Iptables usage details

I. I cannot understand netfilter/iptable at the beginning, but I do not understand netfilter clearly. Netfilter is integrated in the kernel to define and store various rules. Iptalbe is a tool for modifying these rules, which is included in netfilter. When the data packet enters the LINUX server, it first enters the server's netfilter module. I. netfilter/iptable

I couldn't understand this at the beginning, mainly because I didn't understand netfilter clearly. Netfilter is integrated in the kernel to define and store various rules. Iptalbe is a tool for modifying these rules, which is included in netfilter. When the data packet enters the LINUX server, it first enters the server's netfilter module for judgment and processing.
Netfilter contains three types of tables. The three types of tables contain five types of chains. the chain contains various rules. A table contains several chains and several rules.

(1) filter nat mangle
1. filter: processes local data packets. it is a default table and contains three links: input outputforward.
2. nat table: it is not related to the local machine. It mainly processes conversion between source and destination IP addresses and ports. There are three links: prerouting postrouting output
3. mangle table: used for advanced routing information packages, such as changes in the packet header (such as changes to the service type of the package in tos, ttl, and mark ). There are two types of links: prerouting output (kernel 2.4.18, followed by two links: input forward.

(2) five types of chains (the chain is under the table and can be further explained only for clarity)
1. prerouting: Rules executed before the packets entering netfilter enter the route judgment. Change the package.
2. Input: Rules to be executed by data packets on the local machine after the route is determined.
3. output: Rules for executing data packets that need to be sent out from the local machine.
4. forward: Rules executed by data packets whose destination is not local after the route is determined. It is highly associated with the nat and mangle tables and is not associated with the local machine.
5. postrouting: after determining the route, it is sent to the interface of the NIC. That is, the rule executed when the packet is ready to leave netfilter.

Running Daemon refers to the local machine. All Input packages are sent to the local machine. The local machine is processed and then output.

(3) figure after the data packet enters netfilter:
1. the data packet enters the linux server's inbound interface, and the interface sends the data packet to netfilter. the data packet enters netfilter.
2. processed by prerouting (such as whether to change the source IP address of the data packet)
3. data packets are routed to the route table to determine the destination of the data packets. If the destination is a local machine, the data packet is transferred to intput for processing and then enters the local machine. If the destination is not the local machine, the data packet is forwarded to forward for processing.
4. after the data packet is processed by forward, it is forwarded to postrouting (whether the target address needs to be changed or not). after the data packet is processed, netfilter is generated and the interface is output to the linux server, the linux server is released.
5. if a data packet needs to be sent to the local machine after it is processed, or the local machine has its own data packet needs to be sent out, the data packet will be sent to the output chain for processing and transferred to postrouting for processing, linux server. Enter the external world.

(4) rule execution sequence
When the data packet enters the netfilter, it will be compared with the rules in. Rules are ordered.
First, compare with rule 1. if it matches rule 1 and is accepted by Rule 1, the data will not be compared with the subsequent rules. If they do not match, the rules are compared in order until they are accepted. If none of the Rules match, the default policy operation is performed to determine the destination of the data packet. Therefore, the order of rules is very important.
IPTABLE is mainly used to understand the above content. for detailed parameters, see the guide in the attachment.

II. iptalbe syntax and parameters
Iptable [-t table] command [chain] [match] [-j target]
Note: iptable [-t table name]-Command [link] [match] [-j action/target]

(1) table)
1. filter table: all commands are executed using the filter table by default. Only data packets related to the local machine are operated.
2. nat table: used for NAT address translation. Only when the first packet of the data stream is matched by this chain, the subsequent packages will automatically perform the same processing.
It can be divided into: DNAT (target address conversion), SNAT (source address conversion), and MASQUERADE
(1) the DNAT operation is mainly used in such a case that you have a valid IP address and want to redirect access to the firewall to another host (such as DMZ ). That is to say, we changed the destination address so that the packet can be rerouted to a host.
(2) SNAT changes the source address of the package, which can greatly hide your local network or DMZ. Ing between the intranet and the Internet.
(3) the role of MASQUERADE is exactly the same as that of SNAT, but the computer load is a little more. For each matching packet, MASQUERADE needs to find available IP addresses, unlike the IP addresses used by SNAT. Of course, this also has the advantage that we can use addresses obtained through dialing such as PPP, PPPOE, and SLIP. These addresses are randomly allocated by the ISP's DHCP.
3. mangle table: used to change the advanced features of data packets.

(2) command details 
1.-A or -- append // add one or more rules to the end of the chain.
2.-D or -- delete // delete the rule from the chain
3.-R or -- replace // replace a rule from the selected chain
4.-L or -- list // display all the chain rules
5.-I or -- inset // Insert rules into the chain based on the given rule sequence number. Insert the chain in sequence. if it is "1", insert the chain first.
6.-X or -- delete-chain // is used to delete rules in a custom chain. You must ensure that all the rules in the chain are not in use before you can delete the chain. If no chain is specified, all rules in the custom chain will be deleted.
7.-F or -- flush // clear all rules in the selected chain. If the chain name is specified, all rules of the corresponding chain are deleted. If no chain name is specified, all rules of all chains are deleted.
8.-N or -- new-chain // use the name specified in the command to create a new chain.
9.-P or -- policy // set the default target of the chain, that is, the policy. Information packages that do not match any rules in the chain will force the policy specified in this command.
10.-Z or -- zero // clears the packet byte counters of all rules in the specified chain.

(3) match

It can be divided into four categories: general match, implicit match, display match, and abnormal package match.
1. general match
No matter what protocol we use and what extensions we mount, generic matching can be used. No prerequisites

(1)-p (lower case) or -- protocol
Used to check certain protocols. Three protocols are available: TCP, UDP, and ICMP. Use commas to separate any combination of the three protocols. "!" Is also available Number, indicating the remaining protocols except the protocol. You can also use all to indicate all protocols. The default value is all, but only tcp \ udp \ icmp.
$ Iptable-a input-p TCP, UDP
$ Iptable-a input-p! ICMP // The two parameters mean the same.

(2)-s or -- source
Match the package with the Ip source address. Determine whether to allow or deny data packets through the filter based on the source address range. You can use "!" Symbol. All IP addresses are matched by default.
However, you can specify a CIDR block for a single IP address. For example, 192.168.1.1/255.255.255.255 indicates an address. 192.168.1.0/255.255.255.0 indicates a network segment.

(3)-d or -- destination
Match the destination IP addresses. Same as source format usage

(4)-I
Match the package with the network interface used by the package to enter the local device. Only the INPUT \ FORWARD \ PREROUTING chain can be used. Errors may occur when used in any other chain.
You can use "+" "!" Two symbols.
Only one "+" sign is used to match all packages. For example, iptable-a input-I ++ // table matches all packages.
Put it behind a certain type of interface, indicating that all these interfaces match. For example, iptable-AINPUT-I eth + // indicates that all ethernet interfaces are matched.

(5)-o
Package the local network interface to match the package. Same as-I.
Only three links, OUTPUT \ FORWARD \ POSTROUTING, can be used. Errors may occur when used in any other chain.
You can use "+" "!" Two symbols.

(6)-f (or -- fragment)
Used to match the second or later parts of a fragmented package. Because a data packet is divided into multiple slices, only the first packet carries the source or target address. None of them are followed, so we can only use this to match. Prevents fragment attacks.

2. implicit matching
This matching is implicit and automatically loaded into the kernel. For example, we can use -- protocol tcp to automatically match the characteristics related to TCP packets.
Implicit match of three different protocols: tcp udp icmp

2.1 tcp match
Tcp match can only implicitly match the details of TCP packets or streams. However,-p tcp must be used as the precondition.

(2.1.1) TCP -- sport
The source port matching package based on the tcp package. if this option is not specified, it indicates all ports.
Iptable-a input-p TCP -- sport 22: 80 // all ports in the range of TCP source port 22 to 80.
Iptable-a input-p TCP -- sport 22: // All ports between Port 22 and Port 65535 of TCP source.

(2.1.2) TCP -- dport
Match the packet based on the destination port of the tcp packet. Same as -- sport port usage.

(2.1.3) TCP -- flags
Matches the specified TCP tag.
Iptable-p TCP -- tcp-flags SYN, FIN, ACK SYN

2.2 UDP match
(2.1.1) UDP -- sport
SOURCE Port matching package based on UDP packets. if this option is not specified, all ports are used.

