Getting started with iptables

Commands in iptables must be case sensitive.

The main syntax differences between ipchains and iptables are as follows:

1. In ipchains, for example, the input chain uses a lowercase name. In iptables, use uppercase input instead.

2. in iptables, you must specify the rule to be applied to that rule table (use-t to specify, such as-T Nat). If this parameter is not specified, the default value is used to filter the table.

3. In ipchains,-I refers to the interface, but in iptables,-I refers to the Inbound direction, and more-O represents the outbound direction.

4. In iptables, the source port should use the Keyword -- sport or -- source-port.

5. In iptables, the destination port uses the Keyword -- dport or -- destination-port.

6. In iptables, the disposal action of "discard" will no longer use the target deny, and use drop instead.

7. The ipchains record file function-L has been changed to the target-J log, and the title of the record file can be specified.

8. The flag-y in ipchains can be -- SYN or -- TCP-flag SYN, ack, Fin SYN in iptables.

9. In iptables, The imcp messages type should be added with the Keyword -- ICMP-type, such:

Iptables-A output-O eth0-p icmp-S $ fw_ip -- ICMP-type 8-D any/0-J accept

Iptables sample used

When setting iptables packet filtering rules, how many sample actions are there? ?? ? Why? Why ?? What is it? Why are there too many other users? Small? /P>

Observe the current settings

The procedure is as follows:

Iptables-l-N

Iptablse-T nat-l-N

Definition variable

Fw_ip = "163.26.197.8"

Enable the core forward Function

The procedure is as follows:

###-----------------------------------------------------###

# Enable the forward Function

###-----------------------------------------------------###

Echo "1">/proc/sys/NET/IPv4/ip_forward

Clear all rules

In the first step, you must clear all rules and start again to prevent the old rules from affecting the new settings. The procedure is as follows:

###-----------------------------------------------------###

# Clear previous settings

###-----------------------------------------------------###

# Clear all rules in the Rule chain in the filter of the preset table

Iptables-F

# Clear the rules in the User-Defined chain in the filter of the preset table

Iptables-x

# Clear all rules in the Rule chain in the mangle table

Iptables-F-T mangle

# Clear the rules in the Custom link in the mangle table

Iptables-T mangle-x

# Clear all rules in the Rule chain in the NAT table

Iptables-F-T Nat

# Clear the rules in the user-defined link in the NAT table

Iptables-T nat-x

Select preset policies

Next, we need to select different rule chains and the predefined policies. The procedure is as follows:

Default discard all:

###-----------------------------------------------------###

# Set the filter table preset Policy

###-----------------------------------------------------###

Iptables-P input drop

Iptables-P output drop

Iptables-P forward drop

Or accept all by default:

###-----------------------------------------------------###

# Set the filter table preset Policy

###-----------------------------------------------------###

Iptables-P input accept

Iptables-P output accept

Iptables-P forward accept

The preset policies of each rule chain can be set independently without being affected by other chains.

In the following example, if the target is drop, set policy to accept. If the target is accept, set policy to drop to see the effect.

Open an Interface

The procedure is as follows:

Iptables-A input-I lo-J accept

Iptables-A output-O lo-J accept

Note: The Packet Flow of ipfw or netfilter does not pass through the forward chain,

Therefore, lo serves only the input and output chains.

Iptables-A input-I eth1-J accept

Iptables-A output-O eth1-J accept

Iptables-a forward-I eth1-J accept

Iptables-a forward-O eth1-J accept

IP camouflage

After the packets in the internal network are disguised, the external eth0 Nic is used as the representative number for external connection. The procedure is as follows:

###-----------------------------------------------------###

# Start internal external Address Transfer

###-----------------------------------------------------###

Iptables-T Nat-A postrouting-O eth0-s 172.16.0.0/16-j snat -- to-source $ fw_ip

The preceding command indicates that the network segment 172.16.0.0/16 is disguised as $ fw_ip.

Virtual Host

By means of address and port forwarding, packets from the external network can be sent to the servo host in the internal network, which is also known as a virtual host. This method can protect most of the ports of the servo host from external access, and only open public service channels (such as Web server port 80), so the security is very high.

The procedure is as follows:

###-----------------------------------------------------###

# Start external address translation

###-----------------------------------------------------###

# Anyone connected to $ fw_ip: 80 will be directed to 172.16.255.2: 80

Iptables-T Nat-A prerouting-I eth0-P TCP-d $ fw_ip -- dport 80-J DNAT -- to-destination 172.16.255.2: 80

Enable the internal host to telnet to the external host

Open the internal network and telnet to the external host.

The procedure is as follows: (the Default policy is drop)

###-----------------------------------------------------###

# Open external host telnet port 23

###-----------------------------------------------------###

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 23-J accept

Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 23-d $ fw_ip -- dport 1024: 65535-J accept

Mail Transfer Channel

Open any mail host to send a packet to your mail server, and your mail server can also send the packet.

The procedure is as follows: (the Default policy is drop)

###-----------------------------------------------------###

# Open SMTP port 25

###-----------------------------------------------------###

# The following is a message that someone else can send to you:

Iptables-A input-I eth0-P TCP-s any/0 -- Sport 1024: 65535-d $ fw_ip -- dport 25-J accept

Iptables-A output-O eth0-p tcp! -- Syn-S $ fw_ip -- Sport 25-D any/0 -- dport 1024: 65535-J accept

# You can send emails to others.

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 25-J accept

Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 25-d $ fw_ip -- dport 1024: 65525-J accept

Open Channels for offline mailing downloads

An open internal network can receive emails from the POP3 server of an external network.

The procedure is as follows: (the Default policy is drop)

###-----------------------------------------------------###

# Open POP3 port 110 for external hosts

###-----------------------------------------------------###

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 110-J accept

Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 110-d $ fw_ip -- dport 1024: 65535-J accept

Open webpage viewing channel

Open the internal network to view the website of the external network.

The procedure is as follows: (the Default policy is drop)

###-----------------------------------------------------###

# Open http port 80 for external hosts

###-----------------------------------------------------###

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 80-J accept

Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 80-d $ fw_ip -- dport 1024: 65535-J accept

Enable DNS host query for external networks

Open the internal network to query any DNS host on the external network.

The procedure is as follows: (the Default policy is drop)

###-----------------------------------------------------###

# Open DNS port 53

###-----------------------------------------------------###

# UDP packets will be used for the first query

Iptables-A output-O eth0-p udp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 53-J accept

Iptables-A input-I eth0-P UDP-s any/0 -- Sport 53-d $ fw_ip -- dport 1024: 65535-J accept

# If an error occurs, TCP packets are used for query.

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 53-J accept

Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 53-d $ fw_ip -- dport 1024: 65535-J accept

# Enable interaction between DNS on this host and external DNS host: Use UDP

Iptables-A output-O eth0-p udp-S $ fw_ip -- Sport 53-D any/0 -- dport 53-J accept

Iptables-A input-I eth0-P UDP-s any/0 -- Sport 53-d $ fw_ip -- dport 53-J accept

# Enable interactive query between DNS on this host and external DNS host: use TCP

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 53-D any/0 -- dport 53-J accept

Iptables-A input-I eth0-P TCP! -Y-s any/0 -- Sport 53-d $ fw_ip -- dport 53-J accept

Open internal hosts to SSH to external hosts

Open the internal network and SSH can be used to connect to external hosts.

The procedure is as follows: (the Default policy is drop)

###-----------------------------------------------------###

# Open external host ssh port 22

###-----------------------------------------------------###

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 22-J accept

Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 22-d $ fw_ip -- dport 1024: 65535-J accept

# The following are differences between SSH protocols:

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1020:1023-D any/0 -- dport 22-J accept

Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 22-d $ fw_ip -- dport 1020:1023-J accept

Enable internal hosts to FTP to external hosts

Open the internal network and FTP to external hosts.

The procedure is as follows: (the Default policy is drop)

###-----------------------------------------------------###

# Open to external host FTP port 21

###-----------------------------------------------------###

# Open the command channel 21

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 21-J accept

Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 21-d $ fw_ip -- dport 1024: 65535-J accept

# Open Channel 20

Iptables-A input-I eth0-P TCP-s any/0 -- Sport 20-d $ fw_ip -- dport 1024: 65535-J accept

Iptables-A output-O eth0-p tcp! -- Syn-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 20-J accept

# Open the passive mode FTP data channel

Iptables-A output-O eth0-p tcp-S $ fw_ip -- Sport 1024: 65535-D any/0 -- dport 1024: 65535-J accept

Iptables-A input-I eth0-P TCP! -- Syn-s any/0 -- Sport 1024: 65535-d $ fw_ip -- dport 1024: 65535-J accept

Open Ping

You can ping any host externally.

The procedure is as follows: (the Default policy is drop)

Iptables-A output-O eth0-p icmp-S $ fw_ip -- ICMP-type 8-D any/0-J accept

Iptables-A input-I eth0-P ICM-s any/0 -- ICMP-type 0-d $ fw_ip-J accept