Zen

Source string Source string

115/10000 · 115

The string is read only.

English Actions
<literal>iptables -A OUTPUT -p udp --dport 53 -j ACCEPT</literal>
You want to be able to ping your computer to ensure it's still alive:
<literal>iptables -A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT</literal>
BusyBox with iptables example number 4
If you are frequently accessing FTP servers or enjoy chatting, you might notice delays because some implementations of these daemons query an identd daemon on your system to obtain usernames. Although there's really little harm in this, having an identd running is not recommended because many security experts feel the service gives out too much additional information.
To avoid these delays you could reject the requests with a 'tcp-reset' response:
<literal>iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset</literal>
To log and drop invalid packets (packets that came in after netfilter's timeout or some types of network scans) insert these rules at the top of the chain:
<literal>iptables -I INPUT 0 -p tcp -m conntrack --ctstate INVALID \
-j LOG --log-prefix "FIREWALL:INVALID "
iptables -I INPUT 1 -p tcp -m conntrack --ctstate INVALID -j DROP</literal>
Anything coming from the outside should not have a private address, this is a common attack called IP-spoofing:
<literal>iptables -A INPUT -i WAN1 -s 10.0.0.0/8 -j DROP
iptables -A INPUT -i WAN1 -s 172.16.0.0/12 -j DROP
iptables -A INPUT -i WAN1 -s 192.168.0.0/16 -j DROP</literal>
There are other addresses that you may also want to drop: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3 (multicast and experimental), 169.254.0.0/16 (Link Local Networks), and 192.0.2.0/24 (IANA defined test network).
If your firewall is a DHCP client, you need to allow those packets:
<literal>iptables -A INPUT -i WAN1 -p udp -s 0.0.0.0 --sport 67 \
-d 255.255.255.255 --dport 68 -j ACCEPT</literal>
To simplify debugging and be fair to anyone who'd like to access a service you have disabled, purposely or by mistake, you could REJECT those packets that are dropped.
Obviously this must be done directly after logging as the very last lines before the packets are dropped by policy:
<literal>iptables -A INPUT -j REJECT</literal>
These are only examples to show you some of the capabilities of the firewall code in Linux. Have a look at the man page of iptables. There you will find much more information. The port numbers needed for this can be found in <filename>/etc/services</filename>, in case you didn't find them by trial and error in your log file.
<phrase revision="sysv">Boot Script</phrase> <phrase revision="systemd">Systemd Unit</phrase>
To set up the iptables firewall at boot, install the <filename>/etc/rc.d/init.d/iptables</filename> init script included in the <xref linkend="bootscripts"/> package.
To set up the iptables firewall at boot, install the <filename>iptables.service</filename> unit included in the <xref linkend="systemd-units"/> package.
<userinput>make install-iptables</userinput>
Contents
Installed Programs
Installed Libraries
Installed Directories
ip6tables, ip6tables-apply, ip6tables-legacy, ip6tables-legacy-restore, ip6tables-legacy-save, ip6tables-restore, ip6tables-save, iptables, iptables-apply, iptables-legacy, iptables-legacy-restore, iptables-legacy-apply, iptables-restore, iptables-save, iptables-xml, nfsynproxy (optional), and xtables-multi
libip4tc.so, libip6tc.so, libipq.so, libiptc.so, and libxtables.so
/lib/xtables and /usr/include/libiptc
Short Descriptions
<?dbfo list-presentation="list"?> <?dbhtml list-presentation="table"?>

Loading…

User avatar None

Source string added

  1. Beyond Linux From Scratch 11.3
  2. postlfs_security_iptables
  3. English
Obviously this must be done directly after logging as the very last lines before the packets are dropped by policy:
a year ago
Browse all string changes

Things to check

Multiple failing checks

Following checks are failing:
Mismatched colon: French, French

Reset

Glossary

English English
No related strings found in the glossary.

String information

Source string description
type: Content of: <sect1><sect2><sect3><itemizedlist><listitem><para>
Flags
read-only
Source string location
blfs-en/postlfs/security/iptables.xml:797
String age
a year ago
Last updated
9 months ago
Source string age
a year ago
Translation file
string 84