(2.1.1) UDP -- dport
The destination port matching package based on UDP packets. if this option is not specified, all ports are used.

2.3 icmp match
Icmp -- icmp-type
Match an ICMP packet. You can specify the type in decimal format or related names. different types have different ICMP values. You can also use "!" .
For example, iptable-a input-picmp-imcp-type 8

3. display matching
-M is required for matching.

(1) limitmatch 
-M limit must be used to specify. You can limit the number of matching times of a specified rule. That is, when a rule matches a certain number of times, it does not match any more. That is, limit the number of matching packages. This prevents DOS attacks.
Restriction method: sets the maximum number of times a rule is matched. Set a limit value. When the limit value is reached, the matching will be stopped. However, there is a rule that after the limit is exceeded, the number of matches will be increased at intervals. However, the maximum number of idle matches cannot exceed the limit.
-- Limit rate
Maximum Average matching rate: the value can be assigned to units such as '/second','/minute ','/hour', or '/Day'. the default value is 3/hour.
-- Limit-burstnumber
Maximum initial number of packages to be matched: if the limit specified earlier has not reached this value, the total number is increased by 1. the default value is 5.
Iptable-a input-m limit -- limt3/hour // you can specify the maximum average matching rate. That is, the number of matched packets per unit time. -- Limt specifies the interval for a pass.
Iptable-a input-m limit -- limit-burst5 // you can configure up to five packets to match when you issue 5 passes at the beginning.

(2) mac match
Only the MAC source address can be matched. Package-based MAC source address matching package
Iptable-a input-m mac -- mac-source 00: 00: eb: 1c: 24 // the source address matches some MAC addresses.

(3) mark match
Match the packet with the MARK set by the packet. This value is set by mark target.

(4) multiport match
This module matches a group of source or target ports. you can specify up to 15 ports. It can only be used with-p tcp or-p udp.
 
The multi-port matching extension allows us to specify multiple discontinuous ports in a rule. Without this extension, we can only write rules by Port. This is only an enhanced version of standard port matching. Standard port matching and multi-port matching cannot be used simultaneously in a rule.
Three options: -- source-port; -- destination-port; -- port
Iptable-AINPUT-p TCP-m multiport -- source-port22, 28,115
Iptable-AINPUT-p TCP-m multiport -- destination-port 115
Iptable-AINPUT-p TCP-m multiport -- port22, 28,115

(5) state match
The status matching extension should be assisted by the connection tracking code in the kernel. This is because the packet status is obtained from the connection tracing mechanism. In this way, you cannot understand the status.

(6) tos match
Matches packages based on the TOS field to control the priority.

(7) ttl match
Match the package according to the TTL field in the IP header.
It is used to change the TTL of the package. some ISPs determine whether multiple machines share the internet connection based on the TTL.
Iptables-T mangle-a prerouting-I eth0-j TTL -- ttl-set 64
Iptables-t mangle-a prerouting-I eth0-j TTL -- ttl-dec 1
# TTL is actually-2 when you leave the firewall, because the firewall itself needs to-1.
Iptables-t mangle-a prerouting-I eth0-j TTL -- ttl-inc 1
# Tracert won't work if you leave the firewall without increasing or decreasing.

(8) owner match
The package is matched based on the ID of the package generator (that is, the owner or owner.
The owner can be the user ID of the starting process, the user's level ID, the process ID, or the session ID. This can only be used in OUTPUT.
This module is used to generate local packages to match different features of the package creator. And even some packages (such as ICMP ping responses) may not have owners, so they will never match.
-- Uid-owner userid
If a valid user id is provided, it matches the package generated by the process.
-- Gid-owner groupid
If a valid group id is provided, it matches the package generated by the process.
-- Sid-owner seessionid
Match the packets generated by the process according to the given session group.


(4) targets/jump
The action specified by the rule to perform on the information package that matches the rule.

1. accept
This parameter has no options. Specify-j accept.
Once a match is met, other rules defined in the table or chain are no longer matched. However, it may also match rules in other tables and links. That is to say, after matching in the same table, it is up till now and will not continue.

2. drop
-J drop: This packet is discarded when the information package exactly matches the rule. Do not process it. And no information is returned to the sender. No information is returned to the vro.

