The first step in using iptables is to start the
iptables service. This can be done with the
command:
 | Warning |
|---|
| | The ip6tables services should be turned off to
use the iptables service with the following
commands: service ip6tables stop
chkconfig ip6tables off |
|
To make iptables start by default whenever the
system is booted, you must change runlevel status on the service using
chkconfig.
chkconfig --level 345 iptables on |
The syntax of iptables is separated into
tiers. The main tier is the chain. A chain
specifies the state at which a packet is manipulated. The usage is as
follows:
iptables -A chain -j target |
The -A option appends a rule at the end of an
existing ruleset. The chain is the name of
the chain for a rule. The three built-in chains of
iptables (that is, the chains that affect every
packet which traverses a network) are INPUT, OUTPUT, and FORWARD. These
chains are permanent and cannot be deleted. The -j
target option specifies the location
in the iptables ruleset where this particular rule
should jump. Some built in targets are ACCEPT,
DROP, and REJECT.
New chains (also called user-defined chains) can be created by using
the -N option. Creating a new chain is useful for
customizing granular or elaborate rules.
Establishing basic firewall policies creates a foundation for
building more detailed, user-defined
rules. iptables uses policies
(-P) to create default
rules. Security-minded administrators usually elect to drop all
packets as a policy and only allow specific packets on a case-by-case
basis. The following rules block all incoming and outgoing packets on
a network gateway:
iptables -P INPUT DROP
iptables -P OUTPUT DROP |
Additionally, it is recommended that any forwarded
packets — network traffic that is to be routed from
the firewall to its destination node — be denied as well, to
restrict internal clients from inadvertent exposure to the Internet. To
do this, use the following rule:
After setting the policy chains, you can create new rules for your
particular network and security requirements. The following sections
outline some rules you may implement in the course of building your
iptables firewall.
Firewall rules are only valid for the time the computer is on; so,
if the system is rebooted, the rules are automatically flushed and
reset. To save the rules so that they are loaded later, use the
following command:
/sbin/service iptables save |
The rules are stored in the file
/etc/sysconfig/iptables and are applied
whenever the service is started or restarted, including when the
machine is rebooted.
