Questions tagged [iptables]

iptables allow creation of rules to define packet filtering behavior. The most reliable way to provide an iptables ruleset in a question is with the output of (as root): iptables-save -c

According to Wikipedia:

iptables is a user space application program that allows a system administrator to configure the tables provided by the Linux kernel firewall (implemented as different Netfilter modules) and the chains and rules it stores. Different kernel modules and programs are currently used for different protocols; iptables applies to IPv4, ip6tables to IPv6, arptables to ARP, and ebtables for Ethernet frames.

Iptables requires elevated privileges to operate and must be executed by user root, otherwise it fails to function. On most Linux systems, iptables is installed as /usr/sbin/iptables and documented in its man page [2], which can be opened using man iptables when installed. It may also be found in /sbin/iptables, but since iptables is not an "essential binary", but more like a service, the preferred location remains /usr/sbin.

iptables is also commonly used to inclusively refer to the kernel-level components. x_tables is the name of the kernel module carrying the shared code portion used by all four modules that also provides the API used for extensions; subsequently, Xtables is more or less used to refer to the entire firewall (v4,v6,arp,eb) architecture.

2655 questions
190
votes
8 answers

Viewing all iptables rules

Is there a way to view iptables rules in a bit more detail? I recently added masquerade to a range of IPs: iptables -t nat -A POSTROUTING -s 10.8.0.0/24 -o eth0 -j MASQUERADE service iptables save service iptables restart Which has done what I want…
109
votes
2 answers

What is the difference between -m conntrack --ctstate and -m state --state

I'm reading this howto, and there's something like this: We can allow established sessions to receive traffic: $ sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT The above rule has no spaces either side of the comma in…
38
votes
1 answer

iptables and RETURN target

I don't understand what the RETURN target does in a iptables command. The doubt comes from this guide where it says: A chain is a set of rules that a packet is checked against sequentially. When the packet matches one of the rules, it executes the…
zer0uno
  • 1,283
38
votes
2 answers

What do numbers in INPUT,FORWARD,OUTPUT chains mean in iptables config file?

I came across the following config file: # Generated by iptables-save v1.3.1 on Sun Apr 23 06:19:53 2006 *filter :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374] -A INPUT -i lo -j ACCEPT -A INPUT -m conntrack…
27
votes
2 answers

iptables does not list rules i have created

I'm using this guide to set-up a shared internet connection between two PC's. At step 8 it says I should run the commands: iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE /etc/rc.d/iptables save /etc/rc.d/iptables start Doing this seems to…
Stefan
  • 25,300
26
votes
5 answers

Move iptables rule (w/o removing and adding)

Is there a way to move a rule in the iptables and change it position ? I'm aware i can use -I to insert a rule in a specific position, but i also like to keep the counters.
Rabin
  • 3,883
  • 1
  • 22
  • 23
19
votes
1 answer

iptables forward all traffic to interface

I have two interfaces eth1 and eth0. I want all traffic on eth0to be forwarded to eth1. I created an iptable rule like this: iptables -A FORWARD -s 0/0 -i eth0 -p tcp -o eth1 -j ACCEPT But this doesn't work. Is this the correct way of doing this?
user110
  • 193
16
votes
1 answer

How to reset all iptables settings?

Are there any simpler commands to these? (e.g.: a oneliner? can one command reset iptables/netfilter settings to this?) IPTABLES="$(which iptables)" # RESET DEFAULT POLICIES $IPTABLES -P INPUT ACCEPT $IPTABLES -P FORWARD ACCEPT $IPTABLES -P OUTPUT…
LanceBaynes
  • 40,135
  • 97
  • 255
  • 351
15
votes
2 answers

IPTables rule to allow incoming SSH connections

The aim of this script is to only allow traffic over the VPN, except for localhost<->localhost and incoming SSH traffic. But when I run the script over SSH I am disconnected and forced to restart the vm. What is wrong with my…
Steven
  • 153
13
votes
1 answer

What are the definitions of addrtype in iptables?

I am keen to use addrtype in combination with -src as a rule in one of my filter chain like so to drop some bogon ips: -A INPUT -p tcp --dport 80 -m addrtype --src-type UNICAST ! -s 127.0.0.0/8 -j WEB The man page says the following addrtype This…
12
votes
2 answers

iptables: recent module

I am using the "recent" module to prevent port scanning, such as: -A INPUT -i eth0 -m recent --name PORTSCAN --update --seconds 60 -j DROP -A INPUT -i eth0 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -m recent --name PORTSCAN --set -j…
user1968963
  • 4,083
12
votes
3 answers

How to view all iptables tables?

According to https://www.thegeekstuff.com/2011/01/iptables-fundamentals/ IPTables has the following 4 built-in tables. Filter, NAT, Mangle, and Raw table What is the iptables command to view all these tables?
Wolf
  • 1,631
12
votes
1 answer

What do the numbers in brackets mean on the iptables-save output?

What do the [368:102354], [0:0] and [92952:20764374] in my iptables output file mean? :INPUT ACCEPT [368:102354] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [92952:20764374]
11
votes
1 answer

What is a chain in iptables?

Iptables is used to set up, maintain, and inspect the tables of IPv4 packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined…
Tim
  • 101,790
11
votes
1 answer

What is the purpose of -m, --match in an Iptables rule?

Many Iptables rules contain this -m or --match option, for example -I INPUT -p tcp -m state --state NEW -m limit --limit 30/minute --limit-burst 5 -j ACCEPT -A INPUT -p udp -m conntrack --ctstate NEW -j UDP -A INPUT -p tcp -m tcp --tcp-flags…
1
2 3
15 16