LinuxDevCenter.com
oreilly.comSafari Books Online.Conferences.

advertisement


Linux in a Nutshell

This directory of Linux commands is from Linux in a Nutshell, 5th Edition.

Click on any of the 687 commands below to get a description and list of available options. All links in the command summaries point to the online version of the book on Safari Bookshelf.

Buy it now, or read it online on Safari Bookshelf.



iptables

iptables command [options]

System administration command. Configure netfilter filtering rules for kernels 2.4 and later. Rules for iptables consist of some matching criteria and a target, a result to be applied if the packet matches the criteria. The rules are organized into chains. You can use these rules to build a firewall, masquerade your local area network, or just reject certain kinds of network connections.

There are three built-in tables for iptables: one for network filtering (filter), one for Network Address Translation (nat), and the last for specialized packet alterations (mangle). Firewall rules are organized into chains, ordered checklists of rules that the kernel works through looking for matches. The filter table has three built-in chains: INPUT, OUTPUT, and FORWARD. The INPUT and OUTPUT chains handle packets originating from or destined for the host system. The FORWARD chain handles packets just passing through the host system. The nat table also has three built-in chains: PREROUTING, POSTROUTING, and OUTPUT. mangle has only two chains: PREROUTING and OUTPUT.

netfilter checks packets entering the system. After applying any PREROUTING rules, it passes them to the INPUT chain, or to the FORWARD chain if the packet is just passing through. Upon leaving, the system packets are passed to the OUTPUT chain and then on to any POSTROUTING rules. Each of these chains has a default target (a policy) in case no match is found. User-defined chains can also be created and used as targets for packets but do not have default policies. If no match can be found in a user-defined chain, the packet is returned to the chain from which it was called and tested against the next rule in that chain.

iptables changes only the rules in the running kernel. When the system is powered off, all changes are lost. You can use the iptables-save command to make a script you can run with iptables-restore to restore your firewall settings. Such a script is often called at bootup. Many distributions have an iptables initialization script that uses the output from iptables-save.

Commands

iptables is almost always invoked with one of the following commands:

-A chain rules, --append chain rules

Append new rules to chain.

-D chain rules, --delete chain rules

Delete rules from chain. Rules can be specified by their ordinal number in the chain as well as by a general rule description.

-E old-chain new-chain, --rename-chain old-chain new-chain

Rename old-chain to new-chain.

-F [chain] , --flush [chain]

Remove all rules from chain, or from all chains if chain is not specified.

-I chain number rules, --insert chain number rules

Insert rules into chain at the ordinal position given by number.

-L [chain] , --list [chain]

List the rules in chain, or all chains if chain is not specified.

-N chain, --new-chain chain

Create a new chain. The chain's name must be unique. This is how user-defined chains are created.

-P chain target, --policy chain target

Set the default policy for a built-in chain; the target itself cannot be a chain.

-R chain number rule, --replace chain number rule

Replace a rule in chain. The rule to be replaced is specified by its ordinal number.

-X [chain] , --delete-chain [chain]

Delete the specified user-defined chain, or all user-defined chains if chain is not specified.

-Z [chain] , --zero [chain]

Zero the packet and byte counters in chain. If no chain is specified, all chains will be reset. When used without specifying a chain and combined with the -L command, list the current counter values before they are reset.

Targets

A target may be the name of a chain or one of the following special values:

ACCEPT

Let the packet through.

DROP

Drop the packet.

QUEUE

Send packets to the user space for processing.

RETURN

Stop traversing the current chain and return to the point in the previous chain from which this one was called. If RETURN is the target of a rule in a built-in chain, the built-in chain's default policy is applied.

Rule specification parameters

These options are used to create rules for use with the preceding commands. Rules consist of some matching criteria and usually a target to jump to (-j) if the match is made. Many of the parameters for these matching rules can be expressed as a negative with an exclamation point (!) meaning "not." Those rules will match everything except the given parameter.

-c packets bytes, --set-counters packets bytes

Initialize packet and byte counters to the specified values.

-d [!] address[/mask] [!] [port] , --destination [!] address[/mask] [port]

Match packets from the destination address. The address may be supplied as a hostname, a network name, or an IP address. The optional mask is the netmask to use and may be supplied either in the traditional form (e.g., /255.255.255.0) or in the modern form (e.g., /24).

[!] -f, [!] --fragment

The rule applies only to the second or further fragments of a fragmented packet.

-i [!] name[+] , --in-interface name[+]

Match packets being received from interface name. name is the network interface used by your system (e.g., eth0 or ppp0). A + can be used as a wildcard, so ppp+ would match any interface name beginning with ppp.

-j target, --jump target

Jump to a special target or a user-defined chain. If this option is not specified for a rule, matching the rule only increases the rule's counters, and the packet is tested against the next rule.

-o [!] name[+] , --out-interface name[+]

Match packets being sent from interface name. See the description of -i for the syntax for name.

-p [!] name, --protocol [!] name

Match packets of protocol name. The value of name can be given as a name or number, as found in the file /etc/protocols. The most common values are tcp, udp, icmp, or the special value all. The number 0 is equivalent to all, and this is the default value when this option is not used. If there are extended matching rules associated with the specified protocol, they will be loaded automatically. You need not use the -m option to load them.

-s [!] address[/mask] [!] [port] , --source [!] address[/mask] [!] [port]

Match packets with the source address. See the description of -d for the syntax of this option.

Options

-h [icmp] , --help [icmp]

Print help message. If icmp is specified, a list of valid ICMP type names will be printed. -h can also be used with the -m option to get help on an extension module.

--line-numbers

Used with the -L command. Add the line number to the beginning of each rule in a listing, indicating its position in the chain.

-m module, --match module

Explicitly load matching rule extensions associated with module. See the next section.

--modprobe=command

Use specified command to load any necessary kernel modules while adding or inserting rules into a chain.

-n, --numeric

Print all IP address and port numbers in numeric form. By default, text names are displayed when possible.

-t name, --table name

Apply rules to the specified table. Rules apply to the filter table by default.

-v, --verbose

Verbose mode.

-x, --exact

Expand all numbers in a listing (-L). Display the exact value of the packet and byte counters instead of rounded figures.

Match extensions

Several modules extend the matching capabilities of netfilter rules. Using the -p option will cause iptables to load associated modules implicitly. Others need to be loaded explicitly with the -m or --match options. Here we document those modules used most frequently.

icmp

Loaded when -p icmp is the only protocol specified:

--icmp-type [!] type

Match the specified ICMP type. type may be a numeric ICMP type or one of the ICMP type names shown by the command iptables -p icmp -h.

multiport

Loaded explicitly with the -m option. The multiport extensions match sets of source or destination ports. These rules can be used only in conjunction with -p tcp and -p udp. Up to 15 ports can be specified in a comma-separated list:

--source-port [ports]

Match the given source ports.

--destination-port [ports]

Match the given destination ports.

--port [ports]

Match if the packet has the same source and destination port and that port is one of the given ports.

state

Loaded explicitly with the -m option. This module matches the connection state of a packet:

--state states

Match the packet if it has one of the states in the comma-separated list states. Valid states are INVALID, ESTABLISHED, NEW, and RELATED.

tcp

Loaded when -p tcp is the only protocol specified:

--source-port [!] [port] [:port] , --sport [!] [port] [:port]

Match the specified source ports. Using the colon specifies an inclusive range of services to match. If the first port is omitted, 0 is the default. If the second port is omitted, 65535 is the default. You can also use a dash instead of a colon to specify the range.

--destination-port [!] [port] [:port] , --dport [!] [port] [:port]

Match the specified destination ports. The syntax is the same as for --source-port.

--mss n[:n]

Match if TCP SYN or SYN/ACK packets have the specified MSS value or fall within the specified range. Use this to control the maximum packet size for a connection.

[!] --syn

Match packets with the SYN bit set and the ACK and FIN bits cleared. These are packets that request TCP connections; blocking them prevents incoming connections. Shorthand for --tcp-flags SYN,RST,ACK SYN.

--tcp-flags [!] mask comp

Match the packets with the TCP flags specified by mask and comp. mask is a comma-separated list of flags that should be examined. comp is a comma-separated list of flags that must be set for the rule to match. Valid flags are SYN, ACK, FIN, RST, URG, PSH, ALL, and NONE.

--tcp-option [!] n

Match if TCP option is set.

udp

Loaded when -p udp is the only protocol specified:

--source-port [!] [port] [:port] , --sport [!] [port] [:port]

Match the specified source ports. The syntax is the same as for the --source-port option of the TCP extension.

--destination-port [!] [port] [:port] , --dport [!] [port] [:port]

Match the specified destination ports. The syntax is the same as for the --source-port option of the TCP extension.

Target extensions

Extension targets are optional additional targets supported by separate kernel modules. They have their own associated options. We cover the most frequently used target extensions below.

DNAT

Modify the destination address of the packet and all future packets in the current connection. DNAT is valid only as a part of the POSTROUTING chain in the nat table:

--to-destination address[-address] [port-port]

Specify the new destination address or range of addresses. The arguments for this option are the same as the --to-source argument for the SNAT extension target.

LOG

Log the packet's information in the system log:

--log-level level

Set the syslog level by name or number (as defined by syslog.conf).

--log-prefix prefix

Begin each log entry with the string prefix. The prefix string may be up to 30 characters long.

--log-tcp-sequence

Log the TCP sequence numbers. This is a security risk if your log is readable by users.

--log-tcp-options

Log options from the TCP packet header.

--log-ip-options

Log options from the IP packet header.

MASQUERADE

Masquerade the packet so it appears that it originated from the current system. Reverse packets from masqueraded connections are unmasqueraded automatically. This is a legal target only for chains in the nat table that handle incoming packets and should be used only with dynamic IP addresses (like dial-up.) For static addresses use DNAT:

--to-ports port[-port]

Specify the port or range of ports to use when masquerading. This option is valid only if a tcp or udp protocol has been specified with the -p option. If this option is not used, the masqueraded packet's port will not be changed.

REJECT

Drop the packet and, if appropriate, send an ICMP message back to the sender indicating the packet was dropped. If the packet was an ICMP error message, an unknown ICMP type, or a nonhead fragment, or if too many ICMP messages have already been sent to this address, no message is sent:

--reject-with type

Send specified ICMP message type. Valid values are icmp-net-unreachable, icmp-host-unreachable, icmp-port-unreachable, or icmp-proto-unreachable. If the packet was an ICMP ping packet, type may also be echo-reply.

SNAT

Modify the source address of the packet and all future packets in the current connection. SNAT is valid only as a part of the POSTROUTING chain in the nat table:

--to-source address[-address] [port-port]

Specify the new source address or range of addresses. If a tcp or udp protocol has been specified with the -p option, source ports may also be specified. If none is specified, map the new source to the same port if possible. If not, map ports below 512 to other ports below 512, those between 512 and 1024 to other ports below 1024, and ports above 1024 to other ports above 1024.

Examples

To reject all incoming ICMP traffic on eth0:

iptables -A INPUT -p ICMP -i eth0 -j REJECT


Linux Resources
  • Linux Online
  • The Linux FAQ
  • linux.java.net
  • Linux Kernel Archives
  • Kernel Traffic
  • DistroWatch.com


  • Sponsored by: