Home > Notes > Iptables usages

Iptables usages

Wed, 20 Nov 2013 12:45:53 +0800
iptables -I INPUT -s 111.111.111.0/24 -j DROP
iptables will drop the packets from 111.111.111.0-111.111.111.255


Chain options
the options list below:
-A / --append 
add a rule to chain.
e.g 
iptables -A INPUT ... append a rule to INPUT chain.

-D / --delete 
delete a rule from chain
e.g
iptables -D INPUT 1 ... delete a rule which indicated by 1 from INPUT chain.

-R / --replace 
replace a rule in chain
e.g
iptables -R INPUT 1
iptables -R INPUT 1 -s 192.168.1.100 --dport 80 -j DROP

-I / --insert
insert a rule to chain
e.g
iptables -I INPUT -s 1.2.3.4 -j DROP

-L / --list
show current rule list in chain
e.g
iptables -L INPUT

-F / --flush
delete all rules in a chain
iptables -F INPUT

-Z / --zero
reset the packet counter
e.g iptables -Z INPUT

-N / --new-chain
create a chain
e.g iptables -N allowed

-X / --delete-chain
delete a chain
e.g iptables -X allowed

-P / --policy
define the rule policy. That means, the packets which unmatched the rule will do this rule.
e.g iptables -P INPUT DROP

-E / --rename-chain
rename a chain
e.g. iptables -E allowed disallowed

Packet options:
-p / --protocol
Indicate the protocol
e.g
iptables -A INPUT -p tcp
It can use operator, such as !, e.g iptables -A INPUT -p ! tcp, meaning that all protocol but TCP.

-s / --src / --source / -d / --dst / --distination
Indicate the source/distination packets
e.g iptables -A INPUT -s 1.2.3.0/24

-i / --in-interface / -o / --out-interface
Indicate which interface to match on.
e.g iptables -A INPUT -i eth0

--sport / --source-port / --dport / --distination-port
Indicate which port to match on.
e.g iptables -A INPUT -p tcp --dport 80

--tcp-flags
Match the packet's TCP flag
e.g iptables -A INPUT --tcp-flags SYN,ACK,FIN
flag values: SYN, ACK, FIN, RST, URG, PSH

Operation options:
-j operator, values: 
ACCEPT,REJECT,DROP,REDIRECT,MASQUERADE,LOG,DNAT,SNAT,MIRROR,QUEUE,RETURN,MARK

We use following ways to set the default policy:

1) Accept all packets first, then prevent the danger.
#iptables -P INPUT ACCEPT
#iptables -P OUTPUT ACCEPT
#iptables -P FORWARD ACCEPT

2) Reject all packets first, then accept the requisite.
#iptables -P INPUT DROP
#iptables -P OUTPUT DROP
#iptables -P FORWARD DROP

Frequently used:

Open 80 port:
# iptables -A INPUT -p tcp -dport 80 -j ACCEPT
# iptables -A OUTPUT -p tcp -sport 80 -j ACCEPT

Prevent SyncFlood:
# iptables -A FORWARD -p tcp -syn -m limit -limit 1/s -j ACCEPT

Prevent scanning:
# iptables -A FORWARD -p tcp -tcp-flags SYN,ACK,FIN,RST RST -m limit -limit 1/s -j ACCEPT

Prevent Ping of death:
# iptables -A FORWARD -p icmp -icmp-type echo-request -m limit -limit 1/s -j ACCEPT


Tag:iptables
Hots
Tags
Recent Post
Recent Comments
Links
Copyright Notes
You can reship all of these articles without permission but MUST mark the original link in your post. Please contact with me() if u have advice or other arrangements.
Copyright©2007-2011 lewphee.com All rights reserved.