Firewall (iptables)

From Alessandro's Wiki
Jump to navigation Jump to search


Network Address Translation NAT

linux powerful firewall

  • print out the configuration running:
iptables -L
  • or better this will print all input table rules

  • some rules:
target     prot opt source               destination
ACCEPT     all  --  anywhere             anywhere
ACCEPT     icmp --  anywhere             anywhere            icmp any
ACCEPT     ipv6-crypt--  anywhere             anywhere
ACCEPT     ipv6-auth--  anywhere             anywhere
ACCEPT     udp  --  anywhere            udp dpt:mdns
ACCEPT     udp  --  anywhere             anywhere            udp dpt:ipp
ACCEPT     tcp  --  anywhere             anywhere            tcp dpt:ipp
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:46590
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:46720
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited

  • apend a rule (to the end of the table) to accept connections on port 5901 (vncserver)
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPT
  • show NAT table
iptables -t nat -L
iptables -t nat -L -n -v | grep 'IP or anything'
iptables -t nat -L -n -v
  • netstat-nat, software to display nat connections
netstat-nat -n
  • show SNAT connections, run:
netstat-nat -S
  • show DNAT connections, type:
netstat-nat -D

saving configuration in a file

iptables-save > backup_iptables

restore conf from a file

iptables-restore < backup_iptables
  • this will only enable the configuration while iptables process is restarted, to avoid this, we need to save the configuration:
/etc/init.d/iptables save
  • now we can restart/reboot

redirecting connections

from a specified port to an host

iptables -A PREROUTING -d HOSTONE -p tcp -m tcp --dport 80 -j DNAT --to-destination HOSTWO:80
iptables -A POSTROUTING -d HOSTWO -j SNAT --to-source HOSTONE


The Ubuntu Firewall

  • status
ufw status
  • ...with line numbers
ufw status numbered
  • numbers
ufw insert <number> allow from ...
ufw delete <number>

ufw allow from <target> to <destination> port <port number> proto <protocol name>

  • allow all traffic on the forward chain (don't do this)
ufw default allow FORWARD



  • denials
ufw deny from
ufw deny in on eth0 from
  • allow ssh's
ufw allow ssh
ufw allow 22
ufw allow from to any port 22
ufw allow from to port 22
  • web ports
ufw allow http
ufw allow 80
ufw allow https
ufw allow 443
ufw allow proto tcp from any to any port 80,443
  • some dbs

Allow MySQL from Specific IP Address or Subnet

ufw allow from to any port 3306

Allow MySQL to Specific Network Interface

ufw allow in on eth1 to any port 3306

PostgreSQL from Specific IP Address or Subnet

ufw allow from to any port 5432
  • routing from eth1 to eth2
    ufw route allow in on eth1 out on eth2