<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'"><SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">#
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">Generated by iptables-save v1.2.6a on Wed Apr 24 <st1:time Hour="10" Minute="19"><SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">10:19:17</st1:time><SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'"> 2002
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">*nat
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">:PREROUTING ACCEPT [0:0]
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'"><SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">:POSTROUTING ACCEPT [3:450]
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">:OUTPUT ACCEPT [3:450]
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">COMMIT
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'"># Completed on Wed Apr 24 <st1:time Hour="10" Minute="19"><SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">10:19:17</st1:time><SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'"> 2002 <o:p></o:p>
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'"><SPAN style="mso-spacerun: yes"> <o:p></o:p>
This contains a few comments starting with a # sign. Each table is marked like *<table-name>, for example *mangle. Then within each table we have the chain specifications and rules. A chain specification looks like:
<chain-name> <chain-policy> [<packet-counter>:<byte-counter>].
The chain-name may be for example PREROUTING, the policy is described previously and can for example be ACCEPT. Finally the packet-counter and byte-counters are the same counters as in the output from iptables -L -v. Finally, each table declaration ends in a COMMIT keyword. The COMMIT keyword tells us that at this point we should commit all rules currently in the pipeline to kernel.
To save it into any file, it is only a matter of piping the command output on to the file that you would like to save it as. This could look like the following:
<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'"><SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">iptables-save -c > /etc/iptables-save<SPAN style="FONT-FAMILY: Arial; mso-bidi-font-family: 'Times New Roman'">
The above command will in other words save the whole rule-set to a file called /etc/iptables-save with byte and packet counters still intact.
The iptables-restore command is used to restore the iptables rule-set that was saved with the iptables-save command. It takes all the input from standard input and can not load from files as of writing this, unfortunately. This is the command syntax for iptables-restore:
<SPAN style="LETTER-SPACING: 0pt"><SPAN style="LETTER-SPACING: 0pt">iptables-restore [-c] [-n]
The -c argument restores the byte and packet counters and must be used if you want to restore counters that were previously saved with iptables-save. This argument may also be written in its long form --counters.
The -n argument tells iptables-restore to not overwrite the previously written rules in the table, or tables, that it is writing to. The default behavior of iptables-restore is to flush and destroy all previously inserted rules. The short -n argument may also be replaced with the longer format --noflush.
To load rule-set with the iptables-restore command, we could do this in several ways, but we will mainly look at the simplest and most common way here.
<SPAN style="LETTER-SPACING: 0pt"><SPAN style="LETTER-SPACING: 0pt">cat /etc/iptables-save | iptables-restore -c
This would cat the rule-set located within the /etc/iptables-save file and then pipe it to iptables-restore which takes the rule-set on the standard input and then restores it, including byte and packet counters. It is that simple to begin with.
The rule-set should now be loaded properly to kernel and everything should work. If not, you may possibly have run into a bug in these commands, however likely that sounds.
The example given below makes everything clear :
For instance, if your computer was to send out a packet to http://www.yahoo.com/
To request an HTML page, it would first pass through the OUTPUT chain. The kernel would look through the rules in the chain and see if any of them match. The first one that matches will decide the outcome of that packet. If none of the rules match, then the policy of the whole chain will be the final decision maker. Then whatever reply Yahoo! sent back would pass through the INPUT chain. It's no more complicated than that.
Now that we have the basics out of the way, we can start working on putting all this to practical use. Suppose you wanted to block all packets coming from 200.200.200.1. First of all, -s is used to specify a source IP or DNS name. So from that, to refer to traffic coming from this address, we'd use this:
iptables -s 200.200.200.1
But that doesn't tell what to do with the packets. The -j option is used to specify what happens to the packet. The most common three are ACCEPT, DENY, and DROP. Now you can probably figure out what ACCEPT does and it's not what we want. DENY sends a message back that this computer isn't accepting connections. DROP just totally ignores the packet. If we're really suspicious about this certain IP address, we'd probably prefer DROP over DENY. So here is the command with the result:
iptables -s 200.200.200.1 -j DROP
But the computer still won't understand this. There's one more thing we need to add and that's which chain it goes on. You use -A for this. It just appends the rule to the end of whichever chain you specify. Since we want to keep the computer from talking to us, we'd put it on INPUT. So here's the entire command:
iptables -A INPUT -s 200.200.200.1 -j DROP
This single command would ignore everything coming from 200.200.200.1 (with exceptions, but we'll get into that later). The order of the options doesn't matter; the -j DROP could go before -s 200.200.200.1. I just like to put the outcome part at the end of the command. Ok, we're now capable of ignoring a certain computer on a network. If you wanted to keep your computer from talking to it, you'd simply change INPUT to OUTPUT and change the -s to -d for destination. Now that's not too hard, is it?
