iptables

From RaySoft

iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains.[1]

Documentation

Syntax

iptables [PARAMETER ...]

Parameters

Tables

There are currently five independent tables (which tables are present at any time depends on the kernel configuration options and which modules are present).

-t TABLE, --table TABLE
This option specifies the packet matching TABLE which the command should operate on. If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there.
The tables are as follows:
filter
This is the default table (if no -t option is passed). It contains the built-in chains INPUT (for packets destined to local sockets), FORWARD (for packets being routed through the box), and OUTPUT (for locally-generated packets).
nat
This table is consulted when a packet that creates a new connection is encountered. It consists of three built-ins: PREROUTING (for altering packets as soon as they come in), OUTPUT (for altering locally-generated packets before routing), and POSTROUTING (for altering packets as they are about to go out).
mangle
This table is used for specialized packet alteration. Until kernel 2.4.17 it had two built-in chains: PREROUTING (for altering incoming packets before routing) and OUTPUT (for altering locally-generated packets before routing). Since kernel 2.4.18, three other built-in chains are also supported: INPUT (for packets coming into the box itself), FORWARD (for altering packets being routed through the box), and POSTROUTING (for altering packets as they are about to go out).
raw
This table is used mainly for configuring exemptions from connection tracking in combination with the NOTRACK target. It registers at the netfilter hooks with higher priority and is thus called before ip_conntrack, or any other IP tables. It provides the following built-in chains: PREROUTING (for packets arriving via any network interface) OUTPUT (for packets generated by local processes).

Commands

These options specify the desired action to perform. Only one of them can be specified on the command line unless otherwise stated below. For long versions of the command and option names, you need to use only enough letters to ensure that iptables can differentiate it from all other options.

-A CHAIN, --append CHAIN
Append one or more rules to the end of the selected CHAIN. When the source and/or destination names resolve to more than one address, a rule will be added for each possible address combination.
-D CHAIN [NUMBER], --delete CHAIN [NUMBER]
Delete one or more rules from the selected CHAIN. There are two versions of this command: the rule can be specified as a NUMBER in the chain (starting at 1 for the first rule) or a rule to match.
-F [CHAIN], --flush [CHAIN]
Flush the selected CHAIN (all the chains in the table if none is given). This is equivalent to deleting all the rules one by one.
-I CHAIN [NUMBER], --insert CHAIN [NUMBER]
Insert one or more rules in the selected CHAIN as the given rule NUMBER. So, if the rule number is 1, the rule or rules are inserted at the head of the chain. This is also the default if no rule number is specified.
-L [CHAIN], --list [CHAIN]
List all rules in the selected CHAIN. If no chain is selected, all chains are listed.
-N CHAIN, --new-chain CHAIN
Create a new user-defined CHAIN by the given name. There must be no target of that name already.
-P CHAIN TARGET, --policy CHAIN TARGET
Set the policy for the CHAIN to the given TARGET.
NOTE:
Only built-in (non-user-defined) chains can have policies, and neither built-in nor user-defined chains can be policy targets.
-X [CHAIN], --delete-chain [CHAIN]
Delete the optional user-defined CHAIN specified. There must be no references to the chain. If there are, you must delete or replace the referring rules before the chain can be deleted. The chain must be empty, i.e. not contain any rules. If no argument is given, it will attempt to delete every non-builtin chain in the table.

Parameters

The following parameters make up a rule specification (as used in the add, delete, insert, replace and append commands).

[!] -i NAME, --in-interface NAME
NAME of an interface via which a packet was received (only for packets entering the INPUT, FORWARD and PREROUTING chains). When the ! argument is used before the interface name, the sense is inverted. If the interface name ends in a +, then any interface which begins with this name will match. If this option is omitted, any interface name will match.
-j TARGET, --jump TARGET
This specifies the TARGET of the rule; i.e., what to do if the packet matches it. The TARGET can be a user-defined chain (other than the one this rule is in), one of the special builtin targets which decide the fate of the packet immediately, or an extension. If this option is omitted in a rule, then matching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented.
[!] -o NAME, --out-interface NAME
NAME of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTING chains). When the ! argument is used before the interface name, the sense is inverted. If the interface name ends in a +, then any interface which begins with this name will match. If this option is omitted, any interface name will match.
[!] -p PROTOCOL, --protocol PROTOCOL
The PROTOCOL of the rule or of the packet to check. The specified PROTOCOL can be one of tcp, udp, udplite, icmp, esp, ah, sctp or the special keyword all, or it can be a numeric value, representing one of these protocols or a different one. A protocol name from /etc/protocols is also allowed. A ! argument before the protocol inverts the test. The number zero is equivalent to all. all will match with all protocols and is taken as default when this option is omitted.

Examples

References

  1. ↑ man 8 'iptables'
Retrieved from "https://www.raysoft.ch/w/index.php?title=iptables&oldid=43944"