IPTables - Revision history

Leo at 01:22, 12 March 2022

2022-03-12T01:22:45Z

← Older revision		Revision as of 01:22, 12 March 2022
Line 94:		Line 94:
	\| code = $ iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.2.3.4:443		\| code = $ iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.2.3.4:443
	$ iptables -t nat -A POSTROUTING -j MASQUERADE		$ iptables -t nat -A POSTROUTING -j MASQUERADE
			\| lang = terminal
			}}

			=== Mapping incoming traffic to a different internal port ===
			If you have a non-root process that should be exposed on a low port (such as port 80 or 443), you can use IPTables to forward incoming traffic to the high port.
			{{Highlight
			\| code = # iptables -t nat -I PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
	\| lang = terminal		\| lang = terminal
	}}		}}

Leo at 23:25, 12 January 2022

2022-01-12T23:25:14Z

← Older revision		Revision as of 23:25, 12 January 2022
Line 51:		Line 51:
	}}		}}

	==Flushing IPTables==		===Flushing IPTables===
	{{Highlight		{{Highlight
	\| code = # Sets default policy to accept		\| code = # Sets default policy to accept
Line 167:		Line 167:
	===Blocking traffic by IP===		===Blocking traffic by IP===
	See also: [[ipset]]		See also: [[ipset]]

			=== Add a firewall rule at a specific position in a chain ===
			Use <code>-I $chain</code> to insert into a specific chain, followed by the line number. For example, if I wanted to add a rule to the 10th line of the INPUT chain:
			{{Highlight
			\| code = # iptables -I INPUT 10 -p tcp -m tcp --dport 8080 -j ACCEPT
			\| lang = terminal
			}}

	===Dropping all UDP for a specific host===		===Dropping all UDP for a specific host===

Leo at 20:57, 27 January 2021

2021-01-27T20:57:57Z

@@ Line 7: / Line 7: @@
 #mangle
 #destination / NAT
 ===Drop RFC3330===
@@ Line 49: / Line 51: @@
 }}
-==Tasks==
+==Flushing IPTables==
 ===Redirect outgoing traffic to a local port===
@@ Line 150: / Line 176: @@
 }}
-=== Make IPTable rules persistent ===
+===Make IPTable rules persistent===
 On CentOS 8, install the <code>iptables-services</code> package. Persist your existing rules by dumping your rules into <code>/etc/sysconfig/iptables</code>.
 {{Highlight

Leo at 20:48, 27 January 2021

2021-01-27T20:48:06Z

← Older revision		Revision as of 20:48, 27 January 2021
Line 49:		Line 49:
	}}		}}

	== Tasks ==		==Tasks==

	===Redirect outgoing traffic to a local port===		===Redirect outgoing traffic to a local port===
Line 148:		Line 148:
	root@DD-WRT:~# iptables -A OUTPUT -p udp -d 10.1.1.22 -j DROP		root@DD-WRT:~# iptables -A OUTPUT -p udp -d 10.1.1.22 -j DROP
	root@DD-WRT:~# iptables -A INPUT -p udp -s 10.1.1.22 -j DROP		root@DD-WRT:~# iptables -A INPUT -p udp -s 10.1.1.22 -j DROP
			}}

			=== Make IPTable rules persistent ===
			On CentOS 8, install the <code>iptables-services</code> package. Persist your existing rules by dumping your rules into <code>/etc/sysconfig/iptables</code>.
			{{Highlight
			\| code = # iptables-save > /etc/sysconfig/iptables
			\| lang = terminal
	}}		}}

Leo at 20:44, 27 January 2021

2021-01-27T20:44:50Z

← Older revision		Revision as of 20:44, 27 January 2021
Line 49:		Line 49:
	}}		}}

	==Redirect ~~Outgoing Traffic~~ to ~~Local Port~~==		== Tasks ==

			===Redirect outgoing traffic to a local port===

	To redirect traffic destined to 1.2.3.4:443 to localhost:8080 (ie: Serving https/443 to an internal service listening on 8080), use the REDIRECT directive:		To redirect traffic destined to 1.2.3.4:443 to localhost:8080 (ie: Serving https/443 to an internal service listening on 8080), use the REDIRECT directive:
Line 61:		Line 63:
	}}		}}

	== Redirect incoming traffic to an external host ==		===Redirect incoming traffic to an external host===
	To redirect incoming traffic on a specific port to an external server (such as after migrating services to another host, or ghetto load balancing):		To redirect incoming traffic on a specific port to an external server (such as after migrating services to another host, or ghetto load balancing):
	{{Highlight		{{Highlight
Line 69:		Line 71:
	}}		}}

	==Delete a ~~Specific Rule~~ in a ~~Chain~~==		===Delete a specific rule in a chain===
	Suppose I have the following chain and rules:		Suppose I have the following chain and rules:
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
Line 95:		Line 97:
	}}		}}

	==Cluster IP==		===Cluster IP===
	To create a clustered IP address:		To create a clustered IP address:

Line 113:		Line 115:
	}}		}}

	===See Also===		====See Also====

	*http://security.maruhn.com/iptables-tutorial/x8906.html		*http://security.maruhn.com/iptables-tutorial/x8906.html
Line 119:		Line 121:
	*http://serverfault.com/questions/623221/iptable-clusterip-doesnt-work		*http://serverfault.com/questions/623221/iptable-clusterip-doesnt-work

	==Port Mirroring / IPTables Tee==		===Port Mirroring / IPTables Tee===
	An IPTables / netfilter Tee rule mirrors traffic to a specific port or IP address. It is analogous to mirroring a port on a managed switch or router.		An IPTables / netfilter Tee rule mirrors traffic to a specific port or IP address. It is analogous to mirroring a port on a managed switch or router.

Line 127:		Line 129:
	root@DD-WRT:~# iptables -I POSTROUTING -t mangle -j ROUTE --gw 10.1.1.143 --tee		root@DD-WRT:~# iptables -I POSTROUTING -t mangle -j ROUTE --gw 10.1.1.143 --tee
	}}		}}
			===Port forwarding===
			Suppose you have a gateway machine running Linux and you wish to forward traffic between the internal NAT and the outside world through this gateway.
	==Port ~~Forwarding~~==
	Suppose you have a gateway ~~using IPTables~~ to forward traffic between the NAT and the outside world.

	To forward ports to a specific host inside your NAT, append to the {{code\|PREROUTING}} table:		To forward ports to a specific host inside your NAT, append to the {{code\|PREROUTING}} table:
Line 139:		Line 139:
	}}		}}

	==Blocking ~~Traffic~~ by IP==		===Blocking traffic by IP===
	See also: [[ipset]]		See also: [[ipset]]

	~~==Other Tasks==~~		===Dropping all UDP for a specific host===
	===Dropping ~~All~~ UDP for a specific host===
	If a machine is spamming UDP packets, you may want to block it at the firewall.		If a machine is spamming UDP packets, you may want to block it at the firewall.

Leo: /* redirect incoming traffic */

2021-01-27T17:05:17Z

redirect incoming traffic

← Older revision		Revision as of 17:05, 27 January 2021
Line 1:		Line 1:

	== Prerouting Chain ==		==Prerouting Chain==
	This is the first chain that traffic will go through. It contains the following tables:		This is the first chain that traffic will go through. It contains the following tables:
	~~# raw~~
	~~# connection tracking~~
	~~# mangle~~
	~~# destination / NAT~~

	=== Drop RFC3330 ===		#raw
			#connection tracking
			#mangle
			#destination / NAT

			===Drop RFC3330===
	You may wish to drop Special-Use IP addresses defined in RFC 3330. These IPs include internally routed addresses such as 192.168.0.0/16, 10.0.0.0/8, etc., black-hole addresses such as 0.0.0.0, and multicast addresses such as 224.0.0.0/4. There should be no reason for these addresses to be coming in externally and when it does happen, it's probably a spoofed address.		You may wish to drop Special-Use IP addresses defined in RFC 3330. These IPs include internally routed addresses such as 192.168.0.0/16, 10.0.0.0/8, etc., black-hole addresses such as 0.0.0.0, and multicast addresses such as 224.0.0.0/4. There should be no reason for these addresses to be coming in externally and when it does happen, it's probably a spoofed address.

Line 48:		Line 49:
	}}		}}

	== Redirect Outgoing Traffic to Local Port ==		==Redirect Outgoing Traffic to Local Port==

	To redirect traffic destined to 1.2.3.4:443 to localhost:8080 (ie: Serving https/443 to an internal service listening on 8080), use the REDIRECT directive:		To redirect traffic destined to 1.2.3.4:443 to localhost:8080 (ie: Serving https/443 to an internal service listening on 8080), use the REDIRECT directive:
Line 60:		Line 61:
	}}		}}

