Detailed explanation of Iptables commands in Linux

Different tables can be defined. each table contains several internal chains and user-defined chains. Each chain is a rule list that matches the corresponding package: each rule refers

Use iptables-ADC to specify the chain rules.-A Add-D delete-C modify

Iptables-[RI] chain rule num rule-specification [option]
Use iptables-RI to specify the sequence of rules

Iptables-D chain rule num [option]
Deletes a specified rule.

Iptables-[LFZ] [chain] [option]
Use iptables-LFZ chain name [option]

Iptables-[NX] chain
Use-NX to specify a chain

Iptables-P chain target [options]
Default target of the specified chain

Iptables-E old-chain-name new-chain-name
-E old chain name new chain name

Replace old chain names with new chain names

Description

Iptalbes is used to set, maintain, and check the IP packet filtering rules of the Linux kernel.

Different tables can be defined. each table contains several internal chains and user-defined chains. Each chain is a rule list that matches the corresponding package: each rule specifies how the matching package should be processed. This is called a 'target' (target) and can also jump to a user-defined chain in the same table.

TARGETS

The firewall rules specify the features and targets of the checked packets. If the package does not match, it is sent to the next rule check in the chain. If yes, the next rule is determined by the target value. the target value can be a user-defined chain name or a specific value, such as ACCEPT [pass], DROP [delete], QUEUE [QUEUE], or RETURN [RETURN].

ACCEPT indicates that the package passes. DROP indicates dropping this package. QUEUE indicates to pass this package to the user space. RETURN indicates that the matching of the chain is stopped and the rule of the previous chain starts again. If a built-in chain is reached, or the rule of the built-in chain is RETURN, the fate of the package will be determined by the target specified by the chain criterion.

TABLES

There are currently three tables (which table is the current table depends on the kernel configuration option and the current module ).

-T table

This option specifies the table of matching packages to be operated by the command. If the kernel is configured to automatically load modules, if the modules are not loaded, the system will try to load the appropriate modules (for this table. These tables are as follows: filter, which is the default table and contains the built-in chain INPUT (the packet to be processed) and FORWORD (the packet to be processed) and OUTPUT (processing locally generated packages ). Nat. when this table is queried, it indicates that a new connection packet is generated, which consists of three built-in chains: PREROUTING), OUTPUT (the local package before the route is modified), and POSTROUTING (the package to be modified ). The mangle table is used to modify the specified package. It has two built-in rules: PREROUTING (the package before the route is modified) and OUTPUT (the local package before the route is modified ).

OPTIONS

These options that can be recognized by iptables can be different types.

COMMANDS

These options specify to execute a specific action: If there is no other rule under the command line, this row can only specify one option. for long-format commands and option names, you only need to ensure that the iptables command can be distinguished from other options.

-A-append

Add one or more rules at the end of the selected chain. When the source (address) or/and destination (address) are converted to multiple addresses, this rule is added to all possible addresses (combinations.

-D-delete

Delete one or more rules from the selected chain. This command can be used to specify the deleted rule as the serial number in the chain (the first serial number is 1) or as the rule to be matched.

-R-replace

Replaces a rule from the selected chain. If the source (address) or/and destination (address) are converted to multiple addresses, this command fails. The rule sequence number starts from 1.

-I-insert

Insert one or more rules to the selected chain based on the given rule sequence number. Therefore, if the rule number is 1, the rule will be inserted into the chain header. This is the default method when no rule serial number is specified.

-L-list

Displays all the rules of the selected chain. If no link is selected, all links are displayed. It can also be used with the z option, and the chain will be automatically listed and zeroed. Precise output is affected by other parameters.

-F-flush

Clear the selected chain. This means that all rules are deleted one by one.

-- Z-zero

Clears the packets and byte counters of all links. It can be used with-L to view the counter before clearing. See the previous article.

-N-new-chain

Create a new user-defined chain based on the given name. This must ensure that no chain with the same name exists.

-X-delete-chain

Deletes a specified user-defined chain. This chain must not be referenced. if it is referenced, you must delete or replace the relevant rules before deleting it. If no parameter is provided, this command will try to delete each non-built chain.

-P-policy

Set the target rule of the chain.

-E-rename-chain

Rename the specified chain based on the name given by the user. this is only a modifier and does not affect the structure of the entire table. The TARGETS parameter provides a valid target. Rules can be used only for non-user-defined chains, and both built-in and user-defined chains cannot be the target of rules.

-H Help.

Help. The syntax of the current command is very short.

PARAMETERS [PARAMETERS]

The following parameters constitute detailed rules, such as the add, delete, replace, append, and check commands.

-P-protocal [!] Protocol

Protocol for rule or package check (package to be checked. The specified protocol can be either one or all of tcp, udp, or icmp, or a numerical value, representing one of these protocols. You can also use the protocol name defined in/etc/protocols. Add "! "Indicates the opposite rule. The number 0 is equivalent to all. Protocol all matches all protocols, and this is a time-saving option. When combined with the check command, all can be disabled.

-S-source [!] Address [/mask]

Specifies the source address, which can be the host name, network name, and clear IP address. The mask can be a network mask or a clear number. specify the number of "1" on the left of the network mask. Therefore, the value of the mask is 24 or 255.255.255.0. Add "! "Indicates that the opposite address segment is specified. Flag -- src is short for this option.

-D -- destination [!] Address [/mask]

Specify the target address. For more information, see the description of the-s flag. The flag-dst is short for this option.

-J -- jump target

-J target jump

Specify the target of the rule, that is, what to do if the package matches. The target can be a user-defined chain (not where this rule is located), a private built-in target that will immediately determine the fate of the package, or an extension (see EXTENSIONS below ). If the rule option is ignored, the matching process will not affect the package, but the rule counter will increase.

-I-in-interface [!] [Name]

I-access (network) interface [!] [Name]

This is the optional entry name received by the package through this interface, and the package is received through this interface (the package entered in the chain INPUT, FORWORD, and PREROUTING ). Before the interface name, use "! "After description, it refers to the opposite name. If the interface name is followed by "+", all interfaces starting with this interface name will be matched. If this option is ignored, it is assumed to be "+", then any interface will be matched.

-O -- out-interface [!] [Name]

-O -- output interface [name]

This is the optional exit name sent by the package through this interface, and the package is OUTPUT through this port (the package sent in the chain FORWARD, OUTPUT, and POSTROUTING ). Before the interface name, use "! "After description, it refers to the opposite name. If the interface name is followed by "+", all interfaces starting with this interface name will be matched. If this option is ignored, it is assumed as "+", then all arbitrary interfaces will be matched.

[!] -F, -- fragment

[!] -F -- multipart

This means that in the fragmented package, the rule only asks for the second and later parts. Since then, because the source port or target port (or ICMP type) of the packet cannot be determined, such packets cannot match any rules specified for matching them. If "! "The description is used before the"-f "sign to indicate the opposite.

OTHER OPTIONS

Other options

You can also specify the following additional options:

-V -- verbose

-V -- details

Detailed output. This option allows the list command to display the interface address, rule option (if any), and TOS (Type of Service) mask. The package and byte counters will also be displayed. K, M, and G (prefix) are used to indicate 1000, 1,000,000, and 1,000,000,000 times respectively (but refer to the-x flag to change it). for addition, insert, delete, and replace commands. This prints detailed information about one or more rules.

-N -- numeric

-N -- number

Digital output. The IP address and port are printed in numbers. By default, the program displays the host name, network name, or service (as long as it is available ).

-X-exact

-X-precision

Extended number. Display the exact value of the package and byte counter, instead of the approximate number expressed in K, M, G. This option can only be used for the-L command.

-- Line-numbers

When a rule is displayed in the list, add a row number before each rule to match the rule's position in the chain.

Match extensions [corresponding extension]

Iptables can use some extension packages that match the module. The following are the extension packages included in the basic package, and most of them can be added in front! To indicate the opposite.

Tcp

When -- protocol tcp is specified and other matching extensions are not specified, these extensions are loaded. It provides the following options:

-- Source-port [!] [Port [: port]

Specifies the source port or port range. This can be the service name or port number. Format Port: you can specify the port range. If the first port number is ignored, the default value is "0". if the end port number is ignored, the default value is "65535". if the second port number is greater than the first port number, it is switched. You can use the -- sport alias for this option.

-- Destionation-port [!] [Port: [port]

Specify the target port or port range. This option can be replaced by the -- dport alias.

-- Tcp-flags [!] Mask comp

Matches the specified TCP tag. The first parameter is the tag we want to check, a list separated by commas, and the second parameter is a tag table separated by commas, which must be set. Mark as follows: syn ack fin rst urg psh all none. Therefore, this command: iptables-a forward-p tcp -- tcp-flags SYN, ACK, FIN, rst syn only matches the packets whose SYN flag is set but the ACK, FIN, and RST tags are not set.

[!] -- Syn

Only TCP packets whose SYN bit is set and ACK and FIN bit are cleared. These packages are used to send requests during TCP connection initialization. for example, a large number of such packages will block the TCP connection when an interface is blocked, and the outgoing TCP connection will not be affected. This is equal to -- tcp-flags SYN, RST, and ack syn. If "-- syn" is preceded "! "Mark, indicating the opposite.

-- Tcp-option [!] Number

Match the TCP option.

Udp

When protocol udp is specified and other matching extensions are not specified, these extensions are loaded and provide the following options:

-- Source-port [!] [Port: [port]

Specifies the source port or port range. For details, see the description of the TCP extended -- source-port option.

-- Destination-port [!] [Port: [port]

Specify the target port or port range. For details, see the -- destination-port option of TCP extension.

Icmp

When protocol icmp is specified and other matching extensions are not specified, the extension is loaded. It provides the following options:

-- Icmp-type [!] Typename

This option allows you to specify the ICMP type, which can be a numeric ICMP type, or an icmp type name displayed by the command iptables-p ICMP-h.

Mac

-- Mac-source [!] Address

Match the physical address. The format must be XX: XX. Note that it is only valid for packets from the Ethernet device that enter the PREROUTING, FORWORD, and INPUT chains.

Limit

This module matching flag matches with a tag bucket filter at a certain speed. it is used with LOG targets to provide a limited number of logins. when the limit value is reached, the rules that use this extension package will match. (unless "! "Mark)

-- Limit rate

Maximum Average matching rate: the value can be assigned to units such as '/second','/minute ','/hour', or '/Day'. the default value is 3/hour.

-- Limit-burst number

Maximum initial number of packages to be matched: if the limit specified earlier has not reached this value, the total number is increased by 1. the default value is 5.

Multiport

This module matches a group of source or target ports. you can specify up to 15 ports. It can only be used with-p tcp or-p udp.

-- Source-port [port [, port]

If the source port is one of the given ports

-- Destination-port [port [, port]

If the target Port is one of the given ports, it matches

-- Port [port [, port]

If the source port and destination port are the same and are the same as a given port, they match.

Mark

This module matches the netfilter tag Field (you can set MARK as below ).

-- Mark value [/mask]

Match those unsigned tag values (if the mask is specified, a logical tag is added to the mask before comparison ).

Owner

This module generates a local package to match different features of the package creator. It can only be used for OUTPUT chains, and even some packets (such as ICMP ping responses) may not have owners, so they will never match.

-- Uid-owner userid

If a valid user id is provided, it matches the package generated by the process.

-- Gid-owner groupid

If a valid group id is provided, it matches the package generated by the process.

-- Sid-owner seessionid

Match the packets generated by the process according to the given session group.

State

This module allows the connection trace status of the access package when used in conjunction with the connection trace.

-- State

The state is a comma-separated list of matched connection statuses. The possible status is: INVALID indicates that the package is an unknown connection, ESTABLISHED indicates a two-way transmission connection, and NEW indicates that the package is a NEW connection. Otherwise, the package is not transmitted in two directions, RELATED indicates that the package starts from a new connection, but is connected with an existing connection, such as FTP data transmission or an ICMP error.

Unclean

This module has no options, but it tries to match those strange and uncommon packages. In the lab.

Tos

This module matches the eight-bit tos (service type) field (that is, included in the priority) of the IP package header ).

-- Tos

This parameter can be a standard name (view the list with iptables-m tos-h) or a value.

TARGET EXTENSIONS

Iptables can be used to expand the target module: The following are included in the standard edition.

LOG

Enable the kernel record for the matching package. After this option is set in the rule, the Linux kernel prints some information about all matching packages (such as the IP header field) through printk ).

-- Log-level

Record level (numeric or see syslog. conf (5 )).

