Iptables commands Full Guide: How to make our own Firewall

Introduction to iptables commands
Types of Tables in iptables
Types of Chains of iptables
How iptables commands Works
Types of the target in iptables commands
Installation
Syntax
Recent Articles on Computer Networks
Recent Articles on Linux

Introduction to iptables commands

iptables commands is a powerful firewall utility that is commonly used in Linux systems. It allows you to configure and manage network traffic rules, including filtering, network address translation (NAT), and packet manipulation.

In short, iptables commands is a user-level program that controls the kernel-level network module called Netfilter.

Types of Tables in iptables

iptables commands support multiple tables, each serving a specific purpose and containing different chains. Here are the four main tables in iptables:

A) Filter Table (default)

Purpose: The filter table is the default table in iptables and is primarily used for packet filtering. It controls the flow of network packets based on criteria such as source/destination IP addresses, protocols, and ports.

Chains: The filter table has three built-in chains: INPUT (for incoming packets destined for the local system), OUTPUT (for outgoing packets originating from the local system), and FORWARD (for packets passing through the system).

2) NAT table

Purpose: The NAT (Network Address Translation) table is used for network address translation, which enables the modification of source or destination IP addresses and ports in packets as they traverse the firewall. It is commonly used for tasks like port forwarding and IP masquerading.

Chains: The NAT table has three built-in chains: PREROUTING (for packets arriving at the system before routing), POSTROUTING (for packets leaving the system after routing), and OUTPUT (for locally generated packets).

3) Mangle table

Purpose: The mangle table is used for specialized packet alteration and modification. It allows you to modify specific packet header fields, mark packets for special handling, and perform advanced packet manipulations.

Chains: The mangle table has five built-in chains: PREROUTING, INPUT, FORWARD, OUTPUT, and POSTROUTING. These chains correspond to the different stages of packet processing within the network stack.

4) Raw Table

Purpose: The raw table is used for configuring exemptions from connection tracking. It allows packets to bypass the connection tracking mechanisms, which is useful for certain advanced networking scenarios.

Chains: The raw table has four built-in chains: PREROUTING, OUTPUT, CT, and NOTRACK. The CT chain is used for connection tracking-related rules, and the NOTRACK chain is used for packets that should not be tracked.

These tables provide different functionalities and are utilized based on the specific requirements of the firewall configuration. When working with iptables, you can specify the table using the -t option followed by the table name, such as -t filter, -t nat, -t mangle, or -t raw.

It’s worth noting that there are additional tables available in certain scenarios or with specific kernel modules, but the four tables mentioned above are the primary ones used in most iptables configurations.

Types of Chains of iptables

In iptables, there are three main types of chains:

Input Chain (INPUT): The INPUT chain is responsible for processing incoming packets destined for the local system. It includes traffic targeting services running on the system itself. Examples include packets sent to the system’s IP address for services like SSH, HTTP, or DNS.
Output Chain (OUTPUT): The OUTPUT chain handles outgoing packets originating from the local system. It includes traffic generated by services or applications running on the system. Examples include responses to incoming requests, outgoing DNS queries, or web server responses.
Forward Chain (FORWARD): The FORWARD chain manages packets that are being routed through the local system. It applies to packets that are neither destined for the local system nor generated by it. In other words, it handles packets being forwarded between different networks or interfaces on the system, such as acting as a router or a gateway.

In addition to these main chains, there are also some additional built-in chains in iptables that serve specific purposes:

Prerouting Chain (PREROUTING): The PREROUTING chain is used for Network Address Translation (NAT) and is processed before the routing decision is made. It allows you to modify packets before they are routed.
Postrouting Chain (POSTROUTING): The POSTROUTING chain is also used for Network Address Translation (NAT) and is processed after the routing decision. It allows you to modify packets before they leave the system.

When defining rules, you specify the chain to which the rule should be applied. For example, -A INPUT appends a rule to the INPUT chain, -A OUTPUT appends a rule to the OUTPUT chain, and -A FORWARD appends a rule to the FORWARD chain.

