Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 171)

Chapter 14. Firewalling with iptables 171

• -d — Sets the destination hostname, IP address, or network of a packet that will match the rule.

When matching a network, you can use two different methods for signifying the netmasks, such as

192.168.0.0/255.255.255.0 or 192.168.0.0/24.

• -f — Applies this rule only to fragmented packets.

By using the ! option after this parameter, only unfragmented packets will be matched.

• -i — Sets the incoming network interface, such as eth0 or ppp0, to use with a particular rule.

With iptables, this optional parameter may only be used with the INPUT and FORWARD chains

when used with the filter table and the PREROUTING chain with the nat and mangle tables.

This parameter features several useful options that may be used before specifying the name of an

interface:

• ! — Tells this parameter not to match, meaning that any speciﬁed interfaces are speciﬁcally

excluded from this rule.

• + — A wildcard character used to match all interfaces that match a particular string. For example,

the parameter -i eth+ would apply this rule to any Ethernet interfaces on your system but

exclude any other interfaces, such as ppp0.

If the -i parameter is used but no interface is speciﬁed, then every interface is affected by the rule.

• -j — Tells iptables to jump to a particular target when a packet matches a particular rule. Valid

targets to be used after the -j option include the standard options, ACCEPT, DROP, QUEUE, and

RETURN, as well as extended options that are available through modules loaded by default with the

Red Hat Linux iptables RPM package, such as LOG, MARK, and REJECT, among others. See the

iptables man page for more information on these and other targets, including rules regarding

their use.

You may also direct a packet matching this rule to a user-deﬁned chain outside of the current

chain. This allows you to apply other rules against this packet, further ﬁltering it with more speciﬁc

criteria.

If no target is speciﬁed, the packet moves past the rule with no action taken. However, the counter

for this rule is still increased by 1, as the packet matched the speciﬁed rule.

• -o — Sets the outgoing network interface for a particular rule, and may only be used with OUTPUT

and FORWARD chains in the filter table and the POSTROUTING chain in the nat and mangle

tables. This parameter’s options are the same as those of the incoming network interface parameter

(-i).

• -p — Sets the IP protocol for the rule, which can be either icmp, tcp, udp, or all, to match

every supported protocol. In addition, lesser used protocols listed in /etc/protocols can also be

utilized. If this option is omitted when creating a rule, the all option is the default.

• -s — Sets the source for a particular packet, using the same syntax as the destination (-d) param-

eter.

14.3.5. Match Options

Different network protocols provide specialized matching options which may be set in speciﬁc ways

to match a particular packet using that protocol. Of course, the protocol must ﬁrst be speciﬁed in

the iptables command, such as using -p tcp protocol-name , to make the options for that

protocol available.

14.3.5.1. TCP Protocol

These match options are available for the TCP protocol (-p tcp):

1 2 ... 166 167 168 169 170 171 172 173 174 175 176 ... 281 282

Commenti su questo manuale

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 171

Commenti su questo manuale

Prodotti e manuali riguardandi Software di system management Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE