Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 173)

Chapter 14. Firewalling with iptables 173

14.3.5.4. Modules with Additional Match Options

Additional match options are also available through modules loaded when the iptables command

calls them. To use a match option module, you must load the module by name by including -m

module-name in the iptables command.

A large number of modules are available by default. It is even possible to create your own modules

to provide additional match option functionality. Many modules exist, but only the most popular ones

are discussed here.

The limit module allows you to place a limit on how many packets will be matched to a particular

rule. This is especially beneﬁcial when logging rule matches so that a ﬂood of matching packets will

not ﬁll up your logs with repetitive messages or use too many system resources.

• --limit — Sets the number of matches for a particular range of time, speciﬁed with a number and

time modiﬁer arranged in a number / time format. For example, using --limit 5/hour

only lets a rule match ﬁve times in a single hour.

If a number and time modiﬁer are not used, the default value of 3/hour is assumed.

• --limit-burst — Sets a limit on the number of packets able to match a rule at one time. This

option should be used in conjunction with the --limit option, and it accepts a number to set the

burst threshold.

If no number is speciﬁed, only ﬁve packets are initially able to match the rule.

The state module, which uses the --state match option, can match a packet with these particular

connection states:

• ESTABLISHED — The matching packet is associated with other packets in an established connec-

tion.

• INVALID — The matching packet cannot be tied to a known connection.

• NEW — The matching packet is either creating a new connection or is part of a two-way connection

not previously seen.

• RELATED — The matching packet is starting a new connection related in some way to an existing

connection.

These connection states can be used in combination with one another by separating them with com-

mas, such as -m state --state INVALID,NEW.

To speciﬁcally match a hardware MAC address of an Ethernet device, use the mac module, which

accepts --mac-source plus a MAC address as an option. To exclude a MAC address from a rule,

place an exclamation point (!) after the --mac-source match option.

To view other match options available through modules, see the iptables man page.

14.3.6. Target Options

Once a packet has matched a particular rule, the rule can direct the packet to a number of different

targets that decide its fate and, possibly, take additional actions, such as logging the action. Addition-

ally, each chain has a default target, which is used if none of the rules on that chain match a packet or

if none of the rules which match the packet specify a target.

There are only a few standard targets available to decide what happens with the packet:

•

user-defined-chain — The name of a previously created and deﬁned chain within this

table with rules that will be checked against this packet, in addition to any other rules in any other

chains that must be checked against this packet.

1 2 ... 168 169 170 171 172 173 174 175 176 177 178 ... 281 282

Commenti su questo manuale

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 173

Commenti su questo manuale

Prodotti e manuali riguardandi Software di system management Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE