Iptables

External

• http://www.netfilter.org/
• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html#sec-Using_iptables
• http://wiki.centos.org/HowTos/Network/IPTables
• http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-iptables.html
• https://help.ubuntu.com/community/IptablesHowTo
• http://www.thegeekstuff.com/2011/01/iptables-fundamentals/
• http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html
• http://www.cyberciti.biz/faq/rhel-fedorta-linux-iptables-firewall-configuration-tutorial/
• http://www.cyberciti.biz/tips/linux-iptables-examples.html

Internal

• Linux Security

Overview

iptables is a Linux command line tool used to query and manipulate the network packet filtering rules maintained by the Linux kernel. Network packet filtering in the kernel is implemented by the netfilter framework. The term "iptables" is also used to refer to the iptables service, which is a systemd service that uses the iptables tool to configure the packet filtering rules at boot. netfilter and iptables are used to implement network firewalls and NAT. The relationships between these concepts is explained in iptables Concepts: netfilter, iptables tool, iptables service and firewalld. More details available here ...

Installation

With yum

yum install iptables-services

With apt

apt-get update
apt-get install -y iptables

Concepts

iptables Concepts

iptables tool

iptables Command Line Tool

iptables Command Line Tool Examples

iptables Service

Getting Information about iptables Service

systemctl status iptables

The following command tells whether the ip_tables modules are loaded:

lsmod | grep tables
ip_tables               9567  1 iptable_filter
ip6_tables             10867  1 ip6table_filter

iptables Service Installation

iptables service and firewalld are incompatible. If iptables service is used, firewalld must be disabled: firewalld#Disable.

yum -y install iptables iptables-services

This will install both IPv4 and IPv6 support.

Lifecycle

The iptables service starts by reading the individual iptables tool commands from its configuration rule file /etc/sysconfig/iptables and applying those rules to tables and the chains specified in the file. The rule commands are applied in order, then the commit command is issued for each table.

iptables Service Configuration

The service is configured in /usr/libexec/iptables/iptables.init and /usr/libexec/iptables/ip6tables.init (or /etc/init.d/iptables).

This is where the file the service reads its rules from is configured:

IPTABLES=iptables
IPTABLES_DATA=/etc/sysconfig/$IPTABLES

The rule file is read every time the service is started. These are some examples of base configuration:

• IPv4 Base Configuration
• IPv6 Base Configuration

Then enable the service to start at boot.

Further rules will be added on a case by case basis.

Configuration Examples

iptables Command Line Tool Examples

iptables Service Operations

Enable to Start at Boot

After rule configuration, enable the iptables service to start at boot:

systemctl enable iptables
systemctl enable ip6tables

Reload the Rules

This command restarts the service and reloads the rules from the configuration file, discarding the current memory rules:

systemctl restart iptables

iptables-save/iptables-restore

iptables-save/iptables-restore

iptables Troubleshooting

iptables Troubleshooting