• Choose a category
• All
• Classic-Fiction

By Root 443 0

program, which takes each of the rules listed in the ipt.save file and instantiates it within a running kernel. A single execution of the iptables-restore program recreates an entire iptables policy in the kernel; multiple executions of the iptables program are not necessary. This makes the iptables-save and iptables-restore commands ideal for rapid deployment of iptables rulesets, and I illustrate this process with the following two commands:

[iptablesfw]# iptables-save > /root/ipt.save

[iptablewfw]# cat /root/ipt.save | iptables-restore

The contents of the ipt.save file are organized by iptables table, and within each section devoted to an individual table, ipt.save is further organized by iptables chain. A line that begins with an asterisk (*) character followed by a table name (such as filter) denotes the beginning of a section in the ipt.save file that describes a particular table. Following this are lines that track packet and bytes counts for each chain associated with the table.

The next portion of the ipt.save file is a complete description of all iptables rules organized by chain. These lines allow the actual iptables ruleset to be reconstructed by iptables-restore; even including packet and byte counts for each rule if the -c option to iptables-save is used.

Lastly, the word COMMIT on a line by itself concludes the section of the ipt.save file that characterizes the iptables table. This line constitutes the ending marker for all information associated with the table. Below is a complete example of what the filter table section looks like once we have executed all of the iptables commands up to this point in the chapter:

# Generated by iptables-save v1.3.7 on Sat Apr 14 17:35:22 2007

*filter

:INPUT DROP [0:0]

:FORWARD DROP [0:0]

:OUTPUT DROP [2:112]

-A INPUT -m state --state INVALID -j LOG --log-prefix "DROP INVALID "

--log-tcp-options --log-ip-options

-A INPUT -m state --state INVALID -j DROP

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -s ! 192.168.10.0/255.255.255.0 -i eth1 -j LOG --log-prefix "SPOOFED PKT "

-A INPUT -s ! 192.168.10.0/255.255.255.0 -i eth1 -j DROP

-A INPUT -s 192.168.10.0/255.255.255.0 -i eth1 -p tcp -m tcp --dport 22 --tcp-flags

FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT

-A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A INPUT -i ! lo -j LOG --log-prefix "DROP " --log-tcp-options --log-ip-options

-A FORWARD -m state --state INVALID -j LOG --log-prefix "DROP INVALID "

--log-tcp-options --log-ip-options

-A FORWARD -m state --state INVALID -j DROP

-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

-A FORWARD -s ! 192.168.10.0/255.255.255.0 -i eth1 -j LOG --log-prefix "SPOOFED PKT "

-A FORWARD -s ! 192.168.10.0/255.255.255.0 -i eth1 -j DROP

-A FORWARD -s 192.168.10.0/255.255.255.0 -i eth1 -p tcp -m tcp --dport 21 --tcp-flags

FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT

-A FORWARD -s 192.168.10.0/255.255.255.0 -i eth1 -p tcp -m tcp --dport 22 --tcp-flags

FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT

-A FORWARD -s 192.168.10.0/255.255.255.0 -i eth1 -p tcp -m tcp --dport 25 --tcp-flags

FIN,SYN,RST,ACK SYN -m state --state NEW -j ACCEPT

-A FORWARD -p tcp -m tcp --dport 80 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state

NEW -j ACCEPT

-A FORWARD -p tcp -m tcp --dport 443 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state

NEW -j ACCEPT

-A FORWARD -p udp -m udp --dport 53 -m state --state NEW -j ACCEPT

-A FORWARD -p icmp -m icmp --icmp-type 8 -j ACCEPT

-A FORWARD -i ! lo -j LOG --log-prefix "DROP " --log-tcp-options --log-ip-options

-A OUTPUT -m state --state INVALID -j LOG --log-prefix "DROP INVALID "

--log-tcp-options --log-ip-options

-A OUTPUT -m state --state INVALID -j DROP

-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A OUTPUT -p tcp -m tcp --dport 21 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state

NEW -j ACCEPT

-A OUTPUT -p tcp -m tcp --dport 22 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state

NEW -j ACCEPT

-A OUTPUT -p tcp -m tcp --dport 25 --tcp-flags FIN,SYN,RST,ACK SYN -m state --state