iptables - Unix, Linux Command

Each chain is a list of rules which can match a set of packets.  Each
rule specifies what to do with a packet that matches.  This is called
a ‘target’, which may be a jump to a user-defined chain in the same
table.




ACCEPT means to let the packet through.
DROP means to drop the packet on the floor.
QUEUE means to pass the packet to userspace.  (How the packet can be received
by a userspace process differs by the particular queue handler.  2.4.x
and 2.6.x kernels up to 2.6.13 include the
 ip_queue
queue handler.  Kernels 2.6.14 and later additionally include the
 nfnetlink_queue
queue handler.  Packets with a target of QUEUE will be sent to queue number ’0’
in this case. Please also see the
 NFQUEUE
target as described later in this man page.)
RETURN means stop traversing this chain and resume at the next rule in the
previous (calling) chain.  If the end of a built-in chain is reached
or a rule in a built-in chain with target
RETURN is matched, the target specified by the chain policy determines the
fate of the packet.


The tables are as follows:

 iptables -t nat -n -L

 iptables -L -v


The following are included in the base package, and most of these can
be preceded by a
! to invert the sense of the match.


Features:


- long (one counter per protocol TCP/UDP/IMCP/Other) and short statistics


- one iptables rule for all hosts in network/netmask


- loading/saving counters (by reading/writting to procfs entries)




account traffic for/to 192.168.0.0/24 network into table mynetwork:


# iptables -A FORWARD -m account --aname mynetwork --aaddr 192.168.0.0/24


account traffic for/to WWW serwer for 192.168.0.0/24 network into table mywwwserver:


# iptables -A INPUT -p tcp --dport 80

  -m account --aname mywwwserver --aaddr 192.168.0.0/24 --ashort


# iptables -A OUTPUT -p tcp --sport 80

  -m account --aname mywwwserver --aaddr 192.168.0.0/24 --ashort


read counters:


# cat /proc/net/ipt_account/mynetwork
# cat /proc/net/ipt_account/mywwwserver


set counters:


# echo "ip = 192.168.0.1 packets_src = 0" > /proc/net/ipt_account/mywwserver


Webpage:

http://www.barbara.eu.org/~quaker/ipt_account/


The counters are 64bit and are thus not expected to overflow ;)


The primary use is to detect long-lived downloads and mark them to be
scheduled using a lower priority band in traffic control.


The transfered bytes per connection can also be viewed through
/proc/net/ip_conntrack and accessed via ctnetlink


It gives you the ability to express


string can be "ftp" for packets related to a ftp-session on default port.
For other ports append -portnr to the value, ie. "ftp-2121".


Same rules apply for other conntrack-helpers.

 iptables -p icmp -h


Original fingerprint table was created by Michal Zalewski <lcamtuf@coredump.cx>.


This module compares some data(WS, MSS, options and it’s order, ttl,
df and others) from first SYN packet (actually from packets with SYN
bit set) with dynamically loaded OS fingerprints.


In syslog you find something like this:


#iptables -I INPUT -j ACCEPT -p tcp -m osf --genre Linux --log 1 --smart


NOTE: -p tcp is obviously required as it is a TCP match.


Fingerprints can be loaded and read through /proc/sys/net/ipv4/osf file.
One can flush all fingerprints with following command:


Fingerprints can be downloaded from http://www.openbsd.org/cgi-bin/cvsweb/src/etc/pf.os


For example, you can create a ‘badguy’ list out of people attempting
to connect to port 139 on your firewall and then DROP all future
packets from them without considering them.


# iptables -A FORWARD -p tcp -i eth0 --dport 139 -m recent --name badguy --set -j DROP


/proc/net/ipt_recent/* are the current lists of addresses and information
about each entry of each list.


Each file in /proc/net/ipt_recent/ can be read from to see the current list
or written two using the following commands to modify the list:


Chunk types: DATA INIT INIT_ACK SACK HEARTBEAT HEARTBEAT_ACK ABORT SHUTDOWN SHUTDOWN_ACK ERROR COOKIE_ECHO COOKIE_ACK ECN_ECNE ECN_CWR SHUTDOWN_COMPLETE ASCONF ASCONF_ACK


chunk type            available flags     

DATA                  U B E u b e        

ABORT                 T t                

SHUTDOWN_COMPLETE     T t                


(lowercase means flag should be "off", uppercase means "on")


iptables -A INPUT -p sctp --dport 80 -j DROP


iptables -A INPUT -p sctp --chunk-types any DATA,INIT -j DROP


iptables -A INPUT -p sctp --chunk-types any DATA:Be -j ACCEPT

 iptables -A FORWARD -m set --set test src,dst

 iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST SYN


Details and examples are in the kernel module source.


In Kernels up to 2.6.10 you can add several --to-destination options.  For
those kernels, if you specify more than one destination address, either via an
address range or multiple --to-destination options, a simple round-robin (one
after another in cycle) load balancing takes place between these addresses.
Later Kernels (>= 2.6.11-rc1) don’t have the ability to NAT to multiple ranges
anymore.




This target is to be used inside the mangle table, in the PREROUTING,
POSTROUTING or FORWARD hooks.


Examples:


We create a queue for each user, the queue number is adequate
to the IP address of the user, e.g.: all packets going to/from 192.168.5.2
are directed to 1:0502 queue, 192.168.5.12 -> 1:050c etc.


We have one classifier rule:


The target doesn’t take any option, and therefore is extremly easy to use :


# iptables -t mangle -A PREROUTING -j IPV4OPTSSTRIP

 icmp-net-unreachable 
 icmp-host-unreachable 
 icmp-port-unreachable 
 icmp-proto-unreachable 
 icmp-net-prohibited 
 icmp-host-prohibited or 
 icmp-admin-prohibited (*) 


In Kernels up to 2.6.10, you can add several --to-source options.  For those
kernels, if you specify more than one source address, either via an address
range or multiple --to-source options, a simple round-robin (one after another
in cycle) takes place between these addresses.
Later Kernels (>= 2.6.11-rc1) don’t have the ability to NAT to multiple ranges
anymore.


This offers similar functionality to LaBrea
<http://www.hackbusters.net/LaBrea/> but doesn’t require dedicated
hardware or IPs. Any TCP port that you would normally DROP or REJECT
can instead become a tarpit.


To tarpit connections to TCP port 80 destined for the current machine:

 iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN \
             -j TCPMSS --clamp-mss-to-pmtu

 iptables -j TOS -h


The other main difference is that
-i refers to the input interface;
-o refers to the output interface, and both are available for packets
entering the
FORWARD chain.


iptables is a pure packet filter when using the default ‘filter’ table, with
optional extension modules.  This should simplify much of the previous
confusion over the combination of IP masquerading and packet filtering
seen previously.  So the following options are handled differently:

 -j MASQ
 -M -S
 -M -L

iptables (8)
iptables (8)
iptables (8)
iptables (8)
ip6tables (8)
ip6tables (8)
ip6tables (8)
ip6tables (8)
ip6tables (8)
ip6tables (8)

Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic packet
selection framework in iptables, then wrote the mangle table, the owner match,
the mark stuff, and ran around doing cool stuff everywhere.


James Morris wrote the TOS target, and tos match.


Jozsef Kadlecsik wrote the REJECT target.


Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as well as the TTL, DSCP, ECN matches and targets.


The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Jozsef Kadlecsik,
Patrick McHardy, James Morris, Harald Welte and Rusty Russell.


Man page originally written by Herve Eychenne <rv@wallfire.org>.











Advertisements


    129 Lectures 
     23 hours 

 Eduonix Learning Solutions

    5 Lectures 
     4.5 hours 

 Frahaan Hussain

    35 Lectures 
     2 hours 

 Pradeep D

    41 Lectures 
     2.5 hours 

 Musab Zayadneh

    46 Lectures 
     4 hours 

 GUHARAJANM

    6 Lectures 
     4 hours 

 Uplatz
 Print
 Add Notes
 Bookmark this page