Sharing iptables firewall rules

Some specific application of iptables ICMP related applications so that you can not ping 127.0.0.1iptables-AINPUT-s127.0.0.1-picmp-jDROP192.168.0.0/24 network segment can not ping the local iptables-AINPUT-s192.168.0.0/24-picmp-jDROP prohibit all machines # iptabl some IptablesSpecific application
ICMP-related applications
Make yourself unable to ping 127.0.0.1

Iptables-a input-s 127.0.0.1-p icmp-j DROP
The IP address range of 192.168.0.0/24 cannot be pinged to the local machine.

Iptables-a input-s 192.168.0.0/24-p icmp-j DROP

Disable all machines
# Iptables-a input-s 0/0-p icmp-j DROP

# ICMP (PING) accept! Echo-request

/Sbin/iptables-a input-p icmp? Icmp-type! Echo-request-jACCEPT

Accept_redirects

# Echo "0">/proc/sys/net/ipv4/conf/all/accept_redirects

Or

# Sysctl net. ipv4.conf. all. accept_redirects = "0 ″

Prohibit IP access to yourself
[Root @ linux root] # iptables-a input-s 192.168.0.253-j DROP

Blocking MSN
/Sbin/iptables-I FORWARD-d gateway.messenger.hotmail.com-jDROP

/Sbin/iptables-I FORWARD-p tcp? Dport 1863-j DROP

Block QQ
/Sbin/iptables-a forward-p tcp-d tcpconn.tencent.com? Dport 80-j DROP

/Sbin/iptables-a forward-p tcp-d tcpconn.tencent.com? Dport443-j DROP

/Sbin/iptables-a forward-p tcp-d tcpconn2.tencent.com-jDROP

/Sbin/iptables-a forward-I eth0-p udp? Dport 8000-j DROP

Blocking BT
/Sbin/iptables-a forward-I eth0-p tcp? Dport 6881: 6890-jDROP

WWW
# Prohibit> WWW

/Sbin/iptables-a forward-p tcp? Dport 80-j DROP

# Open> WWW

/Sbin/iptables-a forward-p tcp? Dport 80-j ACCEPT

FTP
# Disable FTP

/Sbin/iptables-a forward-I eth0-p tcp? Dport 20-j DROP

/Sbin/iptables-a forward-I eth0-p tcp? Dport 21-j DROP

# Open FTP

/Sbin/iptables-a forward-I eth0-p tcp? Dport 20-j ACCEPT

/Sbin/iptables-a forward-I eth0-p tcp? Dport 21-j ACCEPT

SMTP, POP3
# Disable SMTP and POP3

/Sbin/iptables-a forward-I eth0-p tcp? Dport 25-j DROP

/Sbin/iptables-a forward-I eth0-p tcp? Dport 110-j DROP

# Enable SMTP and POP3

/Sbin/iptables-a forward-I eth0-p tcp? Dport 25-j ACCEPT

/Sbin/iptables-a forward-I eth0-p tcp? Dport 110-jACCEPT

Samba
# Disable Samba

[Root @ linux root] # iptables-a forward-p tcp? Sport 137: 139-jDROP

[Root @ linux root] # iptables-a forward-p udp? Sport 137: 139-jDROP

DROP
# DROP OTHERS

/Sbin/iptables-a forward-I eth0-m state? StateESTABLISHED, RELATED-j ACCEPT

/Sbin/iptables-a forward-s 192.168.1.0/24-j DROP

Use the iptables-L-n command to view the rules of the current firewall. The result is similar to the following: (policyACCEPT) refers to the preset policy.
Chain INPUT (policy ACCEPT)
Target prot opt source destination
ACCEPT all-0.0.0.0/0 0.0.0.0/0

Chain FORWARD (policy ACCEPT)
Target prot opt source destination

Chain OUTPUT (policy ACCEPT)
Target prot opt source destination

Syntax for iptables policy definition:
Iptables [-t tables] [-P] [INPUT, OUTPUT, FORWARD | PREROUTEING, OUTPUT, POSTROUTING] [ACCEPT, DROP]
-P defines the Policy
Used for parameters in the fliter table
Information Package of the INPUT request host
OUTPUT host information package
Information Packet forwarded by FORWARD

Parameters used for nat tables
Processing before PREROUTING routing
OUTPUT host information package
Post-processing of POSTROUTING routes
Iptables:
Iptables [-t table] [-L] [-n]
-T is followed by the iptables table. the default value is-t filter.
-L rules for listing the current table
-N does not convert the IP address and hostname.

Syntax of iptables clearing rules:
Iptables [-t table] [-FXZ]
-F clear all rules;
-X: Kill the chain created by all users.
-Z: clears the count and traffic statistics of all links.

Syntax for adding and defining rules in iptables:
Iptables [-t table] [-ai input, OUTPUT, FORWARD] [-s IP/network]-j [ACCEPT, DROP]

-A: add A rule to the end.
-I: insert a rule, which is first by default.
-S: IP address or CIDR block of the source data packet
-J: action to be executed (drop, accept, log)

Iptables deletion rule syntax:
Iptables-d input 2, indicating to delete the second rule in the INPUT chain