The intended audience for this document is Andrew Grimo's OPS235 class. It is a guide to IPTables in the context of what OPS235 is currently studying and therefore a variety of its complexities will not be explored here.
This is an outline of
- how IPTables command lines are structured and understood
- an explanation of the rule specifications that we use
- sample commands that can be seen in the labs to relate to this document
Command Line Structure
At its core basics, an Iptables command is made up of the following parts.
- The first line below identifies the structure of the commands we would use.
- The lines that follow are similar as found in the iptables man pages.
- the items listed with [ ] square brackets are optional in the command
#iptables command chain rule-spec([match,] target/jump )
------- --------- ----------------------
#iptables -A chain rule-spec (Appends a rule)
'' -D chain rule# (Delete by rule number)
'' -D chain rule-spec (Delete by rule-spec match)
'' -I chain [rule#] rule-spec (Insert by rule-spec)
The rule# is 1 by default
Otherwise it is optional
'' -R chain rule# rule-spec (Replace by rule#)
'' -P chain target (Policy set for chain)
'' -F [chain] (Flush the rules from memory)
'' -L [chain] [--line-numbers] (List current rules in memory)
'' -S [chain] (Shows the rules in memory in
their command format)
Other commands using "service"
# service iptables status (List rules currently in memory)
# service iptables save (Saves the current configuration
into /etc/sysconfig/iptables )
Options for Elements in the Structure
Considering the commands, chains, matches and targets/jumps... there are only a few of those that we will actually use, at least for this course. Matches can get a bit more complex and will be discussed next, but the others will be listed here.
The items that are listed in ( ) round brackets are there for informational purposes as we don't use them in our course for our configurations.