Home > Notes > Iptables usages

Iptables usages

Wed, 20 Nov 2013 12:45:53 +0800
iptables -I INPUT -s -j DROP
iptables will drop the packets from

Chain options
the options list below:
-A / --append 
add a rule to chain.
iptables -A INPUT ... append a rule to INPUT chain.

-D / --delete 
delete a rule from chain
iptables -D INPUT 1 ... delete a rule which indicated by 1 from INPUT chain.

-R / --replace 
replace a rule in chain
iptables -R INPUT 1
iptables -R INPUT 1 -s --dport 80 -j DROP

-I / --insert
insert a rule to chain
iptables -I INPUT -s -j DROP

-L / --list
show current rule list in chain
iptables -L INPUT

-F / --flush
delete all rules in a chain
iptables -F INPUT

-Z / --zero
reset the packet counter
e.g iptables -Z INPUT

-N / --new-chain
create a chain
e.g iptables -N allowed

-X / --delete-chain
delete a chain
e.g iptables -X allowed

-P / --policy
define the rule policy. That means, the packets which unmatched the rule will do this rule.
e.g iptables -P INPUT DROP

-E / --rename-chain
rename a chain
e.g. iptables -E allowed disallowed

Packet options:
-p / --protocol
Indicate the protocol
iptables -A INPUT -p tcp
It can use operator, such as !, e.g iptables -A INPUT -p ! tcp, meaning that all protocol but TCP.

-s / --src / --source / -d / --dst / --distination
Indicate the source/distination packets
e.g iptables -A INPUT -s

-i / --in-interface / -o / --out-interface
Indicate which interface to match on.
e.g iptables -A INPUT -i eth0

--sport / --source-port / --dport / --distination-port
Indicate which port to match on.
e.g iptables -A INPUT -p tcp --dport 80

Match the packet's TCP flag
e.g iptables -A INPUT --tcp-flags SYN,ACK,FIN
flag values: SYN, ACK, FIN, RST, URG, PSH

Operation options:
-j operator, values: 

We use following ways to set the default policy:

1) Accept all packets first, then prevent the danger.
#iptables -P INPUT ACCEPT
#iptables -P OUTPUT ACCEPT

2) Reject all packets first, then accept the requisite.
#iptables -P INPUT DROP
#iptables -P OUTPUT DROP
#iptables -P FORWARD DROP

Frequently used:

Open 80 port:
# iptables -A INPUT -p tcp -dport 80 -j ACCEPT
# iptables -A OUTPUT -p tcp -sport 80 -j ACCEPT

Prevent SyncFlood:
# iptables -A FORWARD -p tcp -syn -m limit -limit 1/s -j ACCEPT

Prevent scanning:
# iptables -A FORWARD -p tcp -tcp-flags SYN,ACK,FIN,RST RST -m limit -limit 1/s -j ACCEPT

Prevent Ping of death:
# iptables -A FORWARD -p icmp -icmp-type echo-request -m limit -limit 1/s -j ACCEPT

Recent Post
Recent Comments
Copyright Notes
You can reship all of these articles without permission but MUST mark the original link in your post. Please contact with me() if u have advice or other arrangements.
Copyright©2007-2011 lewphee.com All rights reserved.