by: Networking

IPTables uses the filter table to act as a firewall, but it also controls the routing of packets on Linux.

A table in IPTables is a collection of chains for a particular networking function.

  • Filter Table (Firewall)
    • Input Chain
    • Output Chain
    • Forward Chain
  • NAT Table
    • Output Chain
    • Prerouting Chain
    • Postrouting Chain
  • Mangle Table
    • Input Chain
    • Output Chain
    • Forward Chain
    • Prerouting Chain
    • Postrouting Chain

Chains match packets based on their state. Here is a simplified view of the main chains:

COMMANDS

  • iptables -L
    • List rules.
  • iptables -L –line-numbers
    • List rules with line numbers.
  • iptables -D INPUT
    • Delete a rule from the INPUT chain.
  • iptables -F
    • Flush all rules.
  • iptables –policy INPUT ACCEPT
    • Set the default policy to ACCEPT.
  • iptables –policy INPUT DROP
    • Set the default policy to DROP.
  • iptables -I -s 1.1.1.1 -j ACCEPT
    • Insert a rule at the top.
    • Allows connections from the specified IP.
  • iptables -A -s 1.1.1.0/24 -j DROP
    • Append a rule to the end.
    • Drops connections from the specified network.
  • iptables -I INPUT -p tcp –dport 80 -j DROP
    • Block incoming connections to a port.
  • iptables -I OUTPUT -p tcp –dport 443 -j DROP
    • Drop outgoing packets to a destination port.
  • sudo iptables -t nat -L -n -v –line-numbers
    • List all rules in the NAT table with line numbers.
  • sudo iptables -t nat -D PREROUTING 10
    • Delete rule number 10 from the NAT table PREROUTING chain.
  • iptables -I INPUT -p tcp –dport -j REJECT –reject-with tcp-reset
    • Helps prevent port enumeration by sending a TCP reset instead of silently dropping the packet, making scan results less accurate.

Chain traversal for incoming traffic:

  • PREROUTING -> INPUT
    • Inbound traffic destined for the host.
  • PREROUTING -> FORWARD -> POSTROUTING
    • Traffic being routed through the host.
  • PREROUTING -> OUTPUT -> POSTROUTING
    • Outbound traffic originating from the host.

CREATE PERSISTENCE

sudo /sbin/iptables-save | sudo tee /root/iptables-rules.v4
sudo apt install iptables-persistent -y

Alternatively, create the file /etc/rc.local and add your rules:

#!/bin/bash
sudo iptables -t nat -A PREROUTING -i ens5 -p udp --dport 1144 -j DNAT --to 10.8.0.2:1144
sudo iptables -t nat -A PREROUTING -i ens5 -p tcp --dport 49152:49159 -j DNAT --to 10.8.0.2:49152-49159
exit 0

FLUSHING ALL TABLES AND DELETING ALL CHAINS

sudo iptables -t filter -F
sudo iptables -t filter -X
sudo iptables -t mangle -X
sudo iptables -t mangle -F
sudo iptables -t raw -X
sudo iptables -t raw -F
sudo iptables -t security -X
sudo iptables -t security -F
sudo iptables -t nat -X
sudo iptables -t nat -F

REFLECTIONS

Older versions of UFW only evaluated INPUT and OUTPUT chains, but the latest version blocks FORWARD traffic by default unless manually allowed.

sudo nano /etc/ufw/before.rules

Add the following lines before COMMIT to allow forwarding to a specific subnet:

-A FORWARD -d 192.168.10.0/24 -j ACCEPT
-A FORWARD -s 192.168.10.0/24 -j ACCEPT

To allow forwarding of all packets:

sudo sed -i 's/^DEFAULT_FORWARD_POLICY="DROP"/DEFAULT_FORWARD_POLICY="ACCEPT"/' /etc/default/ufw