	== Delete a Specific Rule in a Chain ==		== Redirect incoming traffic to an external host ==
			To redirect incoming traffic on a specific port to an external server (such as after migrating services to another host, or ghetto load balancing):
			{{Highlight
			\| code = $ iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 10.2.3.4:443
			$ iptables -t nat -A POSTROUTING -j MASQUERADE
			\| lang = terminal
			}}

			==Delete a Specific Rule in a Chain==
	Suppose I have the following chain and rules:		Suppose I have the following chain and rules:
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
Line 86:		Line 95:
	}}		}}

	== Cluster IP ==		==Cluster IP==
	To create a clustered IP address:		To create a clustered IP address:

Line 104:		Line 113:
	}}		}}

	=== See Also ===		===See Also===
	* http://security.maruhn.com/iptables-tutorial/x8906.html
	* http://www.bertera.it/index.php/2011/10/04/howto-configure-multiple-mac-address-over-a-single-ethernet-interface/
	* http://serverfault.com/questions/623221/iptable-clusterip-doesnt-work

	== Port Mirroring / IPTables Tee ==		*http://security.maruhn.com/iptables-tutorial/x8906.html
			*http://www.bertera.it/index.php/2011/10/04/howto-configure-multiple-mac-address-over-a-single-ethernet-interface/
			*http://serverfault.com/questions/623221/iptable-clusterip-doesnt-work

			==Port Mirroring / IPTables Tee==
	An IPTables / netfilter Tee rule mirrors traffic to a specific port or IP address. It is analogous to mirroring a port on a managed switch or router.		An IPTables / netfilter Tee rule mirrors traffic to a specific port or IP address. It is analogous to mirroring a port on a managed switch or router.

Line 119:		Line 129:


	== Port Forwarding ==		==Port Forwarding==
	Suppose you have a gateway using IPTables to forward traffic between the NAT and the outside world.		Suppose you have a gateway using IPTables to forward traffic between the NAT and the outside world.

Line 129:		Line 139:
	}}		}}

	== Blocking Traffic by IP ==		==Blocking Traffic by IP==
	See also: [[ipset]]		See also: [[ipset]]

	== Other Tasks ==		==Other Tasks==
	=== Dropping All UDP for a specific host ===		===Dropping All UDP for a specific host===
	If a machine is spamming UDP packets, you may want to block it at the firewall.		If a machine is spamming UDP packets, you may want to block it at the firewall.

Line 141:		Line 151:
	}}		}}

	== See Also ==		==See Also==
	* A book on IPTables - https://book.huihoo.com/iptables-tutorial/book1.htm
			*A book on IPTables - https://book.huihoo.com/iptables-tutorial/book1.htm


	{{Navbox Linux}}[[Category:Linux]]		{{Navbox Linux}}
			[[Category:Linux]]
	[[Category:IPTables]]		[[Category:IPTables]]
	[[Category:Networking]]		[[Category:Networking]]

Leo: /* Other Tasks */

2020-06-15T02:33:50Z

Other Tasks

← Older revision		Revision as of 02:33, 15 June 2020
Line 140:		Line 140:
	root@DD-WRT:~# iptables -A INPUT -p udp -s 10.1.1.22 -j DROP		root@DD-WRT:~# iptables -A INPUT -p udp -s 10.1.1.22 -j DROP
	}}		}}

			== See Also ==
			* A book on IPTables - https://book.huihoo.com/iptables-tutorial/book1.htm

Leo: Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

2019-09-01T06:21:13Z

Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

← Older revision		Revision as of 06:21, 1 September 2019
Line 142:		Line 142:


	[[Category:Linux]]~~{{Navbox Linux}}~~		{{Navbox Linux}}[[Category:Linux]]
	[[Category:IPTables]]		[[Category:IPTables]]
	[[Category:Networking]]		[[Category:Networking]]

Leo: Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

2019-09-01T05:10:59Z

Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

← Older revision		Revision as of 05:10, 1 September 2019
Line 142:		Line 142:


	[[Category:Linux]]~~{{Navbox Linux}}~~{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}
	[[Category:IPTables]]		[[Category:IPTables]]
	[[Category:Networking]]		[[Category:Networking]]

Leo: Text replacement - "Category:Linux" to "Category:Linux{{Navbox Linux}}"

2019-09-01T05:09:17Z

Text replacement - "Category:Linux" to "Category:Linux{{Navbox Linux}}"

← Older revision		Revision as of 05:09, 1 September 2019
Line 142:		Line 142:


	[[Category:Linux]]{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}{{Navbox Linux}}
	[[Category:IPTables]]		[[Category:IPTables]]
	[[Category:Networking]]		[[Category:Networking]]