Firewall functions: IPTABLES
U
SER
G
UIDE
173
In the case of the ICMP protocol (-p ICMP) the following extensions are valid:
--icmp-type type
Type
indicates the type of icmp packet to managed. It can be the numeric or the
symbolic value.
In order to list all the possible extensions for ICMP the command is:
iptables
–
p icmp --help
T
ARGETS
Each rule ends with a
target
which indicates what to do with the matching packet. The target
determines the interruption of the chain: the matching packet follows the directions of the target
and the following chains are not considered. The main targets are:
-j ACCEPT
Packet which satisfies the match criteria is accepted and carries on towards its
destination. It is used to define allowed traffic.
-j DROP
The packet is rejected and cancelled without any notification to the sender. It can be
used to block traffic in addition to
REJECT
.
-j REJECT
The packet is rejected. A notification packet (configurable), e.g. ICMP port-
unreachable, is sent to the sender:
--reject-with
icmp-port-unreachable
.
A list of the possible notifications can be displayed by using the command
iptables
–j REJECT –help
.
-j LOG
The packet is logged through syslog and moves on through the chains. Possible
options are:
--log-level
and
--log-prefix
-j DNAT
The destination IP of the packet is modified. The target is used only in NAT table
PREROUTING
and
OUTPUT
chains. The option
–to-destination IP:port
defines the new destination IP (and the new port). It is used to NAT a public address
towards a DMZ server.
-j SNAT
The source IP is modified. It is only used in NAT table
POSTROUTING
chains. It
contains the option
–to-source IP:port
. The port parameter is optional. It is
used to allow Internet access to a local network with private IPs.
-j MASQUERADE
As
SNAT
, it used when packets leaves an interface with dynamic address. It is used
in
POSTROUTING
chains of a NAT table.
-j REDIRECT
Redirects the packet to a local port on the router. It is used in
PREROUTING
and
OUTPUT
chains of a nat table.
-j TOS
It is used in a mangle table. It allows to change the TOS (Type Of Service) value of
the packet.
-j DSCP
It is used in a mangle table. It allows to modify the DSCP value of the IP header.
-j ECN
It is used in a mangle table in order to remove the ECN (Explicit Congestion
Notification) field from the TCP header. For example:
iptables -t mangle -A FORWARD -p tcp -j ECN --ecn-tcp-
remove
-j IPV4OPTSSTRIP
It is used in a mangle table in order to delete options in the IPv4 header:
iptables
–
t mangle
–
A FORWARD
–
j IPV4OPTSSTRIP
