Iptables - Revision history

Christoph at 21:16, 19 December 2018

2018-12-19T21:16:15Z

Christoph: /* Stateful filtering */

2016-09-14T19:51:14Z

‎Stateful filtering

Christoph: /* Stateful filtering */

2016-09-14T19:47:00Z

‎Stateful filtering

Christoph: /* Stateful filtering */

2016-09-14T19:31:50Z

‎Stateful filtering

Christoph: /* See also */

2016-07-21T21:00:19Z

‎See also

Christoph: /* Tips */

2014-07-18T21:49:28Z

‎Tips

Christoph: /* Basic command options */

2014-05-07T17:52:15Z

‎Basic command options

Christoph at 17:45, 7 May 2014

2014-05-07T17:45:43Z

Christoph at 15:11, 7 May 2014

2014-05-07T15:11:22Z

Christoph: /* Tips */

2009-05-14T20:23:21Z

‎Tips

← Older revision		Revision as of 21:16, 19 December 2018
Line 1:		Line 1:
		+	'''iptables''' is a user-space utility program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different Netfilter modules) and the chains and rules it stores. Different kernel modules and programs are currently used for different protocols; iptables applies to IPv4, ip6tables to IPv6, arptables to ARP, and ebtables to Ethernet frames.
		+
		+	iptables requires elevated privileges to operate and must be executed by user root, otherwise it fails to function. On most Linux systems, iptables is installed as <tt>/usr/sbin/iptables</tt> and documented in its man pages, which can be opened using <code>man iptables</code> when installed. It may also be found in <tt>/sbin/iptables</tt>, but since iptables is more like a service rather than an "essential binary", the preferred location remains <tt>/usr/sbin</tt>.
		+
		+	The term ''iptables'' is also commonly used to inclusively refer to the kernel-level components. ''x_tables'' is the name of the kernel module carrying the shared code portion used by all four modules that also provides the API used for extensions; subsequently, ''Xtables'' is more or less used to refer to the entire firewall (v4, v6, arp, and eb) architecture.
		+
		+	The successor of iptables is nftables, which was merged into the Linux kernel mainline in kernel version 3.13, which was released on 19 January 2014.
		+
	==Stateful filtering==		==Stateful filtering==
	*TCP states: NEW, RELATED, ESTABLISHED, INVALID		*TCP states: NEW, RELATED, ESTABLISHED, INVALID

@@ Line 1: / Line 1: @@
 ==Stateful filtering==
 *TCP states: NEW, RELATED, ESTABLISHED, INVALID
 *Basic ruleset:

@@ Line 26: / Line 26: @@
   $ iptables -p icmp -h
 ;<code>REJECT</code>: This is used to send back an error packet in response to the matched packet: otherwise it is equivalent to DROP so it is a terminating TARGET, ending rule traversal. This target is only valid in the INPUT, FORWARD, and OUTPUT chains, and user-defined chains which are only called from those chains. The following option controls the nature of the error packet returned:
   --reject-with type

← Older revision		Revision as of 19:31, 14 September 2016
Line 22:		Line 22:

	-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 --sport 63636 -s 10.0.0.2 -j ACCEPT		-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 --sport 63636 -s 10.0.0.2 -j ACCEPT
		+
		+	* Get a list of ICMP type names:
		+	$ iptables -p icmp -h
		+
		+	;<code>REJECT</code>: This is used to send back an error packet in response to the matched packet: otherwise it is equivalent to DROP so it is a terminating TARGET, ending rule traversal. This target is only valid in the INPUT, FORWARD, and OUTPUT chains, and user-defined chains which are only called from those chains. The following option controls the nature of the error packet returned:
		+	--reject-with type
		+	: The type given can be:
		+	::<code>icmp-net-unreachable</code>
		+	::<code>icmp-host-unreachable</code>
		+	::<code>icmp-port-unreachable</code>
		+	::<code>icmp-proto-unreachable</code>
		+	::<code>icmp-net-prohibited</code>
		+	::<code>icmp-host-prohibited</code>
		+	::<code>icmp-admin-prohibited</code> (*)
		+	:which return the appropriate ICMP error message (port-unreachable is the default). The option tcp-reset can be used on rules which only match the TCP protocol: this causes a TCP RST packet to be sent back. This is mainly useful for blocking ident (113/tcp) probes, which frequently occur when sending mail to broken mail hosts (which will not accept your mail otherwise).
		+	:(*) Using icmp-admin-prohibited with kernels that do not support it will result in a plain DROP instead of REJECT

