Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 175)

Chapter 14. Firewalling with iptables 175

• -x — Expands numbers into their exact values. On a busy system, the number of packets and

bytes seen by a particular chain or rule may be abbreviated using K (thousands), M (millions), and G

(billions) at the end of the number. This option forces the full number to be displayed.

• -n — Displays IP addresses and port numbers in numeric format, rather than the default hostname

and network service format.

• --line-numbers — Lists rules in each chain next to their numeric order in the chain. This option

is useful when attempting to delete a speciﬁc rule in a chain, or to locate where to insert a rule

within a chain.

14.4. Storing iptables Information

Rules created with the iptables command are only stored in RAM. If you restart your system after

setting up various iptables rules, they are lost. If you want particular rules to take effect whenever

your system boots, you need to save them to the /etc/sysconfig/iptables ﬁle.

To do this, arrange your tables, chains, and rules the way they should be the next time the system

boots or iptables is restarted, and type the /sbin/service iptables save command as the

root user. This causes the iptables init script to run the /sbin/iptables-save program and

write the current iptables conﬁguration to the /etc/sysconfig/iptables ﬁle. This ﬁle should

only be readable by root, so your precise packet ﬁltering rules are not viewable by average users.

The next time the system boots, the iptables init script will reapply the rules saved in

/etc/sysconfig/iptables by using the /sbin/iptables-restore command.

While it is always a good idea to test a new iptables rule before committing it to the

/etc/sysconfig/iptables ﬁle, it is possible to copy iptables rules into this ﬁle from another

system’s version of this ﬁle. This allows you to quickly distribute sets of iptables rules to many

different machines at once.

14.5. Additional Resources

See the sources below for additional information on packet ﬁltering with iptables.

14.5.1. Installed Documentation

• The iptables man page contains a comprehensive description of various commands, parameters,

and other options.

14.5.2. Useful Websites

• http://netﬁlter.samba.org — Contains assorted information about iptables, including an FAQ ad-

dressing speciﬁc problems you may see and various helpful guides by Rusty Russell, the Linux

IP ﬁrewall maintainer. The HOWTO documents here cover subjects such as basic networking con-

cepts, 2.4 kernel packet ﬁltering and NAT conﬁgurations.

• http://www.linuxnewbie.org/nhf/intel/security/iptables_basics.html —A very basic and general

look at the way packets move through the Linux kernel, plus an introduction to constructing

simple iptables commands.

• http://www.redhat.com/support/resources/networking/ﬁrewall.html — This page has

update-to-date links to a variety of packet ﬁlter resources.

1 2 ... 170 171 172 173 174 175 176 177 178 179 180 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 175