1
edit
Changes
no edit summary
The intended audience for this document is Andrew Grimo's OPS235 class. It is a guide to IPTables Iptables in the context of what OPS235 is currently studying and therefore a variety of its complexities will not be explored here.
This is an outline of
* how IPTables Iptables command lines are structured and understood
* an explanation of the rule specifications that we use
* sample commands that can be seen in the labs to relate to this document
** the items listed with [ ] square brackets are optional in the command
<pre> #iptables command chain rule-spec([match,] target/jump )
------- --------- ----------------------
#iptables -A chain rule-spec (Appends a rule)
into /etc/sysconfig/iptables )
</pre>
== Options for Elements in the Structure ==
The items that are listed in ( ) round brackets are there for informational purposes as we don't use them in our course for our configurations.
=== Brief Listing of Choices ===
<pre>
Commands Chains Matches Targets -j
------------ --------- ------- ----------
-A ...Append INPUT -p protocol ACCEPT
-I ...Insert OUTPUT -s src-address[/mask][,...] DROP
-D ...Delete (FORWARD) -d dst-address[/mask][,...] LOG
-R ...Replace --dport port (REJECT)
-P ...Policy --sport port
-F ...Flush
-L ...List
-S ...Show
</pre>
Above we can see that when it comes down to it, our chains and targets are limited and few. The commands we are dealing with aren't that many either. These few things help us establish the core basic foundation for our understanding of Iptables and what it offers.
"REJECT" - This target is the same as DROP, except that it returns a define-able error message to the sender. This informs the sender that the port, host, or service is unreachable and defeats the potential stealth mode that "DROP" alone offers.
=== Match Statements ===
Here's a bit more definition to our match statements. Essentially:
* a match is based on a protocol ( TCP, UDP, ICMP,...)
* source and destination addresses can define
** a single ip address with or without a netmask
** a network ip address with its netmask
** a network name or a hostname (defined locally - not through DNS)
** and a comma separated list of these
* source and destination ports can use either:
** port number
** port name (resolved in /etc/services)
== INPUT / OUTPUT ... Source / Destination ==
So where is that packet, coming or going?
<pre>
--------------- --------------- | INPUT | <--destination-------------------<--source--< |OUTPUT | | | | | | F12Host | | Fedora2 | | | | | | OUTPUT| >-source-->----------------->-destination--> |INPUT | --------------- ---------------
</pre>
The question of whether a packet is arriving, or leaving can be more easily visualized by the above chart. As you can see, source and destination are a matter of perspective. If you are configuring your iptables on your F12host machine, your point of reference for your Fedora2 machine will be different, or opposite.
Hopefully this chart will provide a visual for determining how to configure your scripts.
== INPUT/OUTPUT Chain processing ==
The following diagrams hope to visually define the hand off process of a packet as it enters or leaves a given server. This outlines in a brief sketch, what is happening on the INPUT and OUTPUT chains.
=== INPUT Chain ===
<pre>
--------- --------- routing localhost Local process
|F12Host|>-wire->|Fedora2|->eth0 -> decision --> INPUT chain -->filtering --> or application
--------- --------- is made \ of rules
\
some routed elsewhere
or sent to FORWARD chain
</pre>
=== OUTPUT Chain ===
== Sample Scripts from our Lab Material ==