Basic IPTABLES Understanding

Basic Commands

Typing

# iptables -L

lists your current rules in iptables. If you have just set up your server, you will have no rules, and you should see

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

Basic Iptables Options

Here are explanations for some of the iptables options you will see in this tutorial. Don't worry about understanding everything here now, but remember to come back and look at this list as you encounter new options later on.

• -A - Append this rule to a rule chain. Valid chains for what we're doing are INPUT, FORWARD and OUTPUT, but we mostly deal with INPUT in this tutorial, which affects only incoming traffic.
• -L - List the current filter rules.
• -m conntrack - Allow filter rules to match based on connection state. Permits the use of the --ctstate option.
• --ctstate - Define the list of states for the rule to match on. Valid states are:
• NEW - The connection has not yet been seen.
• RELATED - The connection is new, but is related to another connection already permitted.
• ESTABLISHED - The connection is already established.
• INVALID - The traffic couldn't be identified for some reason.
• -m limit - Require the rule to match only a limited number of times. Allows the use of the --limit option. Useful for limiting logging rules.
• --limit - The maximum matching rate, given as a number followed by "/second", "/minute", "/hour", or "/day" depending on how often you want the rule to match. If this option is not used and -m limit is used, the default is "3/hour".
• -p - The connection protocol used.
• --dport - The destination port(s) required for this rule. A single port may be given, or a range may be given as start:end, which will match all ports from start to end, inclusive.
• -j - Jump to the specified target. By default, iptables allows four targets:
• ACCEPT - Accept the packet and stop processing rules in this chain.
• REJECT - Reject the packet and notify the sender that we did so, and stop processing rules in this chain.
• DROP - Silently ignore the packet, and stop processing rules in this chain.
• LOG - Log the packet, and continue processing more rules in this chain. Allows the use of the --log-prefix and --log-level options.
• --log-prefix - When logging, put this text before the log message. Use double quotes around the text to use.
• --log-level - Log using the specified syslog level. 7 is a good choice unless you specifically need something else.
• -i - Only match if the packet is coming in on the specified interface.
• -I - Inserts a rule. Takes two options, the chain to insert the rule into, and the rule number it should be.
• -I INPUT 5 would insert the rule into the INPUT chain and make it the 5^th rule in the list.
• -v - Display more information in the output. Useful for if you have rules that look similar without using -v.
• -s --source - address[/mask] source specification
• -d --destination - address[/mask] destination specification
• -o --out-interface - output name[+] network interface name ([+] for wildcard)

Allowing Established Sessions

We can allow established sessions to receive traffic:

# iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

• The above rule has no spaces either side of the comma in ESTABLISHED,RELATED

If the line above doesn't work, you may be on a VPS that uses OpenVZ or doesn't have some kernel extensions installed. In that case, try this line instead:

# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

Allowing Incoming Traffic on Specific Ports

You could start by blocking traffic, but you might be working over SSH, where you would need to allow SSH before blocking everything else.

To allow incoming traffic on the default SSH port (22), you could tell iptables to allow all TCP traffic on that port to come in.

# iptables -A INPUT -p tcp --dport ssh -j ACCEPT

Referring back to the list above, you can see that this tells iptables:

• append this rule to the input chain (-A INPUT) so we look at incoming traffic
• check to see if it is TCP (-p tcp).
• if so, check to see if the input goes to the SSH port (--dport ssh).
• if so, accept the input (-j ACCEPT).

Lets check the rules: (only the first few lines shown, you will see more)

# iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh

Now, let's allow all incoming web traffic

# iptables -A INPUT -p tcp --dport 80 -j ACCEPT

Checking our rules, we have

# iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www

We have specifically allowed tcp traffic to the ssh and web ports, but as we have not blocked anything, all traffic can still come in.

Blocking Traffic

Once a decision is made to accept a packet, no more rules affect it. As our rules allowing ssh and web traffic come first, as long as our rule to block all traffic comes after them, we can still accept the traffic we want. All we need to do is put the rule to block all traffic at the end.

# iptables -A INPUT -j DROP

# iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www

DROP       all  --  anywhere             anywhere

Because we didn't specify an interface or a protocol, any traffic for any port on any interface is blocked, except for web and ssh.

Editing iptables

The only problem with our setup so far is that even the loopback port is blocked. We could have written the drop rule for just eth0 by specifying -i eth0, but we could also add a rule for the loopback. If we append this rule, it will come too late - after all the traffic has been dropped. We need to insert this rule before that. Since this is a lot of traffic, we'll insert it as the first rule so it's processed first.

# iptables -I INPUT 1 -i lo -j ACCEPT

# iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere

ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:www

DROP       all  --  anywhere             anywhere

The first and last lines look nearly the same, so we will list iptables in greater detail.

# iptables -L -v

Chain INPUT (policy ALLOW 0 packets, 0 bytes)

 pkts bytes target     prot opt in     out     source               destination        

    0     0 ACCEPT     all  --  lo     any     anywhere             anywhere

    0     0 ACCEPT     all  --  any    any     anywhere             anywhere            state RELATED,ESTABLISHED

    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:ssh

    0     0 ACCEPT     tcp  --  any    any     anywhere             anywhere            tcp dpt:www

    0     0 DROP       all  --  any    any     anywhere             anywhere

You can now see a lot more information. This rule is actually very important, since many programs use the loopback interface to communicate with each other. If you don't allow them to talk, you could break those programs!

Logging

In the above examples none of the traffic will be logged. If you would like to log dropped packets to syslog, this would be the quickest way:

# iptables -I INPUT 5 -m limit --limit 5/min -j LOG --log-prefix "iptables denied: " --log-level 7

See Tips section for more ideas on logging.

Saving iptables

If you were to reboot your machine right now, your iptables configuration would disappear. Rather than type this each time you reboot, however, you can save the configuration, and have it start up automatically. To save the configuration, you can use iptables-save and iptables-restore.

I will post more complex example with iptables later.

Thanks.

A-Z Linux Command Index, Linux Commands A to Z

An A-Z Index of the Bash command line for Linux.

Commands marked • are bash built-ins, these are available under all shells.

a 

  adduser            Add a user to the system

  addgroup          Add a group to the system

  alias                 Create an alias •

  apropos             Search Help manual pages (man -k)

  apt-get             Search for and install software packages (Debian)

  aspell               Spell Checker

  awk                 Find and Replace text, database sort/validate/index

b

  basename         Strip directory and suffix from filenames

  bash                GNU Bourne-Again SHell

  bc                                Arbitrary precision calculator language

  bg                               Send to background

  break               Exit from a loop •

  builtin               Run a shell builtin

  bzip2                Compress or decompress named file(s)

c

  cal                   Display a calendar

  case                Conditionally perform a command

  cat                               Display the contents of a file

  cd                                Change Directory

  cfdisk               Partition table manipulator for Linux

  chgrp               Change group ownership

  chmod              Change access permissions

  chown              Change file owner and group

  chroot              Run a command with a different root directory

  chkconfig          System services (runlevel)

  cksum              Print CRC checksum and byte counts

  clear                            Clear terminal screen

  cmp                 Compare two files

  comm              Compare two sorted files line by line

  command         Run a command - ignoring shell functions •

  continue           Resume the next iteration of a loop •

  cp                                Copy one or more files to another location

  cron                 Daemon to execute scheduled commands

  crontab            Schedule a command to run at a later time

  csplit                Split a file into context-determined pieces

  cut                               Divide a file into several parts

d

  date                 Display or change the date & time

  dc                                Desk Calculator

  dd                               Convert and copy a file, write disk headers, boot records

  ddrescue          Data recovery tool

  declare             Declare variables and give them attributes •

  df                    Display free disk space

  diff                  Display the differences between two files

  diff3                            Show differences among three files

  dig                   DNS lookup

  dir                   Briefly list directory contents

  dircolors           Colour setup for `ls'

  dirname            Convert a full pathname to just a path

  dirs                  Display list of remembered directories

  dmesg              Print kernel & driver messages

  du                               Estimate file space usage

e

  echo                Display message on screen •

  egrep               Search file(s) for lines that match an extended expression

  eject                            Eject removable media

  enable              Enable and disable builtin shell commands •

  env                  Environment variables

  ethtool             Ethernet card settings

  eval                             Evaluate several commands/arguments

  exec                Execute a command

  exit                  Exit the shell

  expect              Automate arbitrary applications accessed over a terminal

  expand             Convert tabs to spaces

  export              Set an environment variable

  expr                Evaluate expressions

f

  false                            Do nothing, unsuccessfully

  fdformat          Low-level format a floppy disk

  fdisk                            Partition table manipulator for Linux

  fg                    Send job to foreground

  fgrep               Search file(s) for lines that match a fixed string

  file                  Determine file type

  find                              Search for files that meet a desired criteria

  fmt                              Reformat paragraph text

  fold                              Wrap text to fit a specified width.

  for                               Expand words, and execute commands

  format             Format disks or tapes

  free                             Display memory usage

  fsck                             File system consistency check and repair

  ftp                   File Transfer Protocol

  function            Define Function Macros

  fuser               Identify/kill the process that is accessing a file

g

  gawk               Find and Replace text within file(s)

  getopts             Parse positional parameters

  grep                Search file(s) for lines that match a given pattern

  groups             Print group names a user is in

  gzip                             Compress or decompress named file(s)

h

  hash                Remember the full pathname of a name argument

  head                Output the first part of file(s)

  help                 Display help for a built-in command •

  history             Command History

  hostname         Print or set system name

i

  id                    Print user and group id's

  if                     Conditionally perform a command

  ifconfig             Configure a network interface

  ifdown              Stop a network interface

  ifup                              Start a network interface up

  import              Capture an X server screen and save the image to file

  install               Copy files and set attributes

j

  join                  Join lines on a common field

k

  kill                   Stop a process from running

  killall                Kill processes by name

l

  less                              Display output one screen at a time

  let                   Perform arithmetic on shell variables •

  ln                    Make links between files

  local                 Create variables •

  locate               Find files

  logname           Print current login name

  logout              Exit a login shell •

  look                             Display lines beginning with a given string

  lpc                   Line printer control program

  lpr                   Off line print

  lprint                Print a file

  lprintd              Abort a print job

  lprintq              List the print queue

  lprm                Remove jobs from the print queue

  ls                    List information about file(s)

  lsof                  List open files

m

  make               Recompile a group of programs

  man                 Help manual

  mkdir               Create new folder(s)

  mkfifo              Make FIFOs (named pipes)

  mkisofs            Create an hybrid ISO9660/JOLIET/HFS filesystem

  mknod             Make block or character special files

  more               Display output one screen at a time

  mount              Mount a file system

  mtools              Manipulate MS-DOS files

  mv                  Move or rename files or directories

  mmv                Mass Move and rename (files)

n

  netstat             Networking information

  nice                             Set the priority of a command or job

  nl                    Number lines and write files

  nohup              Run a command immune to hangups

  nslookup           Query Internet name servers interactively

o

  open                Open a file in its default application

  op                               Operator access

p

  passwd             Modify a user password

  paste               Merge lines of files

  pathchk            Check file name portability

  ping                 Test a network connection

  pkill                 Stop processes from running

  popd                Restore the previous value of the current directory

  pr                    Prepare files for printing

  printcap            Printer capability database

  printenv            Print environment variables

  printf                           Format and print data •

  ps                                Process status

  pushd               Save and then change the current directory

  pwd                 Print Working Directory

q

  quota               Display disk usage and limits

  quotacheck       Scan a file system for disk usage

  quotactl            Set disk quotas

r

  ram                 ram disk device

  rcp                              Copy files between two machines

  read                Read a line from standard input •

  readarray         Read from stdin into an array variable •

  readonly           Mark variables/functions as readonly

  reboot              Reboot the system

  rename            Rename files

  renice              Alter priority of running processes

  remsync           Synchronize remote files via email

  return              Exit a shell function

  rev                              Reverse lines of a file

  rm                               Remove files

  rmdir               Remove folder(s)

  rsync               Remote file copy (Synchronize file trees)

s

  screen              Multiplex terminal, run remote shells via ssh

  scp                              Secure copy (remote file copy)

  sdiff                             Merge two files interactively

  sed                              Stream Editor

  select               Accept keyboard input

  seq                              Print numeric sequences

  set                               Manipulate shell variables and functions

  sftp                             Secure File Transfer Program

  shift                 Shift positional parameters

  shopt               Shell Options

  shutdown          Shutdown or restart linux

  sleep                Delay for a specified time

  slocate             Find files

  sort                             Sort text files

  source              Run commands from a file `.'

  split                 Split a file into fixed-size pieces

  ssh                              Secure Shell client (remote login program)

  strace              Trace system calls and signals

  su                                Substitute user identity

  sudo                Execute a command as another user

  sum                 Print a checksum for a file

  symlink            Make a new name for a file

  sync                Synchronize data on disk with memory

t

  tail                   Output the last part of files

  tar                   Tape ARchiver

  tee                              Redirect output to multiple files

  test                              Evaluate a conditional expression

  time                 Measure Program running time

  times               User and system times

  touch               Change file timestamps

  top                              List processes running on the system

  traceroute         Trace Route to Host

  trap                             Run a command when a signal is set(bourne)

  tr                    Translate, squeeze, and/or delete characters

  true                             Do nothing, successfully

  tsort                            Topological sort

  tty                   Print filename of terminal on stdin

  type                 Describe a command •

u

  ulimit               Limit user resources •

  umask              Users file creation mask

  umount            Unmount a device

  unalias             Remove an alias •

  uname             Print system information

  unexpand          Convert spaces to tabs

  uniq                 Uniquify files

  units                            Convert units from one scale to another

  unset               Remove variable or function names

  unshar             Unpack shell archive scripts

  until                 Execute commands (until error)

  useradd            Create new user account

  usermod           Modify user account

  users               List users currently logged in

  uuencode          Encode a binary file

  uudecode          Decode a file created by uuencode

v

  v                     Verbosely list directory contents (`ls -l -b')

  vdir                              Verbosely list directory contents (`ls -l -b')

  vi                    Text Editor

  vmstat             Report virtual memory statistics

w

  watch               Execute/display a program periodically

  wc                               Print byte, word, and line counts

  whereis            Search the user's $path, man pages and source files for a program

  which               Search the user's $path for a program file

  while                Execute commands

  who                 Print all usernames currently logged in

  whoami            Print the current user id and name (`id -un')

  Wget                Retrieve web pages or files via HTTP, HTTPS or FTP

  write                Send a message to another user

x

  xargs               Execute utility, passing constructed argument list(s)

  yes                              Print a string until interrupted

  .                     Run a command script in the current shell

  ###                Comment / Remark