Korenix JetBox5400 series, Руководство пользователя, Страница: 28 / 73

28 Network Feature | Korenix
iptables splits the packet handling into three different tables, each of which contain a number
of chains. The firewalling rules, which we create, are included within a particular chain. The
three tables are:
1. filter : used for packet filtering
2. nat : used to provide packet modification capabilities; NAT/PAT and IP masquerading
3. mangle : used for setting packet options and marking packets for further filtering or
routing
The filter table is the default table for any rule. It is where the bulk of the work in an iptables
firewall occurs. This table contains three chains:
1. INPUT: used for traffic which is entering our system and belongs to an IP address which
is on our local machine
2. OUTPUT: used for traffic which originated on the local system, otherwise known as the
firewall
3. FORWARD: used for traffic which is being routed between two network interfaces on
our firewall
There are three main targets for a rule within the filter table.
1. ACCEPT: allows the packet to be passed through the firewall without any noticeable
interaction
2. DROP: simply drops the packet as if it has never been in the system
3. REJECT: drops the packet then sends a ICMP reply back to the client telling it why the
connection failed
Example:
Add rules
The basic syntax of an iptables command is:
iptables -A INPUT -s 192.168.20.0/24 -j ACCEPT
This would add a rule into the INPUT chain, which matches any packet with a source address in
the 192.168.20.0 subnet. If a packet matches this criteria, then it would use the ACCEPT target,
which simply allows the packet on through.
Remove rules
To delete the first rule in the chain, we would do:
iptables -D INPUT 1
List rules
To list the rules we have on our system use:
iptables -L