Tiesse Imola 0220, Руководство пользователя

Страница: 176 / 376

Firewall functions: IPTABLES
U
SER
G
UIDE
176
-m icmp
It has the same effect as the match
–p icmp
. The following option is available:
--icmp-type typename
The iptables
–m icmp --help
command shows all the possible
icmp-type
codes.
-m
ipv4options
Identifies packets according to options of the Ipv4 header. The following extensions are
available:
--ssrr
for Strict Source and Record Route
--lsrr
for Loose Source and Record Route
--rr
for Record Route
--ts
for Time Stamp
--ra
for Router Alert
e.g. to cancel packets with the RR option:
iptables – A FORWARD – m ipv4options – rr – j DROP
-m multiport
It allows to specify a list of ports (up to 15) with the same command, for example, in order
to accept packets addressed to ports
22
,
80
and
443
:
iptables – A FORWARD – p tcp – m multiport --dports 22,80,443 – j ACCEPT
The following options are available:
--dports
to indicate the destination ports
--sports
to indicate the source ports
--ports
to indicate both source and destination ports.
-m nth
It verifies the match every N packets, for example:
iptables – A FORWARD – p icmp – d 10.10.10.10 – m nth – -every 3 – j LOG
every 3 consecutive matches, a log are created.
-m psd
It controls Port Scanning. The following options are available:
--psd-delay-threshold delay in milliseconds
--psd-hi-ports-weight weight
--psd-lo-ports-weight weight
-m tos
It identifies packets according to the TOS value. The list of possible values can be
displayed with the command:
iptables -m tos – -help
For example:
iptables – A FORWARD – m tos --tos Minimize-Delay
counts all packets whose TOS value is set to Minimize-Delay (16).
-m ttl
Identifies packets according to the value of the TTL field:
iptables – A INPUT – m ttl --ttl 5
-m iprange
It allows to set a rule by using a range of IP addresses. For example, in order to block TCP
access to a range of IP addresses:
iptables – A INPUT – p tcp – m iprange --src-range 10.10.10.1-10.10.10.5 – j DROP
In order to avoid that icmp packets are sent to a range of IP addresses:
iptables – A OUTPUT – p icmp – m iprange --dst-range 10.10.1.0-10.10.1.5 – j DROP