ServerBuddies Support Blog

iptables rule for routing outside the range of the LAN.

LAN range - 192.168.1.0/24
Outside LAN IP - 10.0.4.2

To set a rule for routing incoming HTTP requests to a dedicated HTTP server at 10.0.4.2 (outside of the 192.168.1.0/24 range of the LAN), NAT calls a PREROUTING table to forward the packets to their proper destination:

iptables rules can be set to route traffic to certain machines, such as a dedicated HTTP or FTP server, in a demilitarized zone (DMZ) — a special local subnetwork dedicated to providing services on a public carrier such as the Internet.

With this command, all HTTP connections to port 80 from the outside of the LAN are routed to the HTTP server on a separate network from the rest of the internal network. This form of net work segmentation can prove safer than allowing HTTP connections to a machine on the network. If the HTTP server is configured to accept secure connections, then port 443 must be forwarded as well.

Common iptables Filtering

Default policy set to block all incoming, outgoing, and forwarded packets, it is impossible for the firewall/gateway and internal LAN users to communicate with each other or with external resources. To allow users to perform network-related functions and use networking applications, administrators must open certain ports for communication.

To allow access to port 80 on the firewall, append the following rule:

This allows regular Web browsing from websites that communicate via port 80. To allow access to secure websites (such as https://www.serverbuddies.com/), you must open port 443, as well.

You must set a rule to allow first, and then set a drop rule on the subnet.

To arbitrarily insert a rule in an existing chain of rules, use -I, followed by the chain in which to insert the rule, and a rule number (1,2,3,…,n) for where the rule should reside. For example:

The rule is inserted as the first rule in the INPUT chain to allow local loopback device traffic.

To allow remote SSH access, the following rules may be used:

Saving and Restoring iptables Rules

The iptables package comes with two more tools that are very useful, specially if you are dealing with larger rule-sets.

These two tools are called iptables-save and iptables-restore

Firewall rules are only valid for the time the computer is on; so, if the system is rebooted, the rules are automatically flushed and reset.

To save the rules so that they are loaded later, use the following command:

The rules are stored in the file /etc/sysconfig/iptables and are applied whenever the service is started or restarted, including when the machine is rebooted.

The above command will in other words save the whole rule-set to a file called /etc/iptables-save with byte and packet counters still intact.

Example

Save current iptables firewall rules:

To restore iptables rules:

Basic iptables Firewall policies (-P)

The following rules block all incoming and outgoing packets on a network gateway:

Forwarded packets denied. To do this, use the following rule:

After setting the policy chains, you can create new rules for your particular network and security requirements.

Establishing basic firewall policies creates a foundation for building more detailed, user-defined rules. iptables uses policies (-P) to create default rules.

iptables Overview

iptables features advanced logging, pre and post-routing actions, network address translation, and port forwarding all in one command line interface.

Using iptables

The first step in using iptables is to start the iptables service.
This can be done with the command:

The ip6tables services should be turned off to use the iptables.

To make iptables start by default whenever the system is booted, you must change runlevel status on the service using chkconfig.

The syntax of iptables is separated into tiers. The main tier is the chain. A chain specifies the state at which a packet is manipulated. The usage is as follows:

The -A option appends a rule at the end of an existing ruleset.

The chain is the name of the chain for a rule.
The three built-in chains of iptables (that is, the chains that affect every packet which traverses a network) are INPUT, OUTPUT, and FORWARD.

The -j target option specifies the location in the iptables ruleset where this particular rule should jump. Some built in targets are ACCEPT, DROP, and REJECT.