iptables

View All chains:

iptables -L -n -v --line-numbers

Delete Rule:

iptables -D INPUT 1

Delete whole chains rules:

iptables --flush CHAIN

Delete empty table:

iptables --delete-chain CHAIN

Create new chain:

iptables -N CHAIN

Examples of rules:

iptables -A INPUT -i tun0 -j deluge

iptables -A deluge -p TCP --dport 6881:6891 -j ACCEPT

iptables -A deluge -p UDP --dport 6881:6891 -j ACCEPT

iptables -A deluge -p TCP -m multiport --sports 80,6969 -j ACCEPT

iptables -A deluge -p UDP -m multiport --sports 80,6969 -j ACCEPT

iptables -A deluge -p ICMP -j ACCEPT

iptables -A deluge -j DROP

Get it to autoload rules in debian : http://www.debian-administration.org/articles/445

http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables#.UKQJqIc72nM

http://ubuntuforums.org/showthread.php?t=1431990

http://www.cyberciti.biz/faq/iptables-delete-ip-address-subnet-from-linux-firewall/

http://www.cyberciti.biz/tips/linux-iptables-how-to-specify-a-range-of-ip-addresses-or-ports.html

http://krnlpanic.com/tutorials/iptables.php

http://gr8idea.info/os/tutorials/security/iptables8.html

http://www.cyberciti.biz/tips/linux-iptables-examples.html

------------------------------------------

http://wiki.centos.org/HowTos/Network/IPTables

Now lets look at each of the 8 commands above in turn and understand exactly what we've just done:

    1. iptables -P INPUT ACCEPT If connecting remotely we must first temporarily set the default policy on the INPUT chain to ACCEPT otherwise once we flush the current rules we will be locked out of our server.

    2. iptables -F We used the -F switch to flush all existing rules so we start with a clean state from which to add new rules.

    3. iptables -A INPUT -i lo -j ACCEPT Now it's time to start adding some rules. We use the -A switch to append (or add) a rule to a specific chain, the INPUT chain in this instance. Then we use the -i switch (for interface) to specify packets matching or destined for the lo (localhost, 127.0.0.1) interface and finally -j (jump) to the target action for packets matching the rule - in this case ACCEPT. So this rule will allow all incoming packets destined for the localhost interface to be accepted. This is generally required as many software applications expect to be able to communicate with the localhost adaptor.

    4. iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT This is the rule that does most of the work, and again we are adding (-A) it to the INPUT chain. Here we're using the -m switch to load a module (state). The state module is able to examine the state of a packet and determine if it is NEW, ESTABLISHED or RELATED. NEW refers to incoming packets that are new incoming connections that weren't initiated by the host system. ESTABLISHED and RELATED refers to incoming packets that are part of an already established connection or related to and already established connection.

    5. iptables -A INPUT -p tcp --dport 22 -j ACCEPT Here we add a rule allowing SSH connections over tcp port 22. This is to prevent accidental lockouts when working on remote systems over an SSH connection. We will explain this rule in more detail later.

    6. iptables -P INPUT DROP The -P switch sets the default policy on the specified chain. So now we can set the default policy on the INPUT chain to DROP. This means that if an incoming packet does not match one of the following rules it will be dropped. If we were connecting remotely via SSH and had not added the rule above, we would have just locked ourself out of the system at this point.

    7. iptables -P FORWARD DROP Similarly, here we've set the default policy on the FORWARD chain to DROP as we're not using our computer as a router so there should not be any packets passing through our computer.

    8. iptables -P OUTPUT ACCEPT and finally, we've set the default policy on the OUTPUT chain to ACCEPT as we want to allow all outgoing traffic (as we trust our users).

    9. iptables -L -v Finally, we can list (-L) the rules we've just added to check they've been loaded correctly.

Finally, the last thing we need to do is save our rules so that next time we reboot our computer our rules are automatically reloaded:

# /sbin/service iptables save

This executes the iptables init script, which runs /sbin/iptables-save and writes the current iptables configuration to /etc/sysconfig/iptables. Upon reboot, the iptables init script reapplies the rules saved in /etc/sysconfig/iptables by using the /sbin/iptables-restore command.