overview

iptables is a command-line tool for configuring the Linux kernel firewall. It is based on the kernel's packet filtering framework netfilter and is mainly used to manage packet filtering and NAT rules.

Image source: https://upload.wikimedia.org/wikipedia/commons/3/37/Netfilter-packet-flow.svg

iptables interacts with the packet filtering hooks in the protocol stack to get the job done. These kernel hooks form the netfilter framework. Each packet (received or sent) entering the network system will trigger these hooks when passing through the protocol stack, and the program can process network traffic on some key paths by registering hook functions. iptables​-related kernel modules register processing functions at these hook points, so you can configure iptables rules to make network traffic comply with firewall rules.

Understanding iptables is the basis for learning the implementation of network functions in open source projects such as Docker and Kubernetes.

rule

Rules​ are the conditions predefined by the network administrator. The general definition is that if the packet header meets the current conditions, the packet is processed, otherwise the next judgment condition is executed. The rules​ are stored in the filter table of the kernel space, and these rules specify Source address, destination address, transport protocol (such as TCP, UDP, ICMP) and service type (such as HTTP, FTP, SMTP), etc. When the packet matches the rule, the kernel will perform specific actions.

The main job of configuring a firewall is to add, modify, and delete rules.

Behavior

5 strands

Chain​ is the path for data packets to propagate, and there can be N rules​ (N >= 0) in each chain​. When a data packet reaches a chain​, iptables​ will start to check from the first rule in the chain. If the data packet meets the conditions defined by the rule, the system will perform specific actions​, otherwise iptables​ will continue to check the next rule. If the packet does not match any of the rules in the chain, iptables will process the packet according to the predefined default policy of the chain.

5 tables

A table has N chains, and a chain has N rules.

Most scenarios only need to use Filter table and NAT table.

Raw table

The Raw table is used to process packets before connection tracking, NAT and routing table processing, and contains 2 built-in chains:

• PREROUTING

• OUTPUT

Because the priority is the highest, if the Raw table is used, after the Raw table is processed, the NAT table and ip_conntrack processing will be skipped, that is, connection tracking, NAT and routing table pre-processing will be avoided.

Filter table

Filter​ is the default table of iptables​, which is used to filter packets. If no table is defined, the Filter table will be used, including 3 built-in chains:

• • INPUT
• • OUTPUT
• • FORWARD

In the Filter table, only the operations of accepting and discarding data packets are allowed, but the data packets cannot be changed.

NAT table

NAT is used to implement network address translation and contains 3 built-in chains:

• PREROUTING

• POST-ROUTING

• OUTPUT

Mangle table

Mangle is used to modify, mark or redirect specified packet headers, including 5 built-in chains:

• INPUT

• OUTPUT

• FORWARD

• PREROUTING

• POST-ROUTING

Security table

Security is used to mark packages with SELinux, thereby affecting the behavior of SELinux or other systems that can interpret SELinux security contexts for processing packages. These tags can be based on individual packets or connections.

Table and chain relationship diagram

Table and chain relationship diagram

The detection priority of the table

Raw -> Mangle -> Nat -> Filter

Image source: https://www.frozentux.net/iptables-tutorial/images/tables_traverse.jpg

Any data packet must pass through one of the five chains.

• When a data packet enters the network card, it first enters the PREROUTING chain, and the kernel judges whether it needs to be forwarded according to the destination IP of the data packet

• If the data packet enters the local machine, it will move down the graph and reach the INPUT chain. After the data packet reaches the INPUT chain, any process will receive it, and the program on the machine can send the data packet. The package will go through the OUTPUT​ chain, and then reach the output of the POSTROUTING chain

• If the packet is forwarded, and the kernel allows forwarding, the packet will go through the FORWARD​ chain and then reach the output of the POSTROUTING chain

Common commands

view class

# 查看所有防火墙规则
$ iptables --list

# 示例输出如下
Chain DOCKER (8 references)
target     prot opt source               destination
ACCEPT     tcp  --  anywhere             172.27.0.2           tcp dpt:10010
ACCEPT     tcp  --  anywhere             172.22.0.2           tcp dpt:http
ACCEPT     tcp  --  anywhere             172.29.0.4           tcp dpt:memcached
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:redis
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:nginx
ACCEPT     tcp  --  anywhere             172.17.0.4           tcp dpt:8080
ACCEPT     tcp  --  anywhere             172.17.0.5           tcp dpt:mysql
ACCEPT     tcp  --  anywhere             172.17.0.5           tcp dpt:http

# 查看 mangle 表规则
$ iptables -t mangle --list

# 查看 nat 表规则
$ iptables -t nat --list
1.
2.
3.
4.
5.
6.
7.
8.
9.
10.
11.
12.
13.
14.
15.
16.
17.
18.
19.
20.