Linuxiptables9 practical settings

The iptables command can be used to configure Linux packet filtering rules. it is often used to implement firewall and NAT. The configuration of iptables is complex. after mastering the rules, it is not difficult to use iptables to complete the specified task. next we will learn the detailed usage of iptables through specific instances. 1. delete an existing rule. when you set a new iptables rule, make sure that the old rule is IptablesThe command can be used to configure Linux packet filtering rules. it is often used to implement firewall and NAT. First glance IptablesThe configuration of iptables is very complicated. it is not difficult to use iptables to complete the specified task after mastering the rule. next we will learn the detailed usage of iptables through specific instances.

1. delete an existing rule
When you set a new iptables rule, make sure that the old rule is cleared. run the following command to clear the old rule:
Iptables-F
(Or iptables -- flush)

2. set the chain policy
For the filter table, the default chain policy is ACCEPT. we can use the following command to modify the chain policy:
Iptables-P INPUT DROP
Iptables-P FORWARD DROP
Iptables-P OUTPUT DROP
The preceding command configuration discards the received, forwarded, and sent packets, and implements strict packet management. Because both the receiving and sending packets are discarded, when configuring other rules, you must configure the INPUT and OUTPUT rules separately. Of course, if you trust this machine to send packets out, you do not need to configure the third rule.

3. Shield the specified ip address
Sometimes we find that an ip address keeps sending packets to the server. in this case, we can use the following command to discard packets sent from a specified ip address:
BLOCK_THIS_IP = "x. x"
Iptables-a input-I eth0-p tcp-s "$ BLOCK_THIS_IP"-j DROP
The preceding command is used to discard the tcp packet sent from x. x ip to the eth0 port.

4. configure service items
Using iptables, we can perform security management on the service items that are commonly used. for example, we can only set the network segment to be specified and connect to the local machine through SSH through the specified network port:
Iptables-a input-I eth0-p tcp-s 192.168.100.0/-- dport-m state -- state NEW, ESTABLESHED-j ACCEPT
Iptables-a output-o eth0-p tcp -- sport-m state -- state ESTABLISHED-j ACCEPT
To connect a local machine to another machine through SSH, you need to set the following rules because the connection is established on the local Port:
Iptables-a input-I eth0-p tcp-s 192.168.100.0/-- dport-m state -- state ESTABLESHED-j ACCEPT
Iptables-a output-o eth0-p tcp -- sport-m state -- state NEW, ESTABLISHED-j ACCEPT
Similarly, for tcp connection-based services such as HTTP/HTTPS (80/443), pop3 (110), rsync (873), and MySQL (3306), you can also configure the preceding command.
Run the following command to enable the udp-based dns service:
Iptables-a output-p udp-o eth0 -- dport-j ACCEPT
Iptables-a input-p udp-I eth0 -- sport-j ACCEPT

5. configure network port forwarding
For a server used as a firewall or gateway, a network port is connected to the public network, and packets from other network ports are forwarded to this network port for intranet communication. assume that eth0 is connected to the intranet and eth1 is connected to the public network. the configuration rules are as follows:
Iptables-a forward-I eth0-o eth1-j ACCEPT

6. configure port forwarding
For ports, we can also use iptables to configure forwarding:
Iptables-t nat-a prerouting-p tcp-d 192.168.102.37 -- dport-j DNAT -- to 192.168.102.37:
The above command forwards the packet from Port 422 to port 22, so SSH connection can be performed through Port 422. of course, for Port 422, we also need. configure the rules that support connection establishment in the same way as in the "configure service Items" section.
7. DoS attack prevention
With the extension module limit, we can also configure iptables rules to prevent DoS attacks:
Iptables-a input-p-tcp -- dport-m limit -- limit/minute -- limit-burst-j ACCEPT
-- Litmit 25/minute indicates that the maximum number of connections per minute is 25
-- Litmit-burst 100 indicates that litmit/minute is enabled when the total number of connections exceeds 100.

8. configure web traffic balancing
We can use a server as a front-end server to distribute traffic using iptables. the configuration method is as follows:
Iptables-a prerouting-I eth0-p tcp -- dport-m state -- state NEW-m nth -- counter -- every -- packet-j DNAT -- to-destination 192.168.1.101:
Iptables-a prerouting-I eth0-p tcp -- dport-m state -- state NEW-m nth -- counter -- every -- packet-j DNAT -- to-destination 192.168.1.102:
Iptables-a prerouting-I eth0-p tcp -- dport-m state -- state NEW-m nth -- counter -- every -- packet-j DNAT -- to-destination 192.168.1.103:
The above configuration rules use the nth extension module to balance the traffic on port 80 to three servers.

9. log the discarded packets
Using the LOG target and syslog service, we can record the packets sent and received under a certain port of a protocol. For example, you can use the following method to record packet loss.
First, define a chain:
Next, import all received packets to the LOGGING chain:
Iptables-a input-j LOGGING
Set the log prefix and log level:
Iptables-a logging-m limit -- limit/min-j LOG -- log-prefix "IPTables Packet Dropped:" -- log-level
Finally, the package is dropped to discard the package:
Iptables-a logging-j DROP
You can also configure the syslog. conf file to specify the log output of iptables.

Have fun!