So what if we only wanted to ignore telnet requests from this computer? Well that's not very hard either. You might know that port 23 is for telnet, but you can just use the word telnet if you like. There are at least 3 protocols that can be specified: TCP, UDP, and ICMP. Telnet, like most services, runs on TCP so we're going with it. The -p option specifies the protocol. But TCP doesn't tell it everything; telnet is only a specific protocol used on the larger protocol of TCP. After we specify that the protocol is TCP, we can use --destination-port to denote the port that they're trying to contact us on. Make sure you don't get source and destination ports mixed up. Remember, the client can run on any port, it's the server that will be running the service on port 23. Any time you want to block out a certain service, you'll use --destination-port. The opposite is --source-port in case you need it. So let's put this all together. This should be the command that accomplishes what we want:
iptables -A INPUT -s 200.200.200.1 -p tcp --destination-port telnet -j DROP
And there you go. If you wanted to specify a range of IP's, you could use 200.200.200.0/24. This would specify any IP that matched 200.200.200.*. Now it's time to fry some bigger fish. Let's say that, like me, you have a local area network and then you have a connection to the internet. We're going to also say that the LAN is eth0 while the internet connection is called ppp0. Now suppose we wanted to allow telnet to run as a service to computers on the LAN but not on the insecure internet. Well there is an easy way to do this. We can use -i for the input interface and -o for the output interface. You could always block it on the OUTPUT chain, but we'd rather block it on the INPUT so that the telnet daemon never even sees the request. Therefore we'll use -i. This should set up just the rule:
iptables -A INPUT -p tcp --destination-port telnet -i ppp0 -j DROP
So this should close off the port to anyone on the internet yet kept it open to the LAN. Now before we go on to more intense stuff, I'd like to briefly explain other ways to manipulate rules. The -A option appends a rule to the end of the list, meaning any matching rule before it will have say before this one does. If we wanted to put a rule before the end of the chain, we use -I for insert. This will put the rule in a numerical location in the chain. For example, if we wanted to put it at the top of the INPUT chain, we'd use "-I INPUT 1" along with the rest of the command. Just change the 1 to whatever place you want it to be in.
Now let's say we wanted to replace whatever rule was already in that location. Just use -R to replace a rule. It has the same syntax as -I and works the same way except that it deletes the rule at that position rather than bumping everything down. And finally, if you just want to delete a rule, use -D. This also has a similar syntax but you can either use a number for the rule or type out all the options that you would if you created the rule. The number method is usually the optimal choice. There are two more simple options to learn though. -L lists all the rules set so far. This is obviously helpful when you forget where you're at. AND -F flushes a certain chain. (It removes all of the rules on the chain.) If you don't specify a chain, it will basically flush everything.
Well let's get a bit more advanced. We know that these packets use a certain protocol, and if that protocol is TCP, then it also uses a certain port. Now you might be compelled to just close all ports to incoming traffic, but remember, after your computer talks to another computer, that computer must talk back. If you close all of your incoming ports, you'll essentially render your connection useless. And for most non-service programs, you can't predict which port they're going to be communicating on.
But there's still a way. Whenever two computers are talking over a TCP connection, that connection must first be initialized. This is the job of a SYN packet. A SYN packet simply tells the other computer that it's ready to talk. Now only the computer requesting the service sends a SYN packet.
So if you only block incoming SYN packets, it stops other computers from opening services on your computer but doesn't stop you from communicating with them. It roughly makes your computer ignore anything that it didn't speak to first. It's mean but it gets the job done. Well the option for this is --syn after you've specified the TCP protocol. So to make a rule that would block all incoming connections on only the internet:
iptables -A INPUT -i ppp0 -p tcp --syn -j DROP
That's a likely rule that you'll be using unless you have a web service running. If you want to leave one port open, for example 80 (HTTP), there's a simple way to do this too. As with many programming languages, an exclamation mark means not. For instance, if you wanted to block all SYN packets on all ports except 80, I believe it would look something like this:
iptables -A INPUT -i ppp0 -p tcp --syn --destination-port ! 80 -j DROP
It's somewhat complicated but it's not so hard to comprehend. There's one last thing I'd like to cover and that's changing the policy for a chain. The chains INPUT and OUTPUT are usually set to ACCEPT by default and FORWARD is set to DENY. Well if you want to use this computer as a router, you would probably want to set the FORWARD policy to ACCEPT. Well it's really very simple as to how we do this. All you have to do is use the -P option. Just follow it by the chain name and the new policy and you have it made. To change the FORWARD chain to an ACCEPT policy, we'd do this:
iptables -P FORWARD ACCEPT