	==Examples==		==Examples==

@@ Line 398: / Line 398: @@
 ==See also==
 *[http://ettercap.sourceforge.net/ Ettercap] &mdash; a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks.
 *[http://n2h.telles.org/ netfilter2html] &mdash; a script wrote using [[awk|GAWK]] to process netfilter logs and generate a nice HTML output.

@@ Line 378: / Line 378: @@
 ==Tips==
 *Find your external interface:
-  % /sbin/ip route ls
+  $ ip route ls
 .0.213.56 via 10.0.27.5e dev eth0  metric 10
 .168.27.0/24 dev eth0  proto kernel  scope link  src 192.168.27.63  metric 10
@@ Line 388: / Line 388: @@
 *Determine the IP address of your external interface:
-  % /sbin/ip addr ls dev eth0
+  $ ip addr ls dev eth0
 : eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 100
      link/ether 00:19:d1:4f:22:60 brd ff:ff:ff:ff:ff:ff

@@ Line 105: / Line 105: @@
 *Append a new rule to a chain (<code>-A, --append chain rule-specification</code>)
 *Delete a rule at some position in a chain (<code>-D, --delete chain rule-specification</code>)
 ==Help (-h)==

← Older revision		Revision as of 17:45, 7 May 2014
Line 22:		Line 22:

	-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 --sport 63636 -s 10.0.0.2 -j ACCEPT		-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 --sport 63636 -s 10.0.0.2 -j ACCEPT
		+
		+	==Examples==
		+	* Sample <code>`iptables`</code> ruleset:
		+	<pre>
		+	*filter
		+
		+	# Dropping incoming connections that don't have explecit rules bellow
		+	:INPUT DROP [68:4456]
		+	:FORWARD ACCEPT [0:0]
		+	:OUTPUT ACCEPT [1628:151823]
		+
		+	# Allow established connections for both public and private connections
		+	-A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
		+	-A INPUT -i eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT
		+
		+	# Opening ports wide open
		+	-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
		+	-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
		+	-A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
		+	-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT
		+	-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
		+	-A INPUT -p tcp -m tcp --dport 53 -j ACCEPT
		+	-A INPUT -p udp -m udp --dport 53 -j ACCEPT
		+
		+	# Opening a port to a specific IP
		+	-A INPUT -p tcp -m tcp --dport 10000 -s 192.168.1.1 -j ACCEPT
		+
		+	# Opening a port to a range of IPs
		+	-A INPUT -p tcp -m tcp --dport 20000 -s 192.168.0.0/24 -j ACCEPT
		+
		+	# Commmiting the rules to the firewall
		+	COMMIT
		+	</pre>
		+
		+	*Simple [[Bash]] script:
		+	<pre>
		+	#!/bin/bash
		+	# Set INPUT chain default policy to DROP
		+	iptables -P INPUT DROP
		+	# Flushes all rule in the filter table
		+	iptables -F
		+	# ACCEPT all packets from loopback interface
		+	iptables -A INPUT -i lo -j ACCEPT
		+	# ACCEPT all ESTABLISHED,RELATED packets
		+	iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
		+	# ACCEPT all NEW connections to tcp port 22
		+	iptables -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
		+	# REJECT all packets from 192.168.1.0/24 network
		+	iptables -A INPUT -s 192.168.1.0/24 -j REJECT
		+	# ACCEPT all icmp traffic from 192.168.0.0/24
		+	iptables -A INPUT -p icmp -s 192.168.0.0/24 -j ACCEPT
		+	# save rules
		+	iptables-save > /etc/sysconfig/iptables
		+	# print out saved rules
		+	iptables-save
		+	iptables -nvL
		+	</pre>
		+
		+	===Network Address Translation (NAT)===
		+	* The chains available in the <code>filter</code> table are: <code>INPUT, FORWARD, OUTPUT</code>
		+	* The chains available in the <code>nat</code> table are: <code>PREROUTING, POSTROUTING, OUTPUT</code>
		+	* Example:
		+	$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
		+	$ iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 192.168.0.1
		+	$ iptables -t nat -A PREROUTING -i eth0 -m tcp -p tcp --dport 80 -j DNAT --to-destination 192.168.0.100:8080
		+	* The <code>DNAT</code> target can only be used in the <code>PREROUTING</code> chain and the <code>OUTPUT</code> chain of the <code>nat</code> table.
		+	* To enable forwarding persistently across reboots, add <code>net.ipv4.ip_forward=1</code> to <code>/etc/sysctl.conf</code> then run <code>sysctl -p</code>, or:
		+	sysctl -w net.ipv4.ip_forward=1

	==Basic command options==		==Basic command options==

← Older revision		Revision as of 15:11, 7 May 2014
Line 1:		Line 1:
		+	==Stateful filtering==
		+	*TCP states: NEW, RELATED, ESTABLISHED, INVALID
		+
		+	*Basic ruleset:
		+	<pre>
		+	*filter
		+	:INPUT ACCEPT [0:0]
		+	:FORWARD ACCEPT [0:0]
		+	:OUTPUT ACCEPT [241:19144]
		+	-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
		+	-A INPUT -p icmp -j ACCEPT
		+	-A INPUT -i lo -j ACCEPT
		+	-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
		+	-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
		+	-A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
		+	-A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
		+	-A INPUT -p udp -m state --state NEW -m udp --dport 53 -j ACCEPT
		+	-A INPUT -j REJECT --reject-with icmp-host-prohibited
		+	-A FORWARD -j REJECT --reject-with icmp-host-prohibited
		+	COMMIT
		+	</pre>
		+
		+	-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 --sport 63636 -s 10.0.0.2 -j ACCEPT
		+
	==Basic command options==		==Basic command options==
	Chain manipulation (three default chains, INPUT, FORWARD, OUTPUT, are always present):		Chain manipulation (three default chains, INPUT, FORWARD, OUTPUT, are always present):

@@ Line 276: / Line 276: @@
 ==Tips==
 *Find your external interface:
-  % ip route ls
+  % /sbin/ip route ls
-.168.2.2 dev tun0 proto kernel scope link src 192.168.2.1
+.0.213.56 via 10.0.27.5e dev eth0  metric 10
-.13.10.0/24 dev tun1 scope link
+.168.27.0/24 dev eth0  proto kernel  scope link  src 192.168.27.63  metric 10
-.168.2.0/24 via 192.168.2.2 dev tun0
+.0.27.0/24 dev eth0  proto kernel  scope link  src 10.0.27.63  metric 10
-.95.17.0/24 dev eth0 proto kernel scope link  src 128.95.17.176
+.254.0.0/16 dev eth0  scope link  metric 10
-.10.10.0/24 dev tun1 scope link
+.0.0.0/8 dev lo  scope link
-  default via 128.95.17.254 dev eth0
+  default via 10.0.27.153 dev eth0  metric 10
 The last line shows <code>eth0</code> to be your external interface.
 *Determine the IP address of your external interface:
-  % ip addr ls dev eth0
+  % /sbin/ip addr ls dev eth0
-: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc htb qlen 1000
+: eth0: <BROADCAST,MULTICAST,UP,10000> mtu 1500 qdisc pfifo_fast qlen 100
-     link/ether 00:02:e3:08:48:4c brd ff:ff:ff:ff:ff:ff
+     link/ether 00:19:d1:4f:22:60 brd ff:ff:ff:ff:ff:ff
-     inet '''128.95.17.176'''/24 brd 128.95.17.255 scope global eth0
+     inet '''128.95.27.63'''/24 brd 10.0.27.255 scope global eth0
-     inet6 fe80::202:e3ff:fe08:484c/64 scope link
+    inet 192.168.27.63/24 brd 192.168.27.255 scope global eth0:0
         valid_lft forever preferred_lft forever
-*So, the IP address of the external interface is <code>128.95.17.176</code>.
+*So, the IP address of the external interface is <code>128.95.27.63</code>.
 ==See also==