Iptables firewall, iptables

Iptables firewall, iptables
1 Location

Use vim/usr/sysconfig/iptables

2. Start, close, and save

• Service iptables stop
• Service iptables start
• Service iptables restart
• Service iptables save

3 Structure

Iptables-> tables-> chains-> rules

3.1 iptables tables and links

Iptables has four built-in tables: Filter, NAT, Mangle, and Raw.

3.1.1 Filter table

Filter indicates the default table of iptables. It has three built-in links:

• Input chain-external data processed
• Output chain-process data sent out

• Forward chain-forward data to other NICs on the local machine

3.1.2 NAT table

NAT has three built-in links:

• Prerouting-to process the data packet that has just arrived at the local machine and is forwarded before the route, it will convert the destination ip address (destination ip address) in the data packet, usually used for DNAT (destination NAT ).
• Postrouting-to process the packet that is about to exit the local machine, it will convert the source ip address (source ip address) in the packet, usually SNAT (source NAT)
• Output-process data packets generated by the Local Machine

3.1.3 Mangle table

The Mangle table is used to specify how data packets are processed. It can change the Qos bit in the TCP Header. the Mangle table has five built-in links.

• Prerouting
• Output
• Forward
• Input
• Postrouting

3.1.4 Raw table

Raw table user exception handling, which has two built-in chains

• Prerouting chain
• Output chain

3.2 Iptables Rules (Rules)

• Rules includes a condition and a target)
• If conditions are met, the rule or specific value in the target will be executed.
• If the condition is not met, the next Rules is determined.

3.2.1 target value

• Accept-allow the firewall to receive packets
• Drop-firewall drops data packets
• Queue-firewall transfers data packets to user space
• Return-the Firewall stops executing the subsequent rules in the current chain and returns to the call chain (the calling chain)

4 command

# Iptables-t filter-L view the filter table

# Iptables-t nat-L view the nat table

# Iptables-t mangel-L view the mangel table

# Iptables-t raw-L view Raw table

For example, the following example shows that there are rules in the input chain, forward chain, and output chain of the filter table:

# iptables --listChain INPUT (policy ACCEPT)num  target     prot opt source               destination1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0Chain FORWARD (policy ACCEPT)num  target     prot opt source               destination1    RH-Firewall-1-INPUT  all  --  0.0.0.0/0            0.0.0.0/0Chain OUTPUT (policy ACCEPT)num  target     prot opt source               destinationChain RH-Firewall-1-INPUT (2 references)num  target     prot opt source               destination1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/02    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 2553    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/04    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/05    ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:53536    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:6317    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:6318    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:2210   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Field description

Num: No.

Target: target

Prot: Protocol

Source: the source IP address of the data packet.

Destination: the destination address of the data packet.

4.1 clear all rules

# Iptables-flush

4.2 APPEND Command

The iptables-A command appends the new rule, where-A indicates append. Generally, the last rule is used to discard all data packets and add the new rule using the-A parameter, which is useless.

4.2.1 syntax

Iptables-A chain firewall-rule

• -A chain specifies the chain of rules to be appended
• Parameters of firewall-rule rules

4.2.2 Basic parameters

The protocol used to describe the data packet, the source address, the destination address, the network interface that is allowed, and how to process these data packets.

• Protocol-p (protocol)
  For example, tcp, udp, and icmp, you can use all to specify all protocols.
  The-p parameter is not specified. The default value is all,
  You can use the Protocol name (tcp, udp) or Protocol value (6 stands for tcp). You can view the/etc/protocols ing relationship.
• Source Address-s (source)
  Specifies the source address of the data packet. The parameter can use the IP address, network address, and host name. If the-s parameter is not specified, it indicates all the addresses.
  Example:-s 192.168.1.101 specific IP Address
  For example,-s 192.168.1.10/24 specifies the network address
  
• Destination Address-d (destination)
  Specify the destination address. The parameter is the same as-s.
• Execution target-j (jump to target)
  -J indicates how to process data packets when matching Rules (Rule). The possible values are accept, drop, queue, and return. You can also specify other chains as the target.
• Input interface-I (input interface)
  Specifies the interface from which data packets are to be processed. These data packets enter the input, forward, and prepoute chains.
  For example,-I eth0 specifies the data to be processed in eth0.
  Can be reversed! -I eth0, other than eth0.
  Yes.-I eth + indicates the name starting with eth.
• Output interface-o (out interface)
  The interface output of the data packet, similar to-I
• Source Port-sport
  For example,-sport 22
  For example,-sport specifies the port range
• Destination Port-dport
  Similar to-sport
• TCP flag
• ICMP Type

5. instance analysis

For example, to receive data packets whose destination port is 22

Iptables-a input-I etho-p tcp-dprot 22-j ACCEPT

For example, deny all other data packets.

Iptables-a input-j DROP

6. Modify the Default policy

In the above example, only the received data packets are filtered, but there are no restrictions on the data packets to be sent.

Use iptables-L

# iptables -LChain INPUT (policy ACCEPT)target     prot opt source               destinationACCEPT     tcp  --  anywhere             anywhere            tcp dpt:sshDROP       all  --  anywhere             anywhere            Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination