Home » » Iptables and examples

Iptables and examples

This is just quick-reference for the kernel 2.4 "iptables" tool from the netfilter framework.
Current set of default tables:
filter (default table): Starts with built-in chains:
INPUT: Arriving.
FORWARD: Being routed.
OUTPUT: Locally generated

nat (traffic that creates new connections): Starts with built-in chains:
PREROUTING: Arriving.
OUTPUT: Locally generated.
POSTROUTING: Exiting.

mangle (specialised packet alteration): Starts with built-in chains:
PREROUTING: Incoming, before routing.
OUTPUT: Locally generated.
INPUT: Arriving.
FORWARD: Being routed.
POSTROUTING: Exiting.

The admin can create/delete/rename additional chains for any target.
Each chain consists of a set of rules, consulted in order (thus the term "chain") until one's conditions match. If none match, the default policy applies, "-P" option. (Policies exist only for built-in chains.

Policy target may only be one of the four predefined rules.) Each rule has:
criterion: Which packets will be affected.
target: Which rule to consult next. (May optionally be one of the predefined rules ACCEPT, DROP, QUEUE=userspace-handled, or RETURN=policy.)
Each rule is assigned a rulenum, which can be used to refer to it in iptables commands.

Since rulesets live in RAM, one can preserve them to disk or reload them using iptables-save and iptables-restore, respectively.
Many of the more interesting features, such as stateful inspection, are via dynamically-loaded helper modules (option "-m").
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG 
--log-level DEBUG --log-prefix "IPT FORWARD packet died: "

Spoofing:
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 192.168.0.0/16 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 10.0.0.0/8 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 172.16.0.0/12 -j DROP 

## Create chain that blocks new connections, except if coming from inside.
# iptables -N block
# iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A block -m state --state NEW -i ! eth0 -j ACCEPT
# iptables -A block -j DROP
## Jump to that chain from INPUT and FORWARD chains.
# iptables -A INPUT -j block
# iptables -A FORWARD -j block

Type of Service (TOS) prioritisation: To maximize ssh response while maintaining maximum file data transfer over HTTP connections:
# /sbin/iptables -A PREROUTING -t mangle -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
# /sbin/iptables -A PREROUTING -t mangle -p tcp --sport http -j TOS --set-tos Maximize-Throughput 

Share this article :

13 comments:

  1. I am an avid reader who likes engaging content. That's why I am here. Your original views on this topic are refreshing and interesting. You've done a great job of expressing your views. Thank you.
    tu 95| call of duty| clicker heroes| strike force heroes 2| kitten cannon
    scooby doo games| scooby doo| brain games| braingames| brain

    ReplyDelete
  2. Written, Thank you for the introduction of a range of information that is very interesting to see in this article.
    Signature: open facebook | facebook login | happy wheels | happy wheels game | earn to die | earn to die game
    I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again..

    ReplyDelete
  3. The article you have shared here very awesome. I really like and appreciated your work. I read deeply your article, the points you have mentioned in this article are useful
    monkey go happy 2| yahtzee with buddies| learn to fly 2 | happy wheels | mahjong | pacman | monkey go happy | defendyournuts 2| superfighters 2 |

    ReplyDelete
  4. With a Hotmail account, you can send and receive emails quickly and easily as well as login and use all Microsoft services.
    hotmail login | sign in to hotmail | recover hotmail password
    This is the game so players feel very fierce , adventurous . You try to join and play this game , you will feel great like.
    strike force heroes | strike force heroes 4
    happy wheels | tank trouble 2 | slitherio
    gun mayhem 2 | age of war | can your pet

    ReplyDelete
  5. And money. Thank God for instant loans! It is usually fast loans difficult to approach
    happy wheels | friv | girlsgogames | games2girls | happy wheels

    ReplyDelete
  6. Not all are true. Everyone has their own way of thinking but I think they have to reconsider. I like to argue for the most accurate results.
    http://colorswitchplay.com

    ReplyDelete
  7. Thanks for sharing your info. I really appreciate your efforts and I will be waiting for your further write
    run3unblockedgame.com

    ReplyDelete
  8. I was very impressed by this post, this site has always been pleasant news. Thank you very much for such an interesting post. Keep working, great job! In my free time, I like play game: facebooklite.com.br. What about you?

    ReplyDelete
  9. I often get emotionally involved. Like when I read your post, I can cry, laugh, sad, funny, depending on your written words. I think you are a sensitive person.
    www.facebookbaixargratis.com.br

    ReplyDelete
  10. Very inspiring and helpful too.Hope you continue to share more of your ideas.I will definitely love to read.
    Happyroom2.com Tosstheturtle.net Catmariogame.com

    ReplyDelete

Please fill your name to response.