This chapter focuses on packet filtering basics, defines the differences
between ipchains and iptables,
explains various options available with iptables
commands, and explains how filtering rules can be preserved between system
reboots.
The Linux kernel has the built-in ability to filter packets, allowing
some of them to be received by or pass through the system while stopping
others. The kernel's netfilter has three built-in
tables or rules
lists. They are as follows:
filter — The default table for handling
network packets.
nat — Used to alter packets that create a
new connection and used for Network Address
Translation (NAT).
mangle — Used for specific
types of packet alteration.
 | Tip |
|---|
| | In addition to these built in tables, specialized tables can be created
and stored in the
/lib/modules/<kernel-version>/kernel/net/ipv4/netfilter/
directory (where <kernel-version>
corresponds to the version kernel number).
|
Each table has a group of built-in chains which
correspond to the actions performed on the packet by the netfilter.
The built-in chains for the filter table are as
follows:
INPUT — Applies to network packets that are
targeted for the host.
OUTPUT — Applies to
locally-generated network packets.
FORWARD — Applies to network
packets routed through the host.
The built-in chains for the nat table are as follows:
PREROUTING — Alters network packets
when they arrive.
OUTPUT — Alters locally-generated
network packets before they are sent out.
POSTROUTING — Alters network
packets before they are sent out.
The built-in chains for the mangle table are as
follows:
INPUT — Alters network packets
targeted for the host.
OUTPUT — Alters locally-generated
network packets before they are sent out.
FORWARD — Alters network packets
routed through the host.
PREROUTING — Alters incoming
network packets before they are routed.
POSTROUTING — Alters network
packets before they are sent out.
Every network packet received by or sent from a Linux system is subject
to at least one table. However, a packet may be subjected to multiple
rules within each table before emerging at the end of the chain. The
structure and purpose of these rules may vary, but they usually seek to
identify a packet coming from or going to a particular IP address, or
set of addresses, when using a particular protocol and network service.
 | Note |
|---|
| | Do not use fully qualified domain names in firewall rules that are
saved in the /etc/sysconfig/iptables or
/etc/sysconfig/ip6tables files. In the following
example:
iptables -A FORWARD -s example.com -i eth0 -j DROP
example.com is invalid because the
iptables service starts before any DNS related
services at boot time, which results in an error. Only IP addresses are
valid in creating firewall rules.
|
Regardless of their destination, when packets match a particular rule in
one of the tables, a target or action is applied
to them. If the rule specifies an ACCEPT target for a
matching packet, the packet skips the rest of the rule checks and is
allowed to continue to its destination. If a rule specifies a
DROP target, that packet is refused access to the
system and nothing is sent back to the host that sent the packet. If a
rule specifies a QUEUE target, the packet is passed
to user-space. If a rule specifies the optional
REJECT target, the packet is dropped, but an error
packet is sent to the packet's originator.
Every chain has a default policy to ACCEPT,
DROP, REJECT, or
QUEUE. If none of the rules in the chain apply to the
packet, then the packet is dealt with in accordance with the default
policy.
The iptables command configures these tables, as well
as sets up new tables if necessary.
