What Is iptables?
Originally, the most popular firewall/NAT package running on Linux was ipchains previously, but it had a number of shortcomings. To rectify this, the Netfilter decided to create a new product called iptables, giving it such improvements such as:
1) Better integration with the Linux kernel with the capability of loading iptables-specific kernel modules designed for improved speed and reliability.
2) Stateful packet inspection. This means that the firewall keeps track of each connection passing through it and in certain cases will view the contents of data flows in an attempt to anticipate the next action of certain protocols. This is an important feature in the support of active FTP and DNS, as well as many other network services.
3) Filtering packets based on a MAC address and the values of the flags in the TCP header. This is helpful in preventing attacks using malformed packets and in restricting access from locally attached servers to other networks in spite of their IP addresses.
4) System logging that provides the option of adjusting the level of detail of the reporting.
5) A rate limiting feature that helps iptables block some types of denial of service (DoS) attacks.
6) Support for transparent integration with such Web proxy programs as Squid.
7) Better network address translation
Considered a faster and more secure alternative to ipchains, iptables has become the default firewall package installed under RedHat and Fedora Linux.
Download And Install The Iptables Package
Before you begin, you need to make sure that the iptables software RPM is installed. When searching for the RPMs, remember that the filename usually starts with the software package name by a version number, as in iptables-1.2.9-1.0.i386.rpm.
How To Start iptables
[[email protected]]# service iptables start
[[email protected]]# service iptables stop
[[email protected]]# service iptables restart
To get iptables configured to start at boot, use the chkconfig command:.
[[email protected]]# chkconfig iptables on
Determining The Status of iptables
You can determine whether iptables is running or not via the service iptables status command. Fedora Core will give a simple status message. For example
[[email protected]]# service iptables status
Firewall is stopped.
Packet Processing In iptables
All packets inspected by iptables pass through a sequence of built-in tables (queues) for processing. Each of these queues is dedicated to a particular type of packet activity and is controlled by an associated packet transformation/filtering chain.
There are three tables in total.
The first is the mangle table which is responsible for the alteration of quality of service bits in the TCP header. This is hardly used in a home or SOHO environment.
The second table is the filter queue which is responsible for packet filtering. It has three built-in chains in which you can place your firewall policy rules. These are the:
Input chain: Filters packets destined for the firewall.
Output chain: Filters packets originating from the firewall.
Forward chain: Filters packets to servers protected by the firewall.
The third table is the nat queue which is responsible for network address translation. It has two built-in chains; these are:
Pre-routing chain: NATs packets when the destination address of the packet needs to be changed.
Post-routing chain: NATs packets when the source address of the packet needs to be changed.