Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 172)

172 Chapter 14. Firewalling with iptables

• --dport — Sets the destination port for the packet. You can use either a network service name

(such as www or smtp), port number, or range of port numbers to conﬁgure this option. To browse

the names and aliases of network services and the port numbers they use, view the /etc/services

ﬁle. You can also use --destination-port to specify this match option.

To specify a speciﬁc range of port numbers, separate the two numbers with a colon (:), such as -p

tcp --dport 3000:3200. The largest valid range is 0:65535.

You may also use an exclamation point character (!) as a ﬂag after the --dport option to tell

iptables to match all packets which do not use that network service or port.

• --sport — Sets the source port of the packet, using the same options as --dport. You can also

use --source-port to specify this match option.

• --syn — Applies to all TCP packets designed to initiate communication, commonly called SYN

packets. Any packets that carry a data payload are not touched. Placing an exclamation point char-

acter (!) as a ﬂag after the --syn option causes all non-SYN packets to be matched.

• --tcp-flags — Allows TCP packets with speciﬁc bits, or ﬂags, set to be matched with a rule.

The --tcp-flags match option accepts two parameters after it, which are ﬂags for the various

bits arranged in a comma-separated list. The ﬁrst parameter is the mask, which sets the ﬂags to be

examined on the packet. The second parameter refers to the ﬂags that must be set in the packet to

make a match. The possible ﬂags are ACK, FIN, PSH, RST, SYN, and URG. In addition, ALL and NONE

can also be used to match every ﬂag or none of them.

For example, an iptables rule which contains -p tcp --tcp-flags ACK,FIN,SYN SYN will

only match TCP packets that have the SYN ﬂag set and the ACK and FIN ﬂags unset.

Like many other options, using the exclamation point character (!) after --tcp-flags reverses the

effect of the match option, so that the second parameter’s ﬂags must not be set in order to match.

• --tcp-option — Attempts to match with TCP-speciﬁc options that can be set within a particular

packet. This match option can also be reversed with the exclamation point character (!).

14.3.5.2. UDP Protocol

These match options are available for the UDP protocol (-p udp):

• --dport — Speciﬁes the destination port of the UDP packet, using the service name, port number,

or range of port numbers. The --destination-port match option may be used instead of --

dport. See the --dport match option in Section 14.3.5.1 for various ways to use this option.

• --sport — Speciﬁes the source port of the UDP packet, using the service name, port number, or

range of port numbers. The --source-port match option may be used instead of --sport. See

the --dport match option in Section 14.3.5.1 for various ways to use this option.

14.3.5.3. ICMP Protocol

Packets using the Internet Control Message Protocol (ICMP) can be matched using the following

option when -p icmp is speciﬁed:

• --icmp-type — Sets the name or number of the ICMP type to match with the rule. A list of valid

ICMP names can be seen by typing the iptables -p icmp -h command.

1 2 ... 167 168 169 170 171 172 173 174 175 176 177 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 172