Introduction to the use of iptables on Red Flag Linux

Introduction to Iptables Use

　　
Iptables is a powerful network tool based on packet filtering, this article briefly introduces the use of iptables and how to use it to build a network firewall.

Iptables is composed of two subsystems, namely kernel module and user interface application, it can be compiled into the system kernel, can be compiled into the loading and unloading kernel module, then can choose to install some parts that can accomplish certain function, these parts implement IP address camouflage, port mapping, Packet filter and so on a series of functions.

　　
Install Iptables

Iptables Many components of the configuration, compilation is associated with the kernel configuration, compilation, some Linux distributions have been pre-installed iptables, such as Redhat,redflag. However, you may still need to install it yourself.

First you need a 2.4.X version of the kernel, which can be downloaded from the http://Kernel.org.

You will also need a iptables user space program, which can be downloaded from the NetFilter home page.

When you are ready to begin compiling the kernel, locate the network packet filtering subkey under Networking options, select network packet filtering replaces and configure it.

After booting with the new kernel, the Iptables user space program is compiled and the installer copies the executable file to the/usr/local/sbin directory.

If everything goes well, we've successfully installed the support for Iptables and NetFilter in the kernel.

The service can be started by the user iptables start.

　　
Tables and Chains

Here we discuss how the packets are passed between the iptables and the tables.

For example, a packet sent from an external host to this computer requires the following channels to be received by the application:

1. Packets are passed from the network and received by the NIC

2. The prerouting chain is then transferred to the Mangle table.

3. And then into the pretouting chain of the NAT table, this chain is mainly used to do dnat, that is, destination address forwarding.