Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 174)

174 Chapter 14. Firewalling with iptables

• ACCEPT — Allows the packet to successfully move on to its destination or another chain.

• DROP — Drops the packet without responding to the requester. The system that sent the packet

is not notiﬁed of the failure. The packet is simply removed from the rule checking the chain and

discarded.

• QUEUE — The packet is queued for handling in userspace, where a user or an application, for

instance can do something with it.

• RETURN — Stops checking the packet against rules in the current chain. If the packet with a RETURN

target matches a rule in a chain called from another chain, the packet is returned to the ﬁrst chain to

resume rule checking where it left off. If the RETURN rule is used on a built-in chain and the packet

cannot move up to its previous chain, the default target for the current chain decides what is done

with it.

In addition to these standard targets, various other targets may be used with extensions called target

modules. For more information about match option modules, see Section 14.3.5.4.

There are many extended target modules, most of which only apply to speciﬁc tables or situations. A

couple of the most popular target modules included by default in Red Hat Linux are:

• LOG Logs all packets that match this rule. Since the packets are logged by the kernel, the

/etc/syslog.conf ﬁle determines where these log entries are written. By default, they are

placed in the /var/log/messages ﬁle.

Various options can be used after the LOG target to specify the way in which logging occurs:

• --log-level — Sets the priority level a of logging event. A list of priority levels can be found

in the syslog.conf man page.

• --log-ip-options — Any options set in the header of a IP packet is logged.

• --log-prefix — Places a string before the log line when it is written. Accepts up to 29

characters after the --log-prefix option. This is useful for writing syslog ﬁlters for use in

conjunction with packet logging.

• --log-tcp-options — Any options set in the header of a TCP packet is logged

• --log-tcp-sequence — Writes the TCP sequence number for the packet in the log.

• REJECT — Sends an error packet back to the system which sent the packet, and then DROPs the

packet. This target is useful if you would like to notify the system sending the matching packet of

the problem.

The REJECT target accepts a --reject-with

type option to provide more detail to be sent

with the error packet. The message port-unreachable is the default

type error given if no

other option is used. For a full list of

type options that can be used, see the iptables man

page.

Other target extensions, including several that are useful with masquerading using the nat table, can

be found in the iptables man page.

14.3.7. Listing Options

The default list command, iptables -L, provides a very basic overview of the default ﬁlter table’s

current rile chains. Additional options exist that provide more information and arrange that informa-

tion in speciﬁc ways:

• -v — Display verbose output, such as the number of packets and bytes each chain has seen, the

number of packets and bytes each rule has matched, and which interfaces apply to a particular rule.

1 2 ... 169 170 171 172 173 174 175 176 177 178 179 ... 281 282

Commenti su questo manuale

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 174

Commenti su questo manuale

Prodotti e manuali riguardandi Software di system management Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE