This article describes basic usage of linux iptables.
Sources
List Rules
1 | sudo iptables --list -n --line-numbers |
To show packet counts and aggregate size in the INPUT chain:
1 | sudo iptables -L INPUT -v |
Delete Rules
1 | # delete a single rule in the INPUT chain |
Chains
- INPUT - All packets destined for the host computer.
- OUTPUT - All packets originating from the host computer.
- FORWARD - All packets neither destined for nor originating from the host computer, but passing through (routed by) the host computer. This chain is used if you are using your computer as a router.
Default Policy
- DROP: if no ACCEPT rules are set, drop all packages
- ACCEPT: if no DROP rules are set, accept all packages
CLI Walktrhough
1 | iptables -P INPUT ACCEPT |
Explanation:
- iptables -P INPUT ACCEPT If connecting remotely we must first temporarily set the default policy on the INPUT chain to ACCEPT otherwise once we flush the current rules we will be locked out of our server.
- iptables -F We used the -F switch to flush all existing rules so we start with a clean state from which to add new rules.
- iptables -A INPUT -i lo -j ACCEPT Now it’s time to start adding some rules. We use the -A switch to append (or add) a rule to a specific chain, the INPUT chain in this instance. Then we use the -i switch (for interface) to specify packets matching or destined for the lo (localhost, 127.0.0.1) interface and finally -j (jump) to the target action for packets matching the rule - in this case ACCEPT. So this rule will allow all incoming packets destined for the localhost interface to be accepted. This is generally required as many software applications expect to be able to communicate with the localhost adaptor.
- iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT This is the rule that does most of the work, and again we are adding (-A) it to the INPUT chain. Here we’re using the -m switch to load a module (state). The state module is able to examine the state of a packet and determine if it is NEW, ESTABLISHED or RELATED. NEW refers to incoming packets that are new incoming connections that weren’t initiated by the host system. ESTABLISHED and RELATED refers to incoming packets that are part of an already established connection or related to and already established connection.
- iptables -A INPUT -p tcp –dport 22 -j ACCEPT Here we add a rule allowing SSH connections over tcp port 22. This is to prevent accidental lockouts when working on remote systems over an SSH connection. We will explain this rule in more detail later.
- iptables -P INPUT DROP The -P switch sets the default policy on the specified chain. So now we can set the default policy on the INPUT chain to DROP. This means that if an incoming packet does not match one of the following rules it will be dropped. If we were connecting remotely via SSH and had not added the rule above, we would have just locked ourself out of the system at this point.
- iptables -P FORWARD DROP Similarly, here we’ve set the default policy on the FORWARD chain to DROP as we’re not using our computer as a router so there should not be any packets passing through our computer.
- iptables -P OUTPUT ACCEPT and finally, we’ve set the default policy on the OUTPUT chain to ACCEPT as we want to allow all outgoing traffic (as we trust our users).
- iptables -L -v Finally, we can list (-L) the rules we’ve just added to check they’ve been loaded correctly.
Finally:
1 | sudo /sbin/service iptables save |
Executable script
Open a text editor:
1 |
|
Save the script then make it executable:
1 | chmod +x myfirewall |