How iptables commands Works

iptables commands work by interacting with the netfilter framework in the Linux kernel to configure and manage firewall rules. Netfilter is a packet filtering subsystem that allows the manipulation of network packets as they pass through the network stack.

When an iptables command is executed, it modifies the ruleset within the netfilter framework, which determines how packets are handled. The ruleset consists of a set of chains, and each chain is a list of rules that packets traverse sequentially.

When a packet enters the network stack, it goes through various stages such as PREROUTING, INPUT, FORWARD, OUTPUT, and POSTROUTING. iptables commands are typically applied to one of these stages, depending on the desired action.

Here’s a simplified overview of how iptables commands work:

Packet traversal: When a packet enters the network stack, it passes through different stages (chains) based on its direction and purpose.
Rule matching: As the packet traverses a chain, iptables checks the packet against each rule in the chain sequentially. Each rule contains match criteria (e.g., source IP, destination port) that determine if the packet matches the rule.
Action execution: If a packet matches a rule, the corresponding action defined in the rule’s target is executed. The action can be to accept the packet, drop it, reject it, log it, or perform some other custom action.
Chain traversal: If the packet doesn’t match a rule or the action allows it to continue, it proceeds to the next chain/stage. This process continues until the packet reaches its destination or a rule explicitly drops or rejects it.
Default policy: If a packet doesn’t match any rule in a chain, the default policy for that chain is applied. The default policy can be set to accept, drop, or reject packets that don’t match any rule.

It’s important to note that iptables rules are processed in a top-down manner, meaning that the order of rules within a chain is significant. The first matching rule determines the action taken, and subsequent rules are not evaluated for that packet.

Additionally, iptables rules can be stateful, meaning they can track the state of a connection. For example, you can allow incoming traffic for established connections and related packets, while blocking new or invalid connections.

By carefully crafting iptables rules, you can control network traffic, secure your system, implement network address translation (NAT), redirect packets, and perform various other network-related tasks.

Remember that iptables commands typically require administrative privileges to modify the firewall rules, so they are often executed with root or sudo access.

Types of the target in iptables commands

In iptables, a target refers to the action that is taken on a packet when it matches a rule. The following are some commonly used targets in iptables:

ACCEPT: This target allows the packet to pass through the firewall and reach its destination. It effectively accepts the packet.
DROP: When a packet matches a rule with the DROP target, it is silently discarded, and no response is sent back to the sender. The packet is effectively dropped.
REJECT: Similar to the DROP target, the REJECT target discards the packet. However, it also sends a response back to the sender to inform them that the packet has been rejected.
LOG: The LOG target is used to log information about the packet. When a packet matches a rule with the LOG target, it is logged to the system log files. This can be useful for monitoring and troubleshooting purposes.
RETURN – this rule sends the packet back to the originating chain so you can match it against other rules.

Installation

To install iptables use this command so that we can learn about these:

$ sudo apt-get install iptables

To check whether iptables is installed or not in the system check the version of the iptables

$ iptables -V
iptables v1.8.4 (legacy)

Syntax

The general syntax of the "iptables” command is as follows

$ iptables [options] <command> [chain] [rule-specification]

Here’s a breakdown of the different components:

iptables: The main command to manage firewall rules.
[options]: Optional flags or parameters that modify the behavior of the command.
<command>: Specifies the action to be performed on the firewall rules. Some commonly used commands are:
- -A or --append: Appends a rule to a chain.
- -D or --delete: Deletes a rule from a chain.
- -I or --insert: Inserts a rule into a chain at a specific position.
- -L or --list: Lists the rules in a chain.
- -P or --policy: Sets the default policy for a chain.
[chain]: Specifies the chain to which the rule should be applied. Chains are predefined sets of rules that determine the fate of network packets. Some common chains are:
- INPUT: For incoming packets to the local system.
- OUTPUT: For outgoing packets from the local system.
- FORWARD: For packets routed through the local system.
[rule-specification]: Specifies the details of the rule to be added, modified, or deleted. This can include various parameters such as source/destination IP addresses, protocols, ports, and actions to take.

Note: Please note that manipulating firewall rules using iptables requires root or superuser privileges.