iptables

Intro

This is a basic Linux firewall program.

Look at your firewalls:

1iptables -L

bash

We see the output of input, output and forwarding rules.

Forward

I don't need any forwarding, so I'm going to drop all forwarding:

1iptables -P FORWARD DROP

bash

Input

Let's 'A'dd, or 'A'ppend a rule with -A. Let's drop all input from a nearby IP

1iptables -A INPUT -s 192.168.0.23 -j DROP

bash

Or we can block all input from a particular port on the full Network.

1iptables -A INPUT -s 192.168.0.0/24 -p tcp --destination-port 25 -j DROP

bash

1iptables -A INPUT --dport 80 -j ACCEPT

bash

This allows http traffic to an Apache web server over port 80.

However, rules are accepted in order - so a packet cannot be rejected and then accepted.

To delete rule 2 from the INPUT chain:

1iptables -D INPUT 3

bash

Alternatively, you can 'I'nsert a rule at the start, rather than 'A'ppending it.

1iptables -I INPUT -s 192.168.0.13 DROP

bash

Catchalls

Catchall rules state that anything which is not permitted is forbidden. They must be allowed last.

-Jurice-Diction

The -j flag accepts ACCEPT/REJECT/DROP. The last two are identical except that "REJECT" acknowledges the rejection.

Flush all existing rules with:

1iptables -F

bash

Examples

 1# Allow all loopback (lo0) traffic and drop all traffic to 127/8
 2# that doesn't use lo0
 3iptables -A INPUT -i lo -j ACCEPT
 4iptables -A OUTPUT -o lo -j ACCEPT
 5iptables -A INPUT -d 127.0.0.0/8 ! -i lo -j REJECT --reject-with icmp-port-unreachable
 6
 7# Allow established sessions to receive traffic
 8iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
 9
10# Allow ICMP pings
11iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
12
13# Allow SSH remote
14iptables -I INPUT -p tcp --dport 22 -j ACCEPT
15
16# Reject all other inbound connections
17iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
18iptables -A FORWARD -j REJECT --reject-with icmp-port-unreachable

...