1. iptables allows setup of *stateful* firewalls. This means that the firewall has a memory of each connection passing through it. This mode is essential for effective configuration of FTP (active ftp) and DNS as well as many other network services.
2. iptables can filter packets based on any combination of TCP flags and also based on MAC (i.e. hardware) addresses, which can be sometimes helpful for firewalls within LANs
3. System logging is much more configurable and flexible than with ipchains
4. Netfilter now has more powerful and easy to use support for network address translation (NAT) and transparent proxies.
5. iptables can help block some DoS attacks by using the rate limiting for user-defined packet types that can sometimes block SYN floods (makes a nice addition for SYN cookies for host-based protection)
Hope it helps

Leave a comment: