Getting started with iptables

Commands in iptables must be case sensitive.
The main syntax differences between ipchains and iptables are as follows:
1. In ipchains, for example, the input chain uses a lowercase name. In iptables, use uppercase input instead.
2. in iptables, you must specify the rule to be applied to that rule table (use-t to specify, such as-T Nat). If this parameter is not specified, the default value is used to filter the table.
3. In ipchains,-I refers to the interface, but in iptables,-I refers to the Inbound direction, and more-O represents the outbound direction.
4. In iptables, the source port should use the Keyword -- sport or -- source-port.
5. In iptables, the destination port uses the Keyword -- dport or -- destination-port.
6. In iptables, the disposal action of "discard" will no longer use the target deny, and use drop instead.
7. The ipchains record file function-L has been changed to the target-J log, and the title of the record file can be specified.
8. The flag-y in ipchains can be -- SYN or -- TCP-flag SYN, ack, Fin SYN in iptables.
9. In iptables, The imcp messages type should be added with the Keyword -- ICMP-type, such:
Iptables-A output-O eth0-p icmp-S $ fw_ip -- ICMP-type 8-D any/0-J accept
Iptables sample used
When setting iptables packet filtering rules, there are several sample actions, if you are familiar with pregnancy and pregnancy, then you will be tired and tired? /P>
Observe the current settings
The procedure is as follows:
Iptables-l-N
Iptablse-T nat-l-N
Definition variable
Fw_ip = "163.26.197.8"
Enable the core forward Function
The procedure is as follows:
###-----------------------------------------------------###
# Enable the forward Function
###-----------------------------------------------------###
Echo "1">/proc/sys/NET/IPv4/ip_forward
Clear all rules
In the first step, you must clear all rules and start again to prevent the old rules from affecting the new settings. The procedure is as follows:
###-----------------------------------------------------###
# Clear previous settings
###-----------------------------------------------------###
# Clear all rules in the Rule chain in the filter of the preset table
Iptables-F
# Clear the rules in the User-Defined chain in the filter of the preset table
Iptables-x
# Clear all rules in the Rule chain in the mangle table
Iptables-F-T mangle
# Clear the rules in the Custom link in the mangle table
Iptables-T mangle-x
# Clear all rules in the Rule chain in the NAT table
Iptables-F-T Nat
# Clear the rules in the user-defined link in the NAT table
Iptables-T nat-x
Select preset policies
Next, we need to select different rule chains and the predefined policies. The procedure is as follows:
Default discard all:
###-----------------------------------------------------###
# Set the filter table preset Policy
###-----------------------------------------------------###
Iptables-P input drop
Iptables-P output drop
Iptables-P forward drop
Or accept all by default:
###-----------------------------------------------------###
# Set the filter table preset Policy
###-----------------------------------------------------###
Iptables-P input accept
Iptables-P output accept
Iptables-P forward accept
The preset policies of each rule chain can be set independently without being affected by other chains.
In the following example, if the target is drop, set policy to accept. If the target is accept, set policy to drop to see the effect.
Open an Interface
The procedure is as follows:
Iptables-A input-I lo-J accept
Iptables-A output-O lo-J accept
Note: The Packet Flow of ipfw or netfilter does not pass through the forward chain,
Therefore, lo serves only the input and output chains.
Iptables-A input-I eth1-J accept
Iptables-A output-O eth1-J accept
Iptables-a forward-I eth1-J accept
Iptables-a forward-O eth1-J accept
IP camouflage
After the packets in the internal network are disguised, the external eth0 Nic is used as the representative number for external connection. The procedure is as follows:
###-----------------------------------------------------###
# Start internal external Address Transfer
###-----------------------------------------------------###
Iptables-T Nat-A postrouting-O eth0-s 172.16.0.0/16-j snat -- to-source $ fw_ip
The preceding command indicates that the network segment 172.16.0.0/16 is disguised as $ fw_ip.
Virtual Host
By means of address and port forwarding, packets from the external network can be sent to the servo host in the internal network, which is also known as a virtual host. This method can protect most of the ports of the servo host from external access, and only open public service channels (such as Web server port 80), so the security is very high.
The procedure is as follows:
###-----------------------------------------------------###
# Start external address translation
###-----------------------------------------------------###
# Anyone connected to $ fw_ip: 80 will be directed to 172.16.255.2: 80
Iptables-T Nat-A prerouting-I eth0-P TCP-d $ fw_ip -- dport 80-J DNAT -- to-destination 172.16.255.2: 80
Enable the internal host to telnet to the external host
Open the internal network and telnet to the external host.
The procedure is as follows: (the Default policy is drop)
###-----------------------------------------------------###
# Open external host telnet port 23
###-----------------------------------------------------###
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 23-J accept
Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 23-d $ fw_ip -- dport 1024: 65535-J accept
Mail Transfer Channel
Open any mail host to send a packet to your mail server, and your mail server can also send the packet.
The procedure is as follows: (the Default policy is drop)
###-----------------------------------------------------###
# Open SMTP port 25
###-----------------------------------------------------###
# The following is a message that someone else can send to you:
Iptables-A input-I eth0-P TCP-s any/0 -- Sport 1024: 65535-d $ fw_ip -- dport 25-J accept
Iptables-A output-O eth0-p tcp! -- Syn-S $ fw_ip -- Sport 25-D any/0 -- dport 1024: 65535-J accept
# You can send emails to others.
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 25-J accept
Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 25-d $ fw_ip -- dport 1024: 65525-J accept
Open Channels for offline mailing downloads
An open internal network can receive emails from the POP3 server of an external network.
The procedure is as follows: (the Default policy is drop)
###-----------------------------------------------------###
# Open POP3 port 110 for external hosts
###-----------------------------------------------------###
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 110-J accept
Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 110-d $ fw_ip -- dport 1024: 65535-J accept
Open webpage viewing channel
Open the internal network to view the website of the external network.
The procedure is as follows: (the Default policy is drop)
###-----------------------------------------------------###
# Open http port 80 for external hosts
###-----------------------------------------------------###
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 80-J accept
Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 80-d $ fw_ip -- dport 1024: 65535-J accept
Enable DNS host query for external networks
Open the internal network to query any DNS host on the external network.
The procedure is as follows: (the Default policy is drop)
###-----------------------------------------------------###
# Open DNS port 53
###-----------------------------------------------------###
# UDP packets will be used for the first query
Iptables-A output-O eth0-p udp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 53-J accept
Iptables-A input-I eth0-P UDP-s any/0 -- Sport 53-d $ fw_ip -- dport 1024: 65535-J accept
# If an error occurs, TCP packets are used for query.
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 53-J accept
Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 53-d $ fw_ip -- dport 1024: 65535-J accept
# Enable interaction between DNS on this host and external DNS host: Use UDP
Iptables-A output-O eth0-p udp-S $ fw_ip -- Sport 53-D any/0 -- dport 53-J accept
Iptables-A input-I eth0-P UDP-s any/0 -- Sport 53-d $ fw_ip -- dport 53-J accept
# Enable interactive query between DNS on this host and external DNS host: use TCP
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 53-D any/0 -- dport 53-J accept
Iptables-A input-I eth0-P TCP! -Y-s any/0 -- Sport 53-d $ fw_ip -- dport 53-J accept
Open internal hosts to SSH to external hosts
Open the internal network and SSH can be used to connect to external hosts.
The procedure is as follows: (the Default policy is drop)
###-----------------------------------------------------###
# Open external host ssh port 22
###-----------------------------------------------------###
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 22-J accept
Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 22-d $ fw_ip -- dport 1024: 65535-J accept
# The following are differences between SSH protocols:
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1020:1023-D any/0 -- dport 22-J accept
Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 22-d $ fw_ip -- dport 1020:1023-J accept
Enable internal hosts to FTP to external hosts
Open the internal network and FTP to external hosts.
The procedure is as follows: (the Default policy is drop)
###-----------------------------------------------------###
# Open to external host FTP port 21
###-----------------------------------------------------###
# Open the command channel 21
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 21-J accept
Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 21-d $ fw_ip -- dport 1024: 65535-J accept
# Open Channel 20
Iptables-A input-I eth0-P TCP-s any/0 -- Sport 20-d $ fw_ip -- dport 1024: 65535-J accept
Iptables-A output-O eth0-p tcp! -- Syn-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 20-J accept
# Open the passive mode FTP data channel
Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 1024: 65535-J accept
Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 1024: 65535-d $ fw_ip -- dport 1024: 65535-J accept
Open Ping
You can ping any host externally.
The procedure is as follows: (the Default policy is drop)
Iptables-A output-O eth0-p icmp-S $ fw_ip -- ICMP-type 8-D any/0-J accept
Iptables-A input-I eth0-P ICM-s any/0 -- ICMP-type 0-d $ fw_ip-J accept

More exciting Linux video tutorial, all in 51cto School: http://edu.51cto.com/course/courseList/id-48.htmliptables entry