{"id":333,"date":"2019-09-03T09:08:49","date_gmt":"2019-09-03T07:08:49","guid":{"rendered":"https:\/\/privat.andreas-klingler.de\/itsec\/?p=333"},"modified":"2025-11-07T18:28:39","modified_gmt":"2025-11-07T17:28:39","slug":"iptables","status":"publish","type":"post","link":"https:\/\/infosec.andreas-klingler.de\/?p=333","title":{"rendered":"iptables \/ netfilter"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">Note that ipt\u00ada\u00adbles <strong>and<\/strong> ip6tables should be used always together!<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Tables<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Ipt\u00ada\u00adbles man\u00adages a set of <em>tables<\/em> which act as <span class=\"caps\">ACL<\/span> Access Con\u00adtrol&nbsp;Lists.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>fil\u00adter: default table&nbsp;<ul class=\"wp-block-list\">\n<li><strong><span class=\"caps\">INPUT<\/span><\/strong> han\u00addles all pack\u00adets <em>for<\/em> this system.<\/li>\n\n\n\n<li><strong><span class=\"caps\">OUTPUT<\/span><\/strong> han\u00addles all pack\u00adets <em>from<\/em> this system.<\/li>\n\n\n\n<li><strong><span class=\"caps\">FORWARD<\/span><\/strong> han\u00addles all pack\u00adets which are <em>not from nor for<\/em> this system.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>nat: table for net\u00adwork translation&nbsp;<ul class=\"wp-block-list\">\n<li><strong><span class=\"caps\">PREROUTING<\/span><\/strong> mod\u00adi\u00adfies pack\u00adets when they arrive.<\/li>\n\n\n\n<li><strong><span class=\"caps\">POSTROUTING<\/span><\/strong> mod\u00adi\u00adfies pack\u00adets before they leaving.<\/li>\n\n\n\n<li><strong><span class=\"caps\">OUTPUT<\/span><\/strong> mod\u00adi\u00adfies pack\u00adets which are <em>from<\/em> this system.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>man\u00adgle: table for manip\u00adu\u00adlat\u00ading packets<\/li>\n\n\n\n<li>raw: high-pri\u00ador\u00adi\u00adty table for super\u00adset oth\u00ader&nbsp;rules<\/li>\n\n\n\n<li>secu\u00adri\u00adty: addi\u00adtion\u00adal table for tools like SELinux.<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"910\" height=\"340\" src=\"https:\/\/infosec.andreas-klingler.de\/wp-content\/uploads\/2019\/09\/iptables.png\" alt class=\"wp-image-4904\" srcset=\"https:\/\/infosec.andreas-klingler.de\/wp-content\/uploads\/2019\/09\/iptables.png 910w, https:\/\/infosec.andreas-klingler.de\/wp-content\/uploads\/2019\/09\/iptables-300x112.png 300w, https:\/\/infosec.andreas-klingler.de\/wp-content\/uploads\/2019\/09\/iptables-768x287.png 768w\" sizes=\"auto, (max-width: 910px) 100vw, 910px\"><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Actions<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Actions are defined via the <strong>-j <\/strong>option.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong><span class=\"caps\">ACCEPT<\/span><\/strong> allows a packet<\/li>\n\n\n\n<li><strong><span class=\"caps\">REJECT<\/span><\/strong> rejects a packet<\/li>\n\n\n\n<li><strong><span class=\"caps\">DROP<\/span><\/strong> ignors a packet<\/li>\n\n\n\n<li><strong><span class=\"caps\">LOG<\/span><\/strong> logs a packet<\/li>\n\n\n\n<li><strong><span class=\"caps\">SNAT<\/span><\/strong> mod\u00adi\u00adfies the source address (only in the nat&nbsp;table)<\/li>\n\n\n\n<li><strong><span class=\"caps\">DNAT<\/span><\/strong> mod\u00adi\u00adfies the des\u00adti\u00adna\u00adtion address (only in the nat&nbsp;table)<\/li>\n\n\n\n<li><strong><span class=\"caps\">MASQUERADE<\/span><\/strong> mod\u00adi\u00adfies a pack\u00adet (only in the nat&nbsp;table)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Examples<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Show all&nbsp;rules<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">iptables -L<br>ip6tables -L<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Ignore all pack\u00adets from a network:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">iptables -A INPUT -s 192.168.5.1\/32 -j DROP<br>ip6tables -A INPUT -s fd75:943b:5f2e:0:a4:45a1:b753:4152 -j DROP<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Allow a spe\u00adcif\u00adic port from everywhere:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">iptables -A INPUT -p tcp --dport 80 --destination $LOCALIP -j ACCEPT<br>ip6tables -A INPUT -p tcp --dport 80 --destination $LOCALIP6 -j ACCEPT<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Allow only pack\u00adets which belong to an exist\u00ading connection:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">iptables -A INPUT --destination $LOCALIP -m state --state ESTABLISHED,RELATED -j ACCEPT<br>ip6tables -A INPUT --destination $LOCALIP6 -m state --state ESTABLISHED,RELATED -j ACCEPT<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Persist netfilter rules<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Via init script:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">vi \/etc\/systemd\/system\/iptables.service<br>---<br>[Unit]<br>After=network.target<br><br>[Service]<br>Type=simple<br>RemainAfterExit=yes<br>ExecStart=\/etc\/init.d\/iptables start<br>ExecStop=\/etc\/init.d\/iptables stop<br>ExecReload=\/etc\/init.d\/iptables restart<br><br>[Install]<br>WantedBy=multi-user.target<br>---<br>systemctl enable iptables<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Or via sys\u00adtemd \/ networkd:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">auto eth0<br>iface eth0 inet static<br>    ...<br>    up \/etc\/init.d\/iptables<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Measure traffic from\/to a location<\/h2>\n\n\n\n<pre class=\"wp-block-preformatted\">iptables -I INPUT 1 -s 10.10.10.10 -j ACCEPT\niptables -I OUTPUT 1 -d 10.10.10.10 -j ACCEPT\niptables -Z<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Now per\u00adform the actions. Then<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">iptables -nv -L<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Note that ipt\u00ada\u00adbles and ip6tables should be used always togeth\u00ader! Tables Ipt\u00ada\u00adbles man\u00adages a set of tables which act as <span class=\"caps\">ACL<\/span> Access Con\u00adtrol&nbsp;Lists. Actions Actions are defined via the \u2011j option. Exam\u00adples Show all&nbsp;rules ipt\u00ada\u00adbles \u2011Lip6tables \u2011L Ignore all pack\u00adets from a net\u00adwork: ipt\u00ada\u00adbles \u2011A <span class=\"caps\">INPUT<\/span> \u2011s 192.168.5.1\/32 \u2011j DROPip6tables \u2011A <span class=\"caps\">INPUT<\/span> \u2011s fd75:943b:5f2e:0:a4:45a1:b753:4152 \u2011j [\u2026]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"wp_typography_post_enhancements_disabled":false,"footnotes":""},"categories":[476,468],"tags":[93],"class_list":["post-333","post","type-post","status-publish","format-standard","hentry","category-defence-tool","category-general","tag-iptables"],"_links":{"self":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=333"}],"version-history":[{"count":7,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/333\/revisions"}],"predecessor-version":[{"id":4912,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=\/wp\/v2\/posts\/333\/revisions\/4912"}],"wp:attachment":[{"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/infosec.andreas-klingler.de\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}