Basic iptables operations

If you do not know the basic knowledge about IPTABLES, we recommend that you first check it out. configure a filter table firewall. (1) view the settings of IPTABLES on the local machine [root @ tp ~] # Iptables-L-nChainINPUT (policyACCEPT) targetprotoptsourcedestinationChainFORWA if you do not know the basic IPTABLES knowledge, we recommend that you first check it out.
Start configuration
Let's configure a filter table firewall.
(1) view the settings of IPTABLES on the local machine
[Root @ tp ~] # Iptables-L-n
Chain INPUT (policy ACCEPT)
Target prot optsource destination
Chain FORWARD (policy ACCEPT)
Target prot optsource destination
Chain OUTPUT (policy ACCEPT)
Target prot optsource destination
Chain RH-Firewall-1-INPUT (0 Records)
Target prot optsource destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255
ACCEPT esp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT ah -- 0.0.0.0/0 0.0.0.0/0
ACCEPT udp -- 0.0.0.0/0 224.0.0.20.udpdpt: 5353
ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 uddpt: 631
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED, ESTABLISHED
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt: 22
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt: 80
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt: 25
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
We can see that when I installed Linux, I chose to have a firewall and opened ports 22, 80, and 25.
If you do not choose to start the firewall when installing linux
[Root @ tp ~] # Iptables-L-n
Chain INPUT (policy ACCEPT)
Target prot optsource destination
Chain FORWARD (policy ACCEPT)
Target prot optsource destination
Chain OUTPUT (policy ACCEPT)
Target prot optsource destination
There are no rules.
(2) clear the original rules.
Whether or not you have enabled the firewall when installing linux, if you want to configure your own firewall, clear all the filter rules.
[Root @ tp ~] # Iptables-F clear the rules of all rule chains in the filter of the preset table
[Root @ tp ~] # Iptables-X clear the rules in the user-defined chain in the filter of the preset table
Let's take a look.
[Root @ tp ~] # Iptables-L-n
Chain INPUT (policy ACCEPT)
Target prot optsource destination
Chain FORWARD (policy ACCEPT)
Target prot optsource destination
Chain OUTPUT (policy ACCEPT)
Target prot optsource destination
Nothing, just like we didn't start the firewall when installing linux. (say in advance, these configurations are the same as configuring IP addresses with commands, so restarting them will lose effect.) how to save them.
[Root @ tp ~] #/Etc/rc. d/init. d/iptables save
[Root @ tp ~] # Service iptables restart
Now there are no configurations in the IPTABLES configuration table. let's get started with our configuration.
(3) set preset rules
[Root @ tp ~] # Iptables-P INPUT DROP
[Root @ tp ~] # Iptables-P OUTPUT ACCEPT
[Root @ tp ~] # Iptables-P FORWARD DROP
The above means that when two chain rules (INPUT and FORWARD) in the filter table in IPTABLES are exceeded, how can we process data packets not in these two rules, that is, DROP (discard ). it should be said that the configuration is safe. we want to control inbound data packets
For the OUTPUT chain, that is, the outgoing package, we do not need to impose too many restrictions, but adopt ACCEPT. that is to say, what should we do if the package is not in a rule.
We can see what packets are allowed to pass through the INPUT and FORWARD chains, and what packets are not allowed to pass through the OUTPUT chain.
This setting is quite reasonable. of course you can also DROP all three links, but I don't think it is necessary to do so, and the rules to be written will increase. but if you only want a limited number of rules, for example, only WEB servers. we recommend that all three links be DROP.
Note: If you log on remotely through SSH, you should drop it when you enter the first command and press enter because you have not set any rules.
What should I do? go to the local machine to operate it!
(4) add a rule.
First, add the INPUT chain. the default rule of the INPUT chain is DROP, so we will write the chain that requires ACCETP ().
To enable remote SSH login, we need to enable port 22.
[Root @ tp ~] # Iptables-a input-p tcp -- dport 22-j ACCEPT
[Root @ tp ~] # Iptables-a output-p tcp -- sport 22-j ACCEPT (note: If you set OUTPUT to DROP, write this rule, many people are eager to write this rule, and SSH is always unavailable. remotely, is it okay.
The same applies to other ports. if the WEB server is enabled and the OUTPUT is set to DROP, a chain should also be added:
[Root @ tp ~] # Iptables-a output-p tcp -- sport 80-j ACCEPT .)
If the WEB server is configured, enable port 80.
[Root @ tp ~] # Iptables-a input-p tcp -- dport 80-j ACCEPT
If the email server is configured, enable Port 25,110.
[Root @ tp ~] # Iptables-a input-p tcp -- dport 110-jACCEPT
[Root @ tp ~] # Iptables-a input-p tcp -- dport 25-j ACCEPT
If the FTP server is configured, enable port 21.
[Root @ tp ~] # Iptables-a input-p tcp -- dport 21-j ACCEPT
[Root @ tp ~] # Iptables-a input-p tcp -- dport 20-j ACCEPT
If the DNS server is configured, enable Port 53.
[Root @ tp ~] # Iptables-a input-p tcp -- dport 53-j ACCEPT
If you have another server, you just need to open the port and write it.
The above mainly writes the INPUT chain, and all the rules that are not in the above DROP
Allow icmp packets to pass, that is, allow ping,
[Root @ tp ~] # Iptables-a output-p icmp-j ACCEPT (if OUTPUT is set to DROP)
[Root @ tp ~] # Iptables-a input-p icmp-j ACCEPT (if INPUT is set to DROP)
Steps:
1. view the firewall status
Service iptables status
2. enable firewall and services
Service iptables start
Chkconfig -- level 345 iptables on
3. set iptables rules
[Root @ tp ~] # Iptables-L-n
Chain INPUT (policy ACCEPT)
Target prot optsource destination
Chain FORWARD (policy ACCEPT)
Target prot optsource destination
Chain OUTPUT (policy ACCEPT)
Target prot optsource destination
4. add rules
# Allow the local loopback interface (that is, running the local machine to access the local machine)
Iptables-a input-s 127.0.0.1-d 127.0.0.1-j ACCEPT
# Allow established or related connections