IPTABLES

There are three tables in Iptables.

1) Filter – It contains built chains to filter the packets inbound & outbound.

INPUT – packets coming into box.

FORWARD – packet routed through box.

OUTPUT – for locally generated packets.

2) Nat – This table consulted when a packet creates new connection.

PREROUTING – Altering packets as soon as they come in.

OUTPUT – Altering locally generated packets before routing.

POSTROUTING – Altering packets as they are going outside.

3) Mangle – Used for specialized packet alteration.

INPUT – Packets coming into the box.

OUTPUT – Altering local packets before routing.

PREROUTING – Altering incoming packets before routing.

POSTROUTING – Altering packets as they are about to go outside.

Iptables Command List -

#iptables -L [ chain ]

Lists current iptables configuration.

#iptables -A [ chain ]

Appending a rule

#iptables -R [ chain ]

Replace an existing rule.

#iptables -D [ chain ]

Delete rule from current chain configuration.

#iptables -I [ chain ]

Inserts a new rule into a desired chain.

#iptables -N [ chain ]

Create a new chain.

#iptables -F [ chain ]

Deleting rules one by one.

#iptables -X [ chain ]

Delete all chains.

#iptables -F [ chain ]

Flush the table of all contents.

Examples of some iptable rules -

1)Denying FTP access / Rejecting FTP access

#iptables -I INPUT -s 192.168.0.1 -d 192.168.0.2 -p tcp –dport 21 -j REJECT

Here system IP is – 192.168.0.2

FTP port – 21

Keyword – REJECT – rejects all the requests

ACCEPT – accepts all the requests

FORWARD – forwards all the requests

Rule simplified – If any request coming from 192.168.0.1 with port 21, reject the request.

2)Accepting access to FTP

#iptables -I INPUT -s 192.168.0.1 -d 192.168.0.2 -p tcp –dport 21 -j ACCEPT

Rule simplified – If any request coming from 192.168.0.1 with port 21, accept the request.

Update the entries of iptables -

#restorecon -R /etc/sysconfig/iptables

Save the iptables entries -

#service iptables save

Restart the iptables sarvice -

#service iptables restart

Check the iptable rules applied -

#iptables -L

Removing all iptable rules applied-

#iptables -F

Exporting iptables configuration -

#iptables-save > filename

Importing iptables configuration -

#iptables-restore < filename