7.2. Using IPTables
The first step in using IPTables is to start the IPTables service. This can be done with the command:
service iptables start |
 | Warning | |
|---|---|---|
The IP6Tables services should be turned off to use the IPTables service with the following commands:
|
To make IPTables start by default whenever the system is booted, you must change runlevel status on the service using chkconfig.
chkconfig --level 345 iptables on |
The syntax of IPTables is separated into tiers. The main tier is the chain. A chain specifies the state at which a packet will be manipulated. The usage is as follows:
iptables -A chain -j target |
The -A appends a rule at the end of an existing ruleset. The chain is the name of the chain for a rule. The three built-in chains of IPTables (that is, the chains that affect every packet which traverses a network) are INPUT, OUTPUT, and FORWARD. These chains are permanent and cannot be deleted.
 | Important | |
|---|---|---|
When creating an IPTables ruleset, it is critical to remember that order is important. For example, if a chain that specifies that any packets from the local 192.168.100.0/24 subnet be dropped, and then a chain is appended (-A) which allows packets from 192.168.100.13 (which is within the dropped restricted subnet), then the appended rule is ignored. You must set a rule to allow 192.168.100.13 first, and then set a drop rule on the subnet. To aribitrarily insert a rule in an existing chain of rules, use -I, followed by the chain in which you want to insert the rule, and a rule number (1,2,3,...,n) where you want to rule to reside. For example:
The rule is inserted as the first rule in the INPUT chain to allow local loopback device traffic. |
7.2.1. Basic Firewall Policies
Some basic policies established from the beginning can aid as a foundation for building more detailed, user-defined rules. IPTables uses policies (-P) to create default rules. Security-minded administrators usually elect to drop all packets as a policy and only allow specific packets on a case-by-case basis. The following rules block all incoming and outgoing packets on a network gateway:
iptables -P INPUT DROP iptables -P OUTPUT DROP |
Additionally, it is recommended that any forwarded packets — network traffic that is to be routed from the firewall to its destination node — be denied as well, to restrict internal clients from inadvertent exposure to the Internet. To do this, use the following rule:
iptables -P FORWARD DROP |
 | Note |
|---|---|
There is a distinction between the REJECT and DROP target actions when dealing with appended rules. The REJECT target denies access and returns a connection refused error to users who attempt to connect to the service. The DROP, as the name implies, drops the packet without any warning to telnet users. Administrators can use their own discretion when using these targets; however, to avoid user confusion and attempts to continue connecting, the REJECT target is recommended. |
After setting the policy chains, create new rules for your particular network and security requirements. The following sections outline some rules you may implement in the course of building your IPTables firewall.
7.2.2. Saving and Restoring IPTables Rules
Firewall rules are only valid for the time the computer is on. If the system is rebooted, the rules are automatically flushed and reset. To save the rules so that they will load later, use the following command:
/sbin/service iptables save |
The rules are stored in the file /etc/sysconfig/iptables and are applied whenever the service is started or restarted, including when the machine is rebooted.