-- Log-prefix

Add a specific prefix before the record information: a maximum of 14 letters are used to distinguish it from other information in the record.

-- Log-tcp-sequence

Record the TCP serial number. If records can be read by users, this poses a security risk.

-- Log-tcp-options

Record the options from the TCP header.

-- Log-ip-options

Record the options from the IP packet header.

MARK

Set the netfilter flag value of the package. Only applicable to mangle tables.

-- Set-mark

REJECT

As a response to the matched package, an error package is returned: the package is the same as the DROP in other cases.

This target applies only to INPUT, FORWARD, and OUTPUT chains, and user-defined chains that call these chains. These options control the returned error package features:

-- Reject-with type

The Type can be icmp-net-unreachable, icmp-host-unreachable, icmp-port-nreachable, icmp-proto-unreachable, icmp-net-prohibited, or icmp-host-prohibited, this type will return the corresponding ICMP error message (default: port-unreachable ). The echo-reply option is also allowed. it can only be used to generate a ping response in the rule that specifies the ICMP ping packet. Finally, the tcp-reset option can be used in the INPUT chain or in the rules called by the self-INPUT chain. only the TCP protocol is matched: a tcp rst packet will be returned.

TOS

Set the first eight-bit tos of the IP package. It can only be used for mangle tables.

-- Set-tos

You can use a numeric TOS value or iptables-j TOS-h to view the list of valid TOS names.

MIRROR

This is a test demonstration target. it can be used to convert the source address and target address in the IP address header field, and then transfer the package. it is only applicable to INPUT, FORWARD, and OUTPUT chains, and user-defined chains that only call them.

SNAT

This target only applies to the POSTROUTING chain of the nat table. It specifies to modify the source address of the package (all packages will be affected after this connection) and stop checking the rule. It includes the following options:

-- To-source [- ] [: Port-port]

You can specify a single new IP address, a range of IP addresses, or a port range (only in rules specifying-p tcp or-p udp ). If no port range is specified, ports lower than 512 in the source port will be placed as other ports lower than 512; ports between 512 and 1024 will be placed below 1024, other ports are placed as 1024 or above. If possible, the port is not modified.

-- To-destiontion [- ] [: Port-port]

You can specify a single new IP address, a range of IP addresses, or a port range (only in rules specifying-p tcp or-p udp ). If no port range is specified, the target port is not modified.

MASQUERADE

Only used for the POSTROUTING chain of the nat table. It can only be used to dynamically obtain IP (dial-up) connections: If you have a static IP address, you must use SNAT. Disguise is equivalent to setting an image for the IP address of the interface through which the packet is sent. when the interface is closed, the connection will be terminated. This is because the current dial-up may not be the same interface address (all established connections will be closed later ). It has an option:

-- To-ports [-Port>]

Specify the source port range to be used, and overwrite the default SNAT source address selection (see the above ). This option applies only to rules with-p tcp or-p udp specified.

REDIRECT

Only applicable to the PREROUTING and OUTPUT chains of nat tables, and user-defined chains that only call them. It modifies the target IP address of the package to send the package to the machine itself (the locally generated package is placed at 127.0.0.1 ). It contains an option:

-- To-ports [ ]

Specified destination port or port range: If this parameter is not specified, the target port is not modified. Only rules with-p tcp or-p udp can be specified.

DIAGNOSTICS

Diagnosis

Different error messages are printed as standard errors: exit code 0 to indicate correct. If the command line parameter is incorrect or the command line parameter is abused, error code 2 is returned, and other error codes are returned as 1.

BUGS

Bugs

Check is not implemented (yet ).

Check is not completed yet.

COMPATIBILITY WITH IPCHAINS

Compatibility with ipchains

Iptables is very similar to Rusty Russell's ipchains. The main difference is that the INPUT chain is only used to enter the package of the local host, and the OUTPUT is only used to generate the package from the local host. Therefore, each packet passes through only one of the three chains. the previously forwarded packet passes through all three chains. The other major difference is that-I references the incoming interface;-o references the output interface, both of which are applicable to the packets that enter the FORWARD chain. When the default filter table is used with the optional extension module, iptables is a pure package filter. This can greatly reduce the previous obfuscation of IP camouflage and packet filtering, so the following options are different:

-J MASQ

-M-S

-M-L

There are several different links in iptables.