Data Structure
Networking
RDBMS
Operating System
Java
MS Excel
iOS
HTML
CSS
Android
Python
C Programming
C++
C#
MongoDB
MySQL
Javascript
PHP
Physics
Chemistry
Biology
Mathematics
English
Economics
Psychology
Social Studies
Fashion Studies
Legal Studies
- Selected Reading
- UPSC IAS Exams Notes
- Developer's Best Practices
- Questions and Answers
- Effective Resume Writing
- HR Interview Questions
- Computer Glossary
- Who is Who
Learn How to Manage System Firewall using Iptables in Linux
Iptables and ip6tables are used to established, maintain, and check up on the tables of IPv4 and IPv6 packet filter ideas in the Linux kernel. Several distinct tables may be defined. Each table contains a quantity of constructed-in chains and may also contain person-outlined chains. Let us explore about how to manage a system firewall using Iptables in Linux.
Installing IP tables
To install IP tables, use the following command –
$sudo apt-get install iptables
The sample output should be like this –
Reading package lists... Done Building dependency tree Reading state information... Done The following packages were automatically installed and are no longer required: libecap3 squid-common squid-langpack Use 'sudo apt autoremove' to remove them. The following NEW packages will be installed: iptables 0 upgraded, 1 newly installed, 0 to remove and 261 not upgraded. Need to get 266 kB of archives. After this operation, 1,663 kB of additional disk space will be used. Get:1 http://in.archive.ubuntu.com/ubuntu xenial/main amd64 iptables amd64 1.6.0-2ubuntu3 [266 kB] ...........................................................................
IP tables help
To get more options about IP tables, use the following command –
$ iptables --help
The sample output should be like this –
iptables v1.6.0 Usage: iptables -[ACD] chain rule-specification [options] iptables -I chain [rulenum] rule-specification [options] iptables -R chain rulenum rule-specification [options] iptables -D chain rulenum [options] iptables -[LS] [chain [rulenum]] [options] iptables -[FZ] [chain] [options] iptables -[NX] chain iptables -E old-chain-name new-chain-name iptables -P chain target [options] iptables -h (print this help information) Commands: Either long or short options are allowed. --append -A chainAppend to chain --check -C chainCheck for the existence of a rule --delete -D chainDelete matching rule from chain --delete -D chain rulenum Delete rule rulenum (1 = first) from chain --insert -I chain [rulenum] Insert in chain as rulenum (default 1=first) --replace -R chain rulenum Replace rule rulenum (1 = first) in chain --list -L [chain [rulenum]] List the rules in a chain or all chains --list-rules -S [chain [rulenum]] ..............................................................................
Display the status of firewall
To display the status of firewall, use the following command –
$ sudo iptables -L -n -v
The sample output should be like this –
Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
Starting the firewall
To start the firewall, use the following command –
$ sudo service iptables start
Stopping the firewall
To stop the firewall, use the following command –
$ sudo service iptables stop
Restart the firewall
To Restart the firewall, use the following command –
$sudo service iptables restart
Block all Connections
To block all connections from the IP address, use the following command –
$ sudo iptables -A INPUT -s 100.100.100.100 -j DROP
In the above command, 100.100.100.100 is the example of an IP address.
Blocking a specific Site
To block specific site, use the following command –
$ sudo iptables -A OUTPUT -p tcp -d 100.100.100.100/20 -j DROP
In the above command, 100.100.100.100/20 is the port of particular IP address.
Example
For instance, for blocking a site named www.orkut.com, use the below command line –
$ sudo whois 104.198.199.158
In the above command, 104.198.199.158 indicates the ip of Orkut.com and the result should be like this –
...........................
NetRange: 104.196.0.0 - 104.199.255.255
CIDR: 104.196.0.0/14
NetName: GOOGLE-CLOUD
NetHandle: NET-104-196-0-0-1
Parent: NET104 (NET-104-0-0-0-0)
NetType: Direct Allocation
OriginAS: AS15169
Organization: Google Inc. (GOOGL-2)
RegDate: 2014-08-27
Updated: 2015-09-21
.................................................
Copy the CIDR and use the following command to block orkut.com as shown below –
$sudo iptables -A OUTPUT -p tcp -d 104.196.0.0/14 -j DROP
Saving rules
To save the above rule, use the following command –
$ sudo /sbin/iptables-save
The sample output should be like this –
# Generated by iptables-save v1.6.0 on Tue Jan 24 11:14:39 2017 *filter :INPUT ACCEPT [258:45283] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [233:43953] -A INPUT -s 10.10.10.10/32 -j DROP -A OUTPUT -d 104.196.0.0/14 -p tcp -j DROP -A OUTPUT -d 104.196.0.0/14 -p tcp -j DROP COMMIT # Completed on Tue Jan 24 11:14:39 2017
Block the incoming ping request
To block the incoming ping request, use the following command –
$ sudo iptables -A INPUT -p icmp -i eth0 -j DROP
Droping unused packets
To drop unused packets in IP tables, use the following command –
$sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
Block IP spoofing on public
To log and block IP spoofing on public, use the following command –
$sudo iptables -A INPUT -i eth1 -s 100.100.100.100/24 -j LOG --log-prefix "IP_SPOOF A:" $sudo iptables -A INPUT -i eth1 -s 10.0.0.0/8 -j DROP
Accepting the traffic from mac address
To accept the traffic from mac address, use the following command –
$sudo iptables -A INPUT -p tcp --destination-port 22 -m mac --mac-source 00:0F:EA:91:04:07 -j ACCEPT
Blocking the traffic from mac address
To block the traffic from mac address, use the following command –
$sudo iptables -A INPUT -m mac --mac-source 00:0F:EA:91:04:08 -j DROP
Accepting the open range of port
To accept the open range of port, use the following command-
$sudo iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 7000:7010 -j ACCEPT
Setting the HTTP request to iptables
To set the HTTP request to iptables, use the following command –
$ sudo iptables -p tcp --syn --dport 80 -m connlimit --connlimit-above 50 --connlimit-mask 24 -j DROP
In the above command, we have given 50 request permission.
Setting ssh connections per client host
To set ssh connections per client host, use the following command –
$sudo iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 10 -j REJECT
In the above command, we have given 10 ssh connections per client host.
Flusing the IP table rules
To flush the all IP table rules, use the following command –
$ sudo iptables --flush
In the above article, we have learnt about – Learn how to manage system firewall using iptables in Linux. In our next articles, we will come up with more Linux based tricks and tips. Keep reading.
271 Views
