Iptables is a command line interface used to set up and maintain tables for the Netfilter firewall for IPv4, included in the Linux kernel. The firewall matches packets with rules defined in these tables and then takes the specified action on a possible match.
Tables is the name for a set of chains.
Chain is a collection of rules.
Rule is condition used to match packet.
Target is action taken when a possible rule matches. Examples of the target are ACCEPT, DROP, QUEUE.
Policy is the default action taken in case of no match with the inbuilt chains and can be ACCEPT or DROP.
TABLE
Here the Table Options
filter: Default used table for packet filtering. It includes chains like INPUT, OUTPUT and FORWARD.
nat : Related to Network Address Translation. It includes PREROUTING and POSTROUTING chains.
mangle : For specialised packet alteration. Inbuilt chains include PREROUTING and OUTPUT.
raw : Configures exemptions from connection tracking. Built-in chains are PREROUTING and OUTPUT.
security : Used for Mandatory Access Control
CHAINS
Here the few built-in chains that are included in tables.
INPUT :set of rules for packets destined to localhost sockets.
FORWARD :for packets routed through the device.
OUTPUT :for locally generated packets, meant to be transmitted outside.
PREROUTING :for modifying packets as they arrive.
POSTROUTING :for modifying packets as they are leaving.
Restore Firewall Rules
To restore firewall rules form a file called /root/my.active.firewall.rules, enter:
#iptables-restore < /root/my.active.firewall.rules
To restore firewall rules under CentOS / RHEL / Fedora Linux, enter:
#service iptables restartIptable Examples:
Only Block Incoming Traffic
To drop all incoming / forwarded packets, but allow outgoing traffic, enter:
#iptables -P INPUT DROP
#iptables -P FORWARD DROP
#iptables -P OUTPUT ACCEPT
#iptables -A INPUT -m state --state NEW,ESTABLISHED -j ACCEPT
#iptables -L -v -n### *** now ping and wget should work *** ###
ping kingoncloud.com
wget http://www.linux.com/pub/linux/kernel/v3.0/testing/linux-3.2-rc5.tar.bz2
Drop Private Network Address On Public Interface
IP spoofing is nothing but to stop the following IPv4 address ranges for private networks on your public interfaces. Packets with non-routable source addresses should be rejected using the following syntax:
#iptables -A INPUT -i eth1 -s 192.168.0.0/24 -j DROP
#iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP
Block Incoming Port Requests (BLOCK PORT)
To block all service requests on port 80, enter:
To block port 80 only for an ip address 1.2.3.4, enter:
#iptables -A INPUT -p tcp -s 1.2.3.4 --dport 80 -j DROP
#iptables -A INPUT -i eth1 -p tcp -s 192.168.1.0/24 --dport 80 -j DROP
Block Outgoing IP Address
To block outgoing traffic to a particular host or domain such as kingoncloud.com, use the host command or dig command:
host -t a kingoncloud.com
Sample outputs:
kingoncloud.com has address 75.100.110.200
Note down its ip address and type the following to block all outgoing traffic to 75.100.110.200:
#iptables -A OUTPUT -d 75.100.110.200 -j DROP
You can use a subnet as follows:
Redirect port 80 to 8080
#iptables -t nat -A PREROUTING -i $interfaceName -p tcp --dport $srcPortNumber -j REDIRECT --to-port $dstPortNumber
To redirect all incoming traffic on port 80 redirect to port 8080
#iptables -t nat -I PREROUTING --src 0/0 --dst 192.168.1.5 -p tcp --dport 80 -j REDIRECT --to-ports 8080Port Forwarding
Either you can use sysctl to check if forwarding is enabled or not. Use below command to check –
[root@kingoncloud ~]# sysctl -a |grep -i eth0.forwarding
net.ipv4.conf.eth0.forwarding = 0
net.ipv6.conf.eth0.forwarding = 0Since both values are zero, port forwarding is disabled for ipv4 and ipv6 on interface eth0.
Or you can use the process filesystem to check if port forwarding is enabled or not.
[root@kingoncloud ~]# cat /proc/sys/net/ipv4/conf/eth0/forwarding
0
[root@kingoncloud ~]# cat /proc/sys/net/ipv6/conf/eth0/forwarding
0Again here process FS with zero values confirms port forwarding is disabled on our system. Now we need to first enable port forwarding on our system then we will configure port forwarding rules in iptables.
How to enable port forwarding in Linux
As we checked above, using the same methods you can enable port forwarding in Linux. But its recommended using sysctl command rather than replacing 0 by 1 in proc files.
Enable port forwarding in Linux using sysctl command –
[root@kingoncloud ~]# sysctl net.ipv4.conf.eth0.forwarding=1
net.ipv4.conf.eth0.forwarding = 1
[root@kingoncloud ~]# sysctl net.ipv6.conf.eth0.forwarding=1
net.ipv6.conf.eth0.forwarding = 1To make it persistent over reboots, add parameters in /etc/sysctl.conf
[root@kingoncloud ~]# echo "net.ipv4.conf.eth0.forwarding = 1">>/etc/sysctl.conf
[root@kingoncloud ~]# echo "net.ipv6.conf.eth0.forwarding = 1">>/etc/sysctl.conf
[root@kingoncloud ~]# sysctl -p
net.ipv4.conf.eth0.forwarding = 1
net.ipv6.conf.eth0.forwarding = 1Now, we have port forwarding enabled on our server, we can go ahead with configuring port forwarding rules using iptables.
Here we will forward port 80 to port 8080 on 172.31.40.29. Do not get confused port forwarding with port redirection.
We need to insert an entry in PREROUTING chain of iptables with DNAT target. Command will be as follows –
# iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j DNAT --to 172.31.40.29:8080
# iptables -A FORWARD -p tcp -d 172.31.40.29 --dport 8080 -j ACCEPTChange interface, IP and ports as per your requirement. The first command tells us to redirect packets coming to port 80 to IP 172.31.40.29 on port 8080. Now packet also needs to go through FORWARD chain so we are allowing in in the second command.