Understanding iptables
Download as PPTX, PDF1 like2,700 views
This document provides an overview of iptables and Linux firewall configuration. It discusses Netfilter hooks and stages, stateless and stateful firewall rules using iptables, logging rules, the tables (filter, nat, mangle, raw) and built-in chains, creating custom chains, using ipsets for constant-time lookups, and useful iptables commands. It also briefly mentions using libnetfilter_queue to divert traffic to userspace applications and provides references for further reading on Linux firewalls and Netfilter.
Understanding iptables
- 1. Understanding iptables Linux firewall basics
- 2. Netfilter hooks stages Socket App NIC INPUT PRE_ROUTING POST_ROUTING OUTPUT FORWARD
- 3. Stateless firewall iptables -A INPUT -p tcp --dport 80 -j ACCEPT
- 4. Stateful firewall iptables -A INPUT -p tcp -m conntrack --ctstate ESTABLISHED -j ACCEPT iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -j ACCEPT
- 5. Logging iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW -j LOG --log-prefix “In Http:”
- 6. Tables overview Filter is a default table. So, if you don’t define you own table, you’ll be using filter table. Each table has a number of predefined chains inside. You can create your own chain. Filter Input Forward Output Nat Output Prerouting Postrouting Mangle Input Prerouting Postrouting Output Forward Raw Output Prerouting
- 7. Tables in shell iptables -t mangle -A POSTROUTING -o $NETCARD -p tcp -m connbytes --connbytes 10000000: --connbytes-mode bytes --connbytes-dir both -j CONNMARK --set-mark 999 iptables -t mangle -A INPUT -i eth0 -p tcp --dport 80 -m string --string ”get /admin http/” --icase --algo bm -m conntrack --ctstate ESTABLISHED -j DROP iptables -t filter -A input -p tcp --dport 22 -m time --datestart “” --datestop “” --utc --j DROP
- 8. Custom chains Create a new chain iptables -N LOGDROP Add chain rules iptables -A LOGDROP -j LOG --log-level 4 --log-prefix 'SourceDrop ' iptables -A LOGDROP -j DROP Add chain rules to iptables rules iptables -A INPUT -s 10.0.0.0/8 -j LOGDROP
- 9. Netfilter in user land libnetfilter_queue is used to divert traffic to user application Packets are not duplicated User application has to inject a packet back Useful for debugging rules
- 10. ip sets Constant time hash lookup modprobe ip_set ipset -N droplist nethash ipset -add droplist 192.168.1.0/24 iptables -A INPUT -m set --set droplistsrc -j DROP
- 11. Useful commands Drop all rules iptables -F Quickly restore rules iptables-restore <rules list file>
- 12. References Designing and Implementing Linux Firewalls with QoS using netfilter, iproute2, NAT and L7-filter Netfilter & Iptables Elements Linux Firewall Tutorial: IPTables Tables, Chains, Rules Fundamentals Understanding Linux Network Internals iptables book Iptables targets and jumps Security in Linux
- 13. My blog Learning Network Programming