Commands#
> ls -la /usr/sbin/ip* # list all commands, there are many > iptables* # for ipv4 (in debian busters = nft) > ip6tables* # for ipv6 (in debian busters = nft) > iptables-legacy # former ones, not nft > iptables-nft # directly use nftNotes:
- all iptables commands (for ipv4 only) have an ip6tables* equivalent for ipv6
- see info
on nft
> who -u # get all sessions with ip and pid > sudo netstat -pantW # list network connections, p=programs,a=all,n=IPs,t=tcp,W=wide(not truncate IP address) > ip a # list all ips
Syntax#
see docu
> sudo ip6tables -L -v > sudo ip6tables -nvL # thjis is most compact > sudo ip6tables -n -v --line-numbers -L # list all ipv6 rules with numeric IPs and rule number > sudo service ip6tables start # activate firewalling > sudo chkconfig ip6tables on # enable after reboot
ip6tables [-t <table-name>] <command> <chain-name> <parameter-1> <option-1> <parameter-n> <option-n>
- table-name
- like [filter, nat, mangle, raw, security], if omitted we use "filter"
- command
- -F : flush current chain or all if omitted
- -X : deletes a user-specified chain or all if omitted
- -Z : zeros the byte and packet counters in all chains
- -A : apppend a rule at the end
- -I : inserts at a specified position (similar to replace -R), wihtout position at the top
- -P : a policy is a fall back and is used after all rules have passede** you can enable certain special addresses earlier
- -L : list all rules
- chain-name
- INPUT, FORWARD, OUTPUT (as listed with > iptables -L)
- you may invent new chain names, but this seems not to be common (command -N)
- parameter-1 (filter)
- -s : source filter (address[/mask][...])
- -d : destination filter
- -p : protocoll filter like [icmp, tcp, udp, all] or those in /etc/protocols, if omitted ALL protocols are considered
- with -p tcp you can use --dport for destination port filter, any number
- with -p udp you can use --dport for destination port and --sport as source port filter
- ports can be also a range like 3000:3200 (all from 3000 to 3200)
- with -p icmp you can use --icmp-type
- -i : interface like [eth0, lo, ppp0], without name ALL interfaces are used
- -j : jump to [ACCEPT, DROP, QUEUE, RETURN] (or others added with modules)
- -m : adds a comment when listing the rules, syntax >-m comment --comment "My comments here"<
- option-1 (target)
- [ACCEPT, DROP, QUEUE, RETURN] (or others added with modules)
- option-n (listing options)
- -v : verbose output
- -n : displays IP addresses and port numbers in numeric format instead of hostname/network service
- notes
- the first three commands are usually used to create a fresh ruleset in a script
- in the chain list and then drop all other later
Example RuleSet#
This one is
- allowing dhcp, dns and router traffic
- not allowing ipv4
- allowing ipv6 for 3 distinct ipv6 addresses, these are the first three ipv6 rules, which we replace at Exposing Raspberry to Internet
#!/bin/bash SOURCE=:: # ipv4 ------------------------------------ # Flush all rules and delete all chains for a clean startup iptables -F iptables -X iptables -Z # Zero out all counters # enable dns nameserver iptables -A INPUT -s 1.1.1.1 -j ACCEPT # cloudflare iptables -A OUTPUT -d 1.1.1.1 -j ACCEPT iptables -A INPUT -s 8.8.8.8 -j ACCEPT # google iptables -A OUTPUT -d 8.8.8.8 -j ACCEPT # connection iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT # enable router for dhcp iptables -A INPUT -s 192.168.188.1/24 -j ACCEPT iptables -A OUTPUT -d 192.168.188.1/24 -j ACCEPT # enable dns iptables -A INPUT -p udp -m multiport --sport 53,67,68,90,135,853,5353,8245 -j ACCEPT iptables -A OUTPUT -p udp -m multiport --dport 53,67,68,90,135,853,5353,8245 -j ACCEPT #iptables -A INPUT -i eth0 -p udp --dport 67:68 --sport 67:68 -j ACCEPT #iptables -A INPUT -i eth0 -p udp -m udp -m multiport --dports 67:68 -j ACCEPT #iptables -A OUTPUT -o eth0 -p udp -m udp -m multiport --dports 67:68 -j ACCEPT # enable dhcp iptables -A INPUT -i eth0 -p icmp -j ACCEPT iptables -A OUTPUT -o eth0 -p icmp -j ACCEPT iptables -A INPUT -i eth0 -p icmp -m icmp --icmp-type 134 -m comment --comment router-advertisement -j ACCEPT iptables -A INPUT -p icmp -m icmp --icmp-type 135 -m comment --comment neighbor-solicitation -j ACCEPT iptables -A INPUT -p icmp -m icmp --icmp-type 136 -m comment --comment neighbor-advertisement -j ACCEPT # allow local loopback iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT # drop everything else iptables -A INPUT DROP iptables -P FORWARD -j DROP iptables -A OUTPUT -j DROP # ipv6 ------------------------------------ # Flush all rules and delete all chains for a clean startup ip6tables -F ip6tables -X ip6tables -Z # drop all ipv6 traffic, except special ipv6, see below # do not limit to --dport 22, because the source has random ports (?) # add first to enabel replacing 1. rule later # placeholder for first device ip6tables -A INPUT -s $SOURCE -j ACCEPT ip6tables -A OUTPUT -d $SOURCE -j ACCEPT # placeholder for second device ip6tables -A INPUT -s $SOURCE -j ACCEPT ip6tables -A OUTPUT -d $SOURCE -j ACCEPT # placeholder for third device ip6tables -A INPUT -s $SOURCE -j ACCEPT ip6tables -A OUTPUT -d $SOURCE -j ACCEPT # dns nameserver ip6tables -A INPUT -s 2606:4700:4700::1111 -j ACCEPT # cloudflare ip6tables -A OUTPUT -d 2606:4700:4700::1111 -j ACCEPT ip6tables -A INPUT -s 2001:4860:4860::8888 -j ACCEPT # google ip6tables -A OUTPUT -d 2001:4860:4860::8888 -j ACCEPT # connection ip6tables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT ip6tables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT # enable dhcp ip6tables -A INPUT -s fd94::/16 -j ACCEPT ip6tables -A OUTPUT -d fd94::/16 -j ACCEPT ip6tables -A INPUT -s fe80::/16 -j ACCEPT ip6tables -A OUTPUT -d fe80::/16 -j ACCEPT # enable dns ip6tables -A INPUT -p udp -m multiport --sport 53,67,68,90,135,853,5353,8245 -j ACCEPT ip6tables -A OUTPUT -p udp -m multiport --dport 53,67,68,90,135,853,5353,8245 -j ACCEPT # enable dhcp ip6tables -A INPUT -p ipv6-icmp -j ACCEPT ip6tables -A OUTPUT -p ipv6-icmp -j ACCEPT #ip6tables -A INPUT -i eth0 -p ipv6-icmp -m icmp6 --icmpv6-type 134 -m comment --comment router-advertisement -j ACCEPT #ip6tables -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 135 -m comment --comment neighbor-solicitation -j ACCEPT #ip6tables -A INPUT -p ipv6-icmp -m icmp6 --icmpv6-type 136 -m comment --comment neighbor-advertisement -j ACCEPT # allow ipv6 local loopback ip6tables -A INPUT -i lo -j ACCEPT ip6tables -A OUTPUT -o lo -j ACCEPT # drop everthing else ip6tables -P FORWARD DROP # as policy generally ip6tables -A INPUT -j DROP ip6tables -A OUTPUT -j DROP # update first ip6tables rules and enable EbelStube /home/markus/update_ip6tables.py echo "---- iptables ----" iptables -vnL echo echo "---- ip6tables ----" ip6tables -vnL
No Copyright