Introduction
A firewall plays a crucial role in securing your Linux system by controlling the incoming and outgoing network traffic. iptables is a powerful firewall tool that comes pre-installed in most Linux distributions. In this blog post, we will explore advanced iptables rules for configuring a robust firewall.
Prerequisites
Before we dive into the advanced iptables rules, make sure you have a basic understanding of how iptables works and have a Linux system with iptables installed.
Filtering Traffic
One of the main purposes of a firewall is to filter network traffic based on certain criteria. iptables provides several options for filtering traffic. Here are a few examples:
1. Blocking Incoming SSH Connections from Specific IP Address
To block incoming SSH connections from a specific IP address, use the following command:
$ iptables -A INPUT -p tcp --dport 22 -s 192.168.0.100 -j DROP
This rule adds a new entry to the INPUT chain, which drops any incoming TCP traffic on port 22 (SSH) from the IP address 192.168.0.100.
2. Allow Outgoing HTTP and HTTPS Traffic
To allow outgoing HTTP and HTTPS traffic, use the following commands:
$ iptables -A OUTPUT -p tcp --dport 80 -j ACCEPT
$ iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT
These rules add new entries to the OUTPUT chain, which accept outgoing TCP traffic on ports 80 (HTTP) and 443 (HTTPS).
3. Block Incoming ICMP (Ping) Requests
To block incoming ICMP (ping) requests, use the following command:
$ iptables -A INPUT -p icmp --icmp-type echo-request -j DROP
This rule drops any incoming ICMP echo-request packets.
Port Forwarding and Network Address Translation (NAT)
iptables also supports port forwarding and Network Address Translation (NAT). Here are a few examples:
1. Port Forwarding
To forward incoming traffic from port 8080 to a local server running on port 80, use the following command:
$ iptables -A PREROUTING -t nat -p tcp --dport 8080 -j DNAT --to-destination 192.168.0.10:80
$ iptables -A FORWARD -p tcp -d 192.168.0.10 --dport 80 -j ACCEPT
These rules add new entries to the PREROUTING and FORWARD chains to redirect incoming TCP traffic on port 8080 to the local IP address 192.168.0.10 and port 80.
2. Masquerading and Network Address Translation (NAT)
To perform masquerading and NAT for outgoing traffic, use the following commands:
$ iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
This rule adds a new entry to the POSTROUTING chain in the nat table, which masquerades outgoing traffic on the eth0 interface.
Custom Chains and Policies
iptables allows you to create custom chains to organize your rules and set default policies. Here are a few examples:
1. Creating Custom Chain
To create a custom chain named "MYCHAIN", use the following command:
$ iptables -N MYCHAIN
This command creates a new chain called "MYCHAIN".
2. Setting Default Policies
To set default policies for the INPUT, OUTPUT, and FORWARD chains, use the following commands:
$ iptables -P INPUT DROP
$ iptables -P OUTPUT ACCEPT
$ iptables -P FORWARD ACCEPT
These commands set the default policy for the INPUT chain to DROP (deny), the OUTPUT chain to ACCEPT (allow), and the FORWARD chain to ACCEPT (allow).
Saving and Restoring iptables Rules
To ensure that your iptables rules persist after a system reboot, you need to save them. Here's how:
1. Saving iptables Rules
To save the current iptables rules to a file, use the following command:
$ iptables-save > /etc/iptables/rules.v4
This command saves the current iptables rules to the specified file.
2. Restoring iptables Rules
To restore the saved iptables rules, use the following command:
$ iptables-restore < /etc/iptables/rules.v4
This command restores the iptables rules from the specified file.
Conclusion
iptables is a powerful tool for configuring a firewall on a Linux system. In this blog post, we explored advanced iptables rules for filtering traffic, performing port forwarding and NAT, creating custom chains, and setting default policies. Remember to save your iptables rules to ensure they persist after a system reboot.
本文来自极简博客，作者：柔情似水，转载请注明原文链接：Advanced Linux Firewall Configuration: Using iptables Rules
