Netfilter/iptables firewall framework analysis

1. install and start the Netfilter/iptables system. because Netfilter/iptables's netfilter component is integrated with kernel 2.4.x, later versions of Linux are equipped with the netfilter kernel tool, so generally do not need to download, but just download and install iptables User space tool source code package: http://www.netfilt 1. install and start Netfilter/IptablesSystem
Because Netfilter/iptables's netfilter component is integrated with kernel 2.4.x, later versions of Linux are equipped with the netfilter kernel tool. Therefore, you do not need to download it, download and install the source code package of the iptables User space tool: http://www.netfilter.org/projects/iptables/downloads.html. Currently, the latest source code installation package is: iptables-1.4.10.tar.bz2.
Before you start to install the iptables User space tool, you must modify the configuration of the system as follows:
CONFIG_PACKET: This option is useful if you want applications and programs to directly use certain network devices.
CONFIG_IP_NF_MATCH_STATE: If you want to configure a stateful firewall, this option is very important and useful. Such firewalls will remember the previous decisions on information packet filtering and make new decisions based on them.
CONFIG_IP_NF_FILTER: This option provides a basic information packet filtering framework. If this option is enabled, a basic filter table (with built-in INPUT, FORWARD, and OUTPUT chains) is added to the kernel space.
CONFIG_IP_NF_TARGET_REJECT: This option allows you to specify that an ICMP error message should be sent to respond to dropped inbound information packets, rather than simply killing these information packets.
Install the source code package:
// Decompress the source code file
# Bzip2-d iptables-1.4.10-tar.bz2
# Tar-xvf iptables 1.4.10.tar
// Switch the Directory
# Cd iptables 1.4.10
// Compile the tool to specify the compiled kernel directory as/usr/src/linux-2.6.4-8
# Make KERNEL_DIR =/usr/src/linux-2.4.16-8
// Execute the make install command, also set the kernel directory to/usr/src/linux-2.6.4-8
# Make installKERNEL_DIR =/usr/src/after the linux-2.6.4-8 is installed, you can start the firewall:
// Use the service command to start the instance manually
# Service iptablesstart if you want to enable the firewall service when the system starts, you can run the setup command, enter the Systemservice option, and select the iptables daemon.

　　 2. simple application of Iptables
1) Basic rule application
Below are some simple examples of using the above framework theory to form a rule, for the reader to imitate and use in the actual application process:
(1) accept all inbound data packets from the specified IP address:
# Iptables-a input-s 203.159.0.10-jACCEPT (2) only accept data packets from the specified port (service:
# Iptables-d input -- dport 80-jDROP (3) allow forwarding of all data packets to the local smtp server (198.168.10.13:
# Iptables-a forward-p tcp-d 198.168.10.13 -- dport smtp-ieth0-j ACCEPT (4) allow forwarding of all local udp packets (such as packets generated by software such as instant messaging):
# Iptables-a forward-p udp-d 198.168.80.0/24-I eth0-jACCEPT (5) reject request packets sent to the WWW Server client:
# Iptables-a forward-p tcp-d 198.168.80.11 -- dport www-ieth0-j REJECT (6) allow tcp data packets destined for the specified port to enter:
# Iptables-a input-p tcp-m multiport -- destination-port21, 25,110, ACCEPT (7) allow tcp packets from the source for the specified port to enter:
# Iptables-a input-p tcp-m multiport -- source-port21, 53,80, 25,110 ACCEPT (8) drops the SYN and ACK flag location packet:
# Iptables-a input-p tcp -- tcp-flags all syn, ACKDROP2) fragment detection and traffic control
(1) Check IP fragmentation: In TCP/IP networks, the link layer has the maximum transmission unit MTU, which limits the maximum length of data frames. different network types have an upper limit. The MTU over Ethernet is 1500. If there are packets to be transmitted at the IP layer, and the packet length exceeds MTU, the IP layer must perform fragmentation on the packet so that the length of each piece is smaller than or equal to MTU, these segments become IP fragments. If the firewall does not specifically handle IP fragments, some IP fragments may be intercepted by the firewall, affecting the receiver's restoration of these fragments, finally, it affects information integrity and availability. Therefore, the following example shows the rules for the firewall to allow IP fragmentation:
# Iptables-a forward-p tcp-f-s 172.1696.0/24-d1721397.18-jACCEPT pay special attention to the-f option in the above rules, it specifies that the second and later IP fragments will be handled by the firewall. Otherwise, the firewall may block the second and later IP fragments based on the following rules, thus affecting normal information circulation:
# Iptables-a forward-p tcp-s 172.1696.0/24-d1731697.18-jACCEPT (2) speed limit: iptables provides A sound speed control mechanism, it is mainly used to limit the number of data packets passed in an external unit of time. a direct advantage of this is to suppress the denial-of-service attacks or distributed denial-of-service attacks mentioned many times, A typical manifestation of these two types of attacks is that many packets are routed to the destination in a unit of time. Therefore, we can use the following rules to limit the number of packets allowed to enter the protected network through the firewall per unit time:
# Iptables-a input-m limit -- limit 200/second
# Iptables-a input-m limit -- limit10000/minute the preceding two rules respectively limit the number of packets passed within 1 second and 1 minute to no more than 200 and 10000. Of course, in actual application, you can also set the time interval such as/second,/minute,/hour, and/day, the specific values, such as 200 and 10000, must be set based on actual conditions and experience. unspecified values can be followed.
In addition, after setting the rate limit, you can also set some processing events triggered by exceeding this limit, such as directly dropping. The following rule indicates that when the speed exceeds the 200 limit, subsequent packets will be discarded directly:
# Iptables-a input-m limit -- limit-burst 200