Iptables simple rule formulation

In the previous blog, I explained some common knowledge about iptable. here I will repeat the linux firewall with two parts, they are netfilte in the kernel space and iptables in the user space, while iptable can define four types of rules: filter: nat where the firewall core is located: Address Translation mangle: implement packet modification; for example, TTLraw: not commonly used.

The previous blog article illustrates some common knowledge about iptable.
Here, I will repeat it briefly.

The linux firewall consists of two parts: netfilte in the kernel space and user space.Iptables

Iptable can define four types of rules.
Filter: the core of the firewall
Nat: address translation
Mangle: implements packet modification, such as TTL.
Raw: not commonly used. I will not explain it here.
Priority: raw-mangle-nat-filter

The rules defined in iptable must be transmitted to the netfilte in the kernel to take effect.
Firewall rules can be defined in two modes. One is strict. only data packets that are allowed to pass are allowed, and all other data packets are blocked. There is also a loose way to block packets that are not allowed to pass. In enterprise applications, the first type is generally used to allow corresponding data packets according to business needs.

The general mechanism of Iptable rule definition (for more detailed syntax, refer to the man document)
Iptable [-t table] sub_command CHAIN [num] [cretiria] [-j ACCTION]

-T:
Filter is not specified by default. you can also specify mangle, nat, raw

Sub_command:
Rule:
-A (append): append
-I (insert): insert, such as-I INPUT 3-D (delete): delete, specify the standard or num such as-D OUTPUT 8-R (replace ): replace-r forward 6

Chain:
-F (flush): clears the chain
-N (new): Adds a chain.
-X: deletes a custom empty chain.
-Z: clears the counter.
About counters: each rule has two counters. 1: record the number of packages matched by this rule.
2: record the sum of packages matching the rule
-E: rename a chain

Policy:
-P chain {ACCEPT | DROP} exsample:
Change the default policy of the INPUT chain to DROP
Iptables-t filter-P INTPUT DROP

View:
-L display the defined rules
-N: With this option, the host name of the IP address will not be reverse resolved to speed up viewing.
-V: detailed information. you can add a few more values. the more details, the more-x: precisely displays the data packet volume-line-numbers

Matching Condition:
General match:
-S IP/NETWORK: source address
-D IP/NETWORK: target address
-P {tcp | udp | icmp}: specifies the protocol.
-I input interface: specifies the interface for data packets to enter-o output interface: specifies the interface for data packets to go out.

Example:
Disable host 192.168.1.0/24 CIDR block ping192.168.2.1
Iptables-t fliter-a intup-s 192.168.1.0/24-d 192.168.2.1-picmp-j DROP

Extended matching
Implicit extension: refers to the extension of the protocol specified in the-p option.
-P {tcp | udp | icmp} -- sportportnum source port
-- Dportportnum target Port
-- Tcpflags indicates the tcp flag
-- The packet type of icmp-typeicmp.

Expand the exapmle
Iptables-t fliter-a intup-s 192.168.1.0/24-d 192.168.2.1-picmp? Icmp-type 8-j DROP
Here, the icmp-request packet for the 192.168.1.0/24 network segment is explicitly rejected. 8 is the icmp-request packet, and 0 is the icmp-echo Packet.

Example:
The host 192.168.2.1 is denied access to the web service of the local machine.
Iptables-t fliter-a input-s 192.168.2.1-p -- dport 80-j DROPiptables-t fliter-a input-s 192.168.2.1-p -- dport 443-jDROP

The rules can be written in multiple ways or in the OUTPUT chain, but the efficiency is not as high as INPUT. if the rules are written in the OUTPUT chain, write iptables-t fliter-a output-d 192.168.2.1-p? Sport 80-j DROPiptables-t fliter-a output-d 192.168.2.1-p? Sport 443-jDROP

The specific writing method depends on the requirement and the trend of data packets.

Explicit extension: Use-m to specify the extension to be loaded (details in the next chapter)

-J TARGET: The following are common links to jump:
ACCEPT
DROP
REJECT