The Hidden Treasures of IPTables

    Date16 Jul 2004
    Posted ByAnthony Pell
    A introduction to some of the lesser know features of iptables, including string matching, time based rules and tar pits. This article originally appeared in the April 2004 edition of the linux journal, contributed to "Linux security" by the author. . . . With these powerful add-ons for iptables you can match strings or port ranges in iptables rules or even create a tar pit for network abusers.

    Linux's iptables allows powerful firewalls to be implemented at a minute fraction of the cost of many commercial offerings. Basic iptables firewalls are packet filters, which means they inspect the network communications flowing through them a packet at a time and make choices about how those packets are handled. Simple configurations can be used to drop certain packets and accept others. The choice about which policy to apply to a particular packet commonly is made on the basis of the IP address and port number to which it has been sent and the direction in which it is traveling. iptables also can use state information to make more-informed choices based on the state of the connection to which the packet relates. This is known as connection tracking.

    A simple and highly effective firewall configuration blocks inbound TCP/IP connection packets and UDP exchanges initiated from the public Internet while allowing outbound ones over translated addresses. This gives users free access to the outside world while protecting them from unwelcome intrusions. Such configurations are a bit simplistic and may need additional filters to be truly useful, but the basic concept is straightforward.

    iptables has a lot more to offer than these simple packet-filtering criteria. Some of the extras are fairly well known and even may make their way into some off-the-shelf Linux distributions, but some lesser-known features are worthy of investigation. These are the hidden treasures I intend to point you toward in this article. It would take a book to describe all the possible features and options associated with them, so all I do here is flag their existence and put you on the path of exploration.

    You are not authorised to post comments.

    LinuxSecurity Poll

    Has your email account ever been pwned in a data breach?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.