Moxa TC-6110-LX [41/117] Writing rulechains

Moxa TC-6110-LX [41/117] Writing rulechains
TC-6110 Linux User's Manual Managing Communications
3-23
There must be no references to the chain in other chains or tables, and the chain must be empty, i.e. not
contain any rules. You must delete or replace any remaining referring rules before the chain can be deleted. If
no argument is given, this will attempt to delete every user defined chain in the table.
Writing Rulechains
In this section we show you how to write rules for a simple industrial network firewall. More complicated
firewallssuch as those serving public networks, or untrusted customersare beyond the scope of this
manual. For advanced firewall needs, Moxa