3. reject
In the same way as drop, an error message is sent to the sender after the packet is discarded.
Iptables-a forward-p TCP -- dport 22-j REJECT -- reject-with icmp-net-unreachable

4. DNAT
Used on the prerouting chain.
The destination network address is converted. Is to rewrite the IP address of the target.
If a package matches, all packages that belong to the same stream will be automatically converted. Then it can be routed to the correct host and network.
That is, the external address ING of the firewall. Maps external addresses to internal addresses.
Iptables-t nat-a prerouting-d218.104.235.238-p TCP -- dport 110,125-jDNAT -- to-destination 192.168.9.1
// Forward all packets destined for Port 218.104.235.238 to 192.168.9.1.
-- To-destination // rewrite the destination

5. SNAT
Used in the postrouting linked list of the nat table. This is the opposite of DNAT. Is used for source address conversion. That is, rewrite the source IP address. It is often used for conversion from an intranet to an external network.
-- To-source
Iptables-t nat POSTROUTING-o eth0-p tcp-j SNAT -- to-source 218.107.248.127 // all data packets sent from the eth0 interface rewrite the source address to 218.107.248.127
********************
Iptables-t nat-a prerouting-p tcp-d 15.45.23.67 -- dport 80-j DNAT -- to-destination 192.168.1.9
# Send all the data accessing Port 15.45.23.67: 80 as DNAT to 192.168.1.9: 80
If machines on the same intranet as 192.168.1.9 need to access 15.45.23.67, the firewall also needs to set the source IP address to firewall intranet IP 192.168.1.1. Otherwise, the packets are directly sent to the intranet machine, and the other party will discard the packets.
Iptables-t nat-a postrouting-p tcp -- dst15.45.23.67 -- dport 80-j SNAT -- to-source 192.168.1.1
# Change the source IP address of all data packets accessing Port 15.45.23.67: 80 to 192.168.1.1
If the firewall also needs to access 15.45.23.67: 80, add it to the OUTPUT chain because the packets sent by the firewall do not pass through PREROUTING.
Iptables-t nat-a output -- dst 15.45.23.67 -- dport 80-j DNAT -- to-destination 192.168.1.9
********************

6. MASQUERADE
The role of masquerade is the same as that of SNAT. The difference is that he does not need to specify a fixed converted IP address. It is designed to dynamically obtain IP addresses.
MASQUERADE is used to automatically obtain the current IP address from the server's NIC for NAT.
For example, if you access the Internet through ADSL at home, the IP address of the Internet is not fixed. you cannot set the IP address after NAT translation. In this case, we need to use masquerade for dynamic acquisition.
Iptables-t nat-a postrouting-s 192.168.1.0/24-jmasquerade // rewrite the IP address of the network segment 192.168.1.0 to A dynamic external IP address.

7. REDIRECT
It can only be used in the prerouting output chain of the NAT table
Forward packets or flow to another port within the sub-host where the firewall is located. For example, we can REDIRECT all packets destined for HTTP to HTTPproxy (for example, squid). of course, this happens within our own host.
-- To-ports
Iptables-t nat-a prerouting-p tcp -- dport 80-j REDIRECT -- to-ports 8080
If this option is not used, the destination port will not be changed.
Specify a port, for example, -- to-ports 8080.
Specify the port range, for example, -- to-ports 8080-8090.

8. RETURN
As the name suggests, it causes the package to return to the previous layer. the sequence is: Sub-chain --> parent chain --> default policy. Specifically, if the packet encounters RETURN in the sub-chain, the next rule of the parent chain is returned to continue the condition comparison. if it is in the parent chain (or the main chain, such as INPUT) if RETURN is encountered, it will be operated by the default policy (generally ACCEPT or DROP. (Note: This is very similar to the function return value in C)

9. MIRROR
The source and destination addresses in the IP header are reversed before forwarding.

10. LOG
Logs can be viewed only in the kernel space, such as dmesg.

11. ULOG
Logs are recorded in the user space.

(5) IP forwarding
Enable the forwarding IP address function (IP forwarding ):
Echo "1">/proc/sys/net/ipv4/ip_forward
If you use dynamic IP addresses such as PPP and DHCP, you must enable the following:
Echo "1">/proc/sys/net/ipv4/ip_dynaddr
Label: none