Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 168)

168 Chapter 14. Firewalling with iptables

Regardless of their destination, when packets match a particular rule on one of the rule lists, they are

designated for a particular target or action to be applied to them. If the rule speciﬁes an ACCEPT

target for a matching packet, the packet skips the rest of the rule checks and is allowed to continue

to its destination. If a rule speciﬁes a DROP target, that packet is refused access to the system and

nothing is sent back to the host that sent the packet. If a rule speciﬁes a REJECT target, the packet is

dropped, but an error packet is sent to the packet’s originator.

Every chain has a default policy to ACCEPT, DROP, REJECT, or QUEUE the packet to be passed

to userspace. If none of the rules in the chain apply to the packet, then the packet is dealt with in

accordance with the default policy.

The iptables command allows you to conﬁgure these rule lists, as well as set up new tables to be

used for your particular situation.

14.2. Differences between iptables and ipchains

At ﬁrst glance, ipchains and iptables appear to be quite similar. After all, both methods of packet

ﬁltering use chains of rules operating within the Linux kernel to decide not only which packets to let

in or out, but also what to do with packets that match certain rules. However, iptables offers a much

more extensible way of ﬁltering packets, giving the administrator a greater amount of control without

building too much complexity into the entire system.

Speciﬁcally, users comfortable with ipchains should be aware of the following signiﬁcant differ-

ences between ipchains and iptables before attempting to use iptables:

• Under iptables, each ﬁltered packet is only processed using rules from one chain rather than

multiple chains. In other words, a FORWARD packet coming into a system using ipchains would

have to go through the INPUT, FORWARD, and OUTPUT chains in order to move along to its

destination. However, iptables only sends packets to the INPUT chain if they are destined for

the local system and only sends them to the OUTPUT chain if the local system generated the

packets. For this reason, you must be sure to place the rule designed to catch a particular packet in

the rule that will actually see the packet.

The advantage is that you now have more control over the disposition of each packet. If you are

attempting to block access to a particular website, it is now possible to block access attempts from

clients running on hosts which use your host as a gateway. An OUTPUT rule which denies access

will no longer prevent access for hosts which use your host as a gateway.

• The DENY target has been changed to DROP. In ipchains, packets that matched a rule in a

chain could be directed to the DENY target, which silently dropped the packet. This target must be

changed to DROP in iptables to have the same effect.

• Order matters when placing options in a rule. Previously, with ipchains, it did not matter very

much how you ordered the rule options. The iptables command is a bit pickier about where some

options may go. For example, you must now specify the source or destination port after the protocol

(ICMP, TCP, or UDP) to be used in a rule.

• When specifying network interfaces to be used with a rule, you must only use incoming interfaces

(-i option) with INPUT or FORWARD chains and outgoing interfaces (-o option) with FORWARD

or OUTPUT chains. This is necessary due to the fact that OUTPUT chains are no longer used by

incoming interfaces, and INPUT chains are not seen by packets moving through outgoing inter-

faces.

This is by no means a comprehensive list of the changes, given that iptables represents a funda-

mentally rewritten network ﬁlter in use with the kernel. For more speciﬁc information, consult the

Linux 2.4 Packet Filtering HOWTO and the sources found in Section 14.5.

1 2 ... 163 164 165 166 167 168 169 170 171 172 173 ... 281 282

Commenti su questo manuale

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 168

Commenti su questo manuale

Prodotti e manuali riguardandi Software di system management Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE