prerouting-i eth0-p TCP--dport 443-m State--state new-m nth--counter 0--every 3--packet 1-j DNAT--t O-destination 192.168.1.102:443
Iptables-a prerouting-i eth0-p TCP--dport 443-m State--state new-m nth--counter 0--every 3--packet 2-j DNAT--t O-destination 192.168.1.103:443
12, allow Ping
Iptables-a input-p ICMP--icmp-type echo-request-j ACCEPT
Iptables-a output-p ICMP--icmp-type echo-reply-j ACCEPT
13, allow ping remote
Iptables-a output-p ICMP--icmp-type echo-request-j ACCEPT
Iptables-a input-p ICMP--icmp-type echo-reply-j ACCEPT
14, allow local loopback
Iptables-a input-i lo-j ACCEPT
Iptables-a Output-o lo-j ACCEPT
15, allow intranet access to external network
This example eth1 connecting an external network, eth0 connecting the internal network
Iptables-a forward-i eth0-o eth1-j ACCEPT
16, allow DNS to go out
Iptables-a output-p udp-o eth0--dport 53-j ACCEPT
Iptables-a input-p udp-i eth0--sport 53-j ACCEPT
17, allow NIS connections
The NIS port is dynamic when Ypbind is started and it allocates ports.
First run the rpcinfo-p display to get the port number, this example uses port 850,853.
Iptables-a input-p TCP--dport 111-j ACCEPT
Iptables-a input-p UDP--dport 111-j ACCEPT
Iptables-a input-p TCP--dport 853-j ACCEPT
Iptables-a input-p UDP--dport 853-j ACCEPT
Iptables-a input-p TCP--dport 850-j ACCEPT
Iptables-a input-p UDP--dport 850-j ACCEPT
The above example will fail when Ypbind restarts, there are 2 solutions:
(1) Assigning NIS service static IP (2) using sophisticated scripting
18, allow the specified network segment to connect to Rsync
Iptables-a input-i eth0-p tcp-s 192.168.101.0/24--dport 873-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 873-m State--state established-j ACCEPT
19, allows MySQL to connect from the specified network segment
Iptables-a input-i eth0-p tcp-s 192.168.100.0/24--dport 3306-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 3306-m State--state established-j ACCEPT
20, allow SendMail or postfix
Iptables-a input-i eth0-p TCP--dport 25-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 25-m State--state established-j ACCEPT
21, allow IMAP and Imaps
Imap:
Iptables-a input-i eth0-p TCP--dport 143-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 143-m State--state established-j ACCEPT
IMAPS:
Iptables-a input-i eth0-p TCP--dport 993-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 993-m State--state established-j ACCEPT
22, allow POP3 and pop3s
POP3:
Iptables-a input-i eth0-p TCP--dport 110-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 110-m State--state established-j ACCEPT
Pop3s:
Iptables-a input-i eth0-p TCP--dport 995-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 995-m State--state established-j ACCEPT
23, preventing Dos attacks
Iptables-a input-p tcp--dport 80-m limit--limit 25/minute--limit-burst 100-j ACCEPT
-M: Using iptables extensions
--limit 25/minute: Limit number of minute connection requests
--limit-burst: Trigger threshold, number of packets in a single flood
24, Port forwarding
All from 442 go to Port 22.
Iptables-t nat-a prerouting-p tcp-d 192.168.102.37--dport 422-j DNAT--to 192.168.102.37:22
You must also explicitly allow Port 442
Iptables-a input-i eth0-p TCP--dport 422-m State--state new,established-j ACCEPT
Iptables-a output-o eth0-p TCP--sport 422-m State--state established-j ACCEPT
25, packet discard log
You may want to view the logs for all discarded packages.
First create a new chain called LOGGING
Iptables-n LOGGING
Make sure all connections jump to logging
Iptables-a input-j LOGGING
Record these packages by customizing the name "Log-prefix"
Iptables-a logging-m limit--limit 2/min-j LOG--log-prefix "iptables Packet Dropped:"--log-level 7
Finally discard these packets
Iptables-a logging-j DROP

25 most common iptables strategies