What do you know about iptables?

Iptables is a command-line utility in Linux operating systems used for configuring the Linux kernel's packet filtering rules (netfilter). It operates at the network stack level, allowing to accept, drop, modify, or redirect network packets based on specified criteria.

Main concepts:

• Tables: Sets of rule chains. Main tables:
  • filter: Used for packet filtering (accept/drop).
  • nat: Used for network address translation (port forwarding, masquerading).
  • mangle: Used for modifying packet headers.
  • raw: Used for processing packets before connection tracking.
• Chains: Lists of rules that packets pass through. Each table has predefined chains (INPUT, OUTPUT, FORWARD), and custom chains can also be created.
  • INPUT: Packets destined for the local host.
  • OUTPUT: Packets generated by the local host.
  • FORWARD: Packets passing through the host (routing).
• Rules: Instructions defining what to do with a packet matching certain criteria (source/destination IP, port, protocol, etc.).
• Targets: Actions performed on packets matching a rule.
  • ACCEPT: Accept the packet.
  • DROP: Silently drop the packet.
  • REJECT: Drop the packet and send a notification to the sender (e.g., ICMP unreachable).
  • SNAT: Change the source IP address of the packet (in nat table).
  • DNAT: Change the destination IP address of the packet (in nat table).
  • MASQUERADE: Dynamic SNAT using the IP address of the outgoing interface (in nat table).

Examples of commands (filter table):

# Show current rules in the filter table
iptables -L

# Allow incoming SSH connections (port 22)
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Reject all other incoming traffic
iptables -A INPUT -j DROP

# Allow outgoing traffic
iptables -A OUTPUT -j ACCEPT

# Remove all rules in the filter table
iptables -F

# Set default policy for INPUT chain to DROP
iptables -P INPUT DROP

Examples of commands (nat table):

# Enable forwarding in the kernel
# sysctl net.ipv4.ip_forward=1
# Or via the /etc/sysctl.d/ file
# echo "net.ipv4.ip_forward = 1" > /etc/sysctl.d/99-sysctl.conf
# sysctl -p

# Masquerade outgoing traffic through interface eth0
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# DNAT: Redirect traffic from external port 80 to internal IP 192.168.1.10 on port 8080
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:8080

iptables rules are not saved automatically after reboot. Special utilities (iptables-save, iptables-restore) or third-party packages (iptables-persistent) are used for saving.

Iptables is a powerful tool for configuring network interaction and security at the kernel level, but for complex configurations, higher-level tools like firewalld or ufw, which often use iptables as a backend, may be more convenient. However, understanding iptables is critical for network diagnostics and fine-tuning in Linux.