Iptables (Debian)
Aus Matts Wiki
Commands
General Commands
iptables-save > iptables.rules # Export iptables rules to iptables.rules iptables-restore < iptables.rules # Import iptables rules from iptables.rules iptables -L # List active iptables rules iptables -L [CHAIN] # List active iptables rules for given chain name iptables -L -v # List active iptables rules and show adapters iptables -S # List active in iptables-save-format iptables -F # Flush active rules
In case of iptables -L being very slow try:
iptables -L -n # List active iptables with numeric output
Parameter -n leads to showing numeric values. This prevents reverse DNS lookup for IP Adresses possibly slowing the whole process.
Create Blocking Rules Manually
Block individual IP address:
sudo iptables -A INPUT -s 1.2.3.4 -j DROP
Works with range of IP addresses as well:
sudo iptables -A INPUT -s 1.2.3.0/24 -j DROP
Make it permanent then:
netfilter-persistent save
Checking How Many Packets Dropped
sudo iptables -L INPUT -v --line-numbers
Deleting Iptables Rules
List the rules with line numbers:
sudo iptables -L [CHAIN] –-line-numbers
i.e.:
sudo iptables -L INPUT –line-numbers
Delete a rule by its number in a specific chain:
sudo iptables -D [CHAIN] [number]
i.e.:
sudo iptables -D INPUT 4
Delete by rule specification:
sudo iptables -D [CHAIN] -p [PROTOCOL] –dport [PORT] -j [TARGET]
iptables on Debian
Add iptables Rule File
Copy iptables.rules to /etc
chown root:root iptables.rules chmod 600 iptables.rules iptables-restore < iptables.rules
Check, if still works.
Enable Automatic Load of Rules at Startup
Copy iptables-restore script to /etc/network/if-pre-up.d/
Add execution permissions:
chmod +x iptables
The package iptables-persistent which also can be used for persisting iptables:
# apt-get install iptables-persistent
