Home » » Iptables and examples

Iptables and examples

This is just quick-reference for the kernel 2.4 "iptables" tool from the netfilter framework.
Current set of default tables:
filter (default table): Starts with built-in chains:
INPUT: Arriving.
FORWARD: Being routed.
OUTPUT: Locally generated

nat (traffic that creates new connections): Starts with built-in chains:
PREROUTING: Arriving.
OUTPUT: Locally generated.
POSTROUTING: Exiting.

mangle (specialised packet alteration): Starts with built-in chains:
PREROUTING: Incoming, before routing.
OUTPUT: Locally generated.
INPUT: Arriving.
FORWARD: Being routed.
POSTROUTING: Exiting.

The admin can create/delete/rename additional chains for any target.
Each chain consists of a set of rules, consulted in order (thus the term "chain") until one's conditions match. If none match, the default policy applies, "-P" option. (Policies exist only for built-in chains.

Policy target may only be one of the four predefined rules.) Each rule has:
criterion: Which packets will be affected.
target: Which rule to consult next. (May optionally be one of the predefined rules ACCEPT, DROP, QUEUE=userspace-handled, or RETURN=policy.)
Each rule is assigned a rulenum, which can be used to refer to it in iptables commands.

Since rulesets live in RAM, one can preserve them to disk or reload them using iptables-save and iptables-restore, respectively.
Many of the more interesting features, such as stateful inspection, are via dynamically-loaded helper modules (option "-m").
$IPTABLES -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A FORWARD -m limit --limit 3/minute --limit-burst 3 -j LOG 
--log-level DEBUG --log-prefix "IPT FORWARD packet died: "

Spoofing:
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 192.168.0.0/16 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 10.0.0.0/8 -j DROP
$IPTABLES -t nat -A PREROUTING -i $INET_IFACE -s 172.16.0.0/12 -j DROP 

## Create chain that blocks new connections, except if coming from inside.
# iptables -N block
# iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A block -m state --state NEW -i ! eth0 -j ACCEPT
# iptables -A block -j DROP
## Jump to that chain from INPUT and FORWARD chains.
# iptables -A INPUT -j block
# iptables -A FORWARD -j block

Type of Service (TOS) prioritisation: To maximize ssh response while maintaining maximum file data transfer over HTTP connections:
# /sbin/iptables -A PREROUTING -t mangle -p tcp --sport ssh -j TOS --set-tos Minimize-Delay
# /sbin/iptables -A PREROUTING -t mangle -p tcp --sport http -j TOS --set-tos Maximize-Throughput 

Share this article :

7 comments:

  1. I am an avid reader who likes engaging content. That's why I am here. Your original views on this topic are refreshing and interesting. You've done a great job of expressing your views. Thank you.
    tu 95| call of duty| clicker heroes| strike force heroes 2| kitten cannon
    scooby doo games| scooby doo| brain games| braingames| brain

    ReplyDelete
  2. Written, Thank you for the introduction of a range of information that is very interesting to see in this article.
    Signature: open facebook | facebook login | happy wheels | happy wheels game | earn to die | earn to die game
    I enjoyed over read your blog post. Your blog have nice information, I got good ideas from this amazing blog. I am always searching like this type blog post. I hope I will see again..

    ReplyDelete
  3. The article you have shared here very awesome. I really like and appreciated your work. I read deeply your article, the points you have mentioned in this article are useful
    monkey go happy 2| yahtzee with buddies| learn to fly 2 | happy wheels | mahjong | pacman | monkey go happy | defendyournuts 2| superfighters 2 |

    ReplyDelete
  4. With a Hotmail account, you can send and receive emails quickly and easily as well as login and use all Microsoft services.
    hotmail login | sign in to hotmail | recover hotmail password
    This is the game so players feel very fierce , adventurous . You try to join and play this game , you will feel great like.
    strike force heroes | strike force heroes 4
    happy wheels | tank trouble 2 | slitherio
    gun mayhem 2 | age of war | can your pet

    ReplyDelete
  5. And money. Thank God for instant loans! It is usually fast loans difficult to approach
    happy wheels | friv | girlsgogames | games2girls | happy wheels

    ReplyDelete

Please fill your name to response.