Common routines of iptables

Common routines of iptables

[common routines in iptablesfilter tables]

(note: the following "[INPUT | FORWARD]" indicates INPUT or FORWARD)

# (1) improve firewall efficiency: existing connections are directly let go (mandatory and must be placed first)

Iptables-A [INPUT | FORWARD]-ptcp-mstate--stateESTABLISHED,RELATED-jACCEPT

# (2) Anti-* *: new connections in NEW status and tcp packets without syn bits are considered to be illegal tcp requests and are directly discarded (recommended)

# this anti-* policy is optional because security is relative, but it is recommended to add this policy.

Iptables-A [INPUT | FORWARD]-ptcphands Muhashi Muyashi state Mustang Mustang stateNEWMurjDROP

# (3) access control: only the specified port is allowed to access the local firewall or data flowing through the intranet (mandatory)

Iptables-A [INPUT | FORWARD]-ptcp-mmultiport--dport22,80443-jACCEPT

# (4) finally, set the default policy

Iptables-PINPUTDROP

Iptables-PFORWARDDROP

Iptables-POUTPUTACCEPT# note that OUTPUT is ACCEPT at this time, that is, all outgoing packets are allowed without blocking.

#

[common routines in nat tables]

# snat: source address translation, when the private network accesses the public network

Iptables-tnat-APOSTROUTING-o external network card-s internal network segment-jSNAT--to external network card ip

# or use MASQUEAGE to let netfilter choose the source ip based on the export ip.

Iptables-tnat-APOSTROUTING-o external network card-s internal network segment-jMASQUERADE

# dnat: target address translation, when the public network accesses the private network server

Iptables-tnat-APERROUTING-i external network card-d external network card ip-ptcp--dport80-jDNAT--to intranet server ip:80

#

[iptables policy save and restore]

Iptables-save > / etc/sysconfig/iptables

Iptables-restore