Shulou(Shulou.com)06/01 Report--

Most people do not understand the knowledge points of this article "how to use Iptables to initialize firewall", so the editor summarizes the following content, detailed content, clear steps, and has a certain reference value. I hope you can get something after reading this article. Let's take a look at this "how to use Iptables to initialize firewall" article.

Netfilter/iptables (abbreviated as iptables) constitutes a packet filtering firewall under the Linux platform. Like most Linux software, this packet filtering firewall is free. It can replace expensive commercial firewall solutions to complete packet filtering, packet redirection and network address translation (NAT) and other functions.

Initialization of firewall

No more nonsense, let's start with a form:

Option meaning-F clear all rules in the chain-P add a default policy (target) to the chain-An add a rule description to the chain-D remove a rule from the chain-L view the chain and rules of the current table

To clear the data in the default table (filter table), simply use the following command:

[root@localhost] # iptables-F

To clear the rules for the INPUT chain in the default table, use the following command:

[root@localhost] # iptables-F INPUT

After the command is executed, use iptables-L to view the current firewall settings. The basic syntax for setting a default policy for a chain is as follows:

Iptables-P archy target

Where archy is the name of the chain and target (target) is used to define the policy. There are nine different policies available in the filter table, but only four are most commonly used, including: ACCEPT means to allow a packet to pass; DROP discards a packet; REJECT returns an ICMP error message when it is discarded; and LOG acts as a clerk to record packet information. Generally speaking, setting all chains to DROP is a good choice for servers. The following command sets the default policy for all chains to DROP:

[root@localhost ~] # iptables-P INPUT DROP

After executing this command, all attempts to establish a connection with the local machine will fail because all packets arriving from the "outside" to the firewall will be discarded, not even using the loopback interface ping itself.

Add Rul

Use the iptables-A command to add chain rules, the basic syntax of which is as follows:

Iptables-An archy-I interface-j target

Where archy represents the name of the chain, interface specifies which network interface the rule is used for, and target is used to define the policy. To take a very simple example, the following command adds an INPUT chain rule that allows all link requests through the lo interface:

[root@localhost] # iptables-An INPUT-I lo-p ALL-j ACCEPT

Other options related to setting firewall rules, as shown in the following table:

The meaning of the option-p proto matches the network protocol: tcp, udp, icmp-icmp-type type match the ICMP type, used in conjunction with-p icmp. Notice that there are two dashes-s source-ip that match the IP address of the source host (or network)-sport port# matches the port of the source host and is used with-s source-ip. -d dest-ip matches the IP address of the target host-dport port# matches the port of the target host (or network) and is used in conjunction with-d dest-ip. Delete chain rule

Iptables provides the-D option to delete chain rules, and there are two different syntax for deleting a rule. Here are the most common methods:

First, use the iptables-L command with the-line-numbers option to view the number of the chain rule, as follows:

[root@localhost] # iptables-L-line-numbers

When you find the rule number, use the following command to delete the even rule:

[root@localhost] # iptables-D18 is the content of this article on "how to initialize a firewall with Iptables". I believe you all have some understanding. I hope the content shared by the editor will be helpful to you. If you want to know more about it, please follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.