Getting started with iptables

Last Update:2018-12-05 Source: Internet

Author: User

Tags ssh port

Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

This section describes iptables concepts and usage.

Commands in iptables must be case sensitive.

The main syntax differences between ipchains and iptables are as follows:
1. In ipchains, for example, the input chain uses a lowercase name. In iptables, use uppercase input instead.
2. in iptables, you must specify the rule to be applied to that rule table (use-t to specify, such as-T Nat). If this parameter is not specified, the default value is used to filter the table.
3. In ipchains,-I refers to the interface, but in iptables,-I refers to the Inbound direction, and more-O represents the outbound direction.
4. In iptables, the source port should use the Keyword -- sport or -- source-port.
5. In iptables, the destination port uses the Keyword -- dport or -- destination-port.
6. In iptables, the disposal action of "discard" will no longer use the target deny, and use drop instead.
7. The ipchains record file function-L has been changed to the target-J log, and the title of the record file can be specified.
8.-y in ipchains can be used in iptables -- SYN or -- TCP-flag SYN, ack, Fin SYN
9. In iptables, add the Keyword -- ICMP-type to the imcp messages type, for example:

Iptables-A output-O eth0-p icmp-S $ fw_ip -- ICMP-type 8-D any/0-J accept

Iptables example
When setting iptables packet filtering rules, there are several examples. If you are familiar with them first, you can apply them on your own. So you can quickly enter the world.

######################################## ######

##--------##
Preparations
##--------##

First, check the settings of iptables on the machine.
The procedure is as follows:

Iptables-l-N
Iptablse-T nat-l-N

Define the IP address of the variable referenced in the following example
$ Fw_ip = "163.26.197.8"

To enable the core forward function, follow these steps:

###-----------------------------------------------------###
# Enable the forward Function
###-----------------------------------------------------###

Echo "1">/proc/sys/NET/IPv4/ip_forward
Or add
Forward_ipv4 = Yes
Enable forwarding

To clear all rules, follow these steps ::

In the first step, you must clear all rules and start again to prevent the old rules from affecting the new settings. The procedure is as follows:

###-----------------------------------------------------###
# Clear previous settings
###-----------------------------------------------------###

# Clear all rules in the Rule chain in the filter of the preset table
Iptables-F

# Clear the rules in the User-Defined chain in the filter of the preset table
Iptables-x

# Clear all rules in the Rule chain in the mangle table
Iptables-F-T mangle

# Clear the rules in the Custom link in the mangle table
Iptables-T mangle-x

# Clear all rules in the Rule chain in the NAT table
Iptables-F-T Nat

# Clear the rules in the user-defined link in the NAT table
Iptables-T nat-x

######################################## ###########

Select a preset Policy
Next, you need to select different rule chains and the predefined policies. The procedure is as follows:

Default discard all:

###-----------------------------------------------------###
# Set the filter table preset Policy
###-----------------------------------------------------###
Iptables-P input drop
Iptables-P output drop
Iptables-P forward drop

Or accept all by default:

###-----------------------------------------------------###
# Set the filter table preset Policy
###-----------------------------------------------------###
Iptables-P input accept
Iptables-P output accept
Iptables-P forward accept

** The preset policies of each rule chain can be set independently without being affected by other chains. **

In the following example, if the target is drop (discard), set policy to accept (accept). If the target is accept, set policy to drop to see the effect.

Open an Interface
The procedure is as follows:

Iptables-A input-I lo-J accept
Iptables-A output-O lo-J accept

Note: The Packet Flow of ipfw or netfilter does not pass through the forward chain,
Therefore, lo serves only the input and output chains.

Iptables-A input-I eth1-J accept
Iptables-A output-O eth1-J accept
Iptables-a forward-I eth1-J accept
Iptables-a forward-O eth1-J accept

IP camouflage (SNAT Application)
After the packets in the Intranet are disguised, the external eth0 Nic is used as the proxy number for external connections. The procedure is as follows:

###-----------------------------------------------------###
# Start internal external Address Transfer
###-----------------------------------------------------###

Iptables-T Nat-A postrouting-O eth0-s 172.16.0.0/16-j snat -- to-source $ fw_ip

The preceding command indicates that the network segment 172.16.0.0/16 is disguised as $ fw_ip.

Virtual Host (DNAT Application)
Internet packets can be sent to server hosts in the Intranet by means of address and port forwarding, which is commonly known as virtual hosts. This method protects most of the ports on the server host from being exported.

Only open public service channels (such as Web server port 80), so the security is high.

The procedure is as follows:

###-----------------------------------------------------###
# Start external address translation
###-----------------------------------------------------###
# Anyone connected to $ fw_ip: 80 will be directed to 172.16.255.2: 80
Iptables-T Nat-A prerouting-I eth0-P TCP-d $ fw_ip -- dport 80-J DNAT -- to-destination 172.16.255.2: 80

Enable the internal host to telnet to the external host
Open the Intranet and telnet to the external host.