Basic iptables configuration in Linux

LinuxSystem ConfigurationIptablesSpecific steps:

1. view the settings of IPTABLES on the local machine.

[root@www.linuxidc.com /]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destinationChain FORWARD (policy ACCEPT)
target     prot opt source               destination
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
Chain RH-Lokkit-0-50-INPUT (0 references)
target     prot opt source               destination

2. Clear original rules

[root@www.linuxidc.com /]# iptables -F

3. Save and take effect of the configured rule. You must perform the operation after each rule update.

[root@www.linuxidc.com /]# /etc/rc.d/init.d/iptables save[root@www.linuxidc.com /]# service iptables restart

4. Set preset rules

[root@www.linuxidc.com /]# iptables -P INPUT DROP [root@www.linuxidc.com /]# iptables -P OUTPUT ACCEPT [root@www.linuxidc.com /]# iptables -P FORWARD DROP

The above means that when two chain rules (INPUT and FORWARD) in the filter table in IPTABLES are exceeded, how can we process data packets not in these two rules, that is, DROP (discard ).

For the OUTPUT chain, that is, the outgoing package, you do not need to impose too many restrictions, but use ACCEPT. That is to say, what should we do if the package is not in a rule.

5. Example of adding a new rule

# To enable remote SSH Login, open port 22.

[root@www.linuxidc.com /]# iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Open the tcp protocol for the WEB Service port

iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# Open the tcp protocol for the POP3 Service port

[root@www.linuxidc.com /]# iptables -A INPUT -p tcp --dport 110 -j ACCEPT

# Open the tcp protocol of the SMTP service port

[root@www.linuxidc.com /]# iptables -A INPUT -p tcp --dport 25 -j ACCEPT

# Open the tcp protocol for the FTP service port

[root@www.linuxidc.com /]# iptables -A INPUT -p tcp --dport 21 -j ACCEPT

# Allow the IP address 202.106.12.130 to connect to the local SSH service port.

[root@www.linuxidc.com /]# iptables -A INPUT -p tcp -s 202.106.12.130 --dport 22 -j ACCEPT

# Allow inbound tcp packets from the DNS Service port

[root@www.linuxidc.com /]# iptables -A INPUT -p tcp --dport 53 -j ACCEPT