IPtables
IPtables work on kernel layers. It is use to filter the
network. Also use for NAT. it is configure on port and protocols, IP address
and on the interface.
Kernel layer= transport( port protocol)+ network(IP address)+
Data link(interface)
IP Tables Type
1) Filter
2) NAT
3) Mangle.
Filter
Filter is use for allow and deny the packet.
NAT
Redirect and changing the IP address.
NAT havr two type
Prerouting
To redirect the packet before come is called prerouting.
Post routing
To redirect the packet after packet come and use packet or
provide the other PC IP or hide the own IP address is called post routing.
Mangle
Change the Packet type.
Syntex:-
#iptables -t filter
(NAT mangle) –I INPUT (OUTPUT FORWARD
PREROUTING POSTROUTING) –p tcp (UDP) –s (Source IP) –d (Destination IP) –sport (Source Port) –d ( Destination Port) –I
(Interface) –to-source ( IP Address) –to-dest (IP Address) –o (Output Interface)
–j ACCEPT ( REJECT DROP SNAT DNAT )
Implement of IPtables
#service iptables restart
#iptables –F (flush the defaults rule)
#service iptables save ( to save the rule)
#iptables –L –n –v (to check the rules enable (list))
#iptables –L –v –n –line-number
#iptables –L output –v –n (list bye chain type)
#iptables –nvL
#system-config-securitylevel (graphical setting)
#iptables –d OUTPUT ( to delete rules)
Configuration file
#/etc/sysconfig/iptables
Some example of IPtables
1) Our sshd server is access by only our
network
#iptables –t filter –I
INPUT –p tcp –s ! 172.17.1.0/255.255.0.0 –d 172.17.1.1 –dport 22 –j REJECT
2) We can connect only orkut.com at HTTP
request
#iptables –t filter –I
OUTPUT –p tcp –s 172.17.1.1 –d! orkut.com –dport 80 –j REJECT
3) Our network connect to only
jabong.com from our getway server
#iptables –t filter –I
FORWARD –s! 172.17.1.0/255.255.0.0 –j REJECT
#iptables –t filter –I
FORWARD –s 172.17.1.0/255.255.0.0 –d! jabong.com –j REJECT
4) If any client/packet come from
redhat.com its redirect to jabong.com
#iptables –t NAT –I
PREROUTING –p tcp –s redhat.com d 172.17.1.1 –j DNAT –to-dst jabong.com
5) If anyone connect to our jabong.com
server IP shown different 172.17.1.1
#iptables –t NAT –I
POSTROUTING –p tcp –s 172.17.1.10 –d jabong.com –j SNAT –to-source 172.17.1.1
6) To block all service
# iptables –I INPUT –p
tcp –j REJECT
7) To block all output
#iptables –I OUTPUT –p
tcp –j REJECT
8) To block perticular service to all
machine.
#iptables –I INPUT –p tcp
–dport 22 –j REJECT
9) To block service for a machine or
network
#iptables –I INPUT –p tcp
–dport 22 –s 172.17.1.1 (172.17.1.0/255.255.0.0) –j REJECT
10) To reject multiple port
#iptables –I INPUT –p tcp
–m multiport –dport 22,23,80 –s 172.17.1.0/255.255.0.0 –j REJECT
11) Apply security according to MAC
address
#iptables –I INPUT –m
–mac-source (give here MAC) –j reject
12) To stop ICMP request
#iptables –I INPUT –p
icmp –s 172.17.1.1 –j DROP
To create manuly chain
#iptables –N rhce
Insert rule in chain
#iptables –I INPUT 1 –j
rhce
1 is here chain number
#iptables –A rhce –p tcp
–dport 23 –s 172.17.1.1 –j ACCEPT
#iptables –x chain name (
to remove chain)
Backup of iptables
#iptables-save > /root/Desktop/kausahal
#iptables-restore <
/root/Desktop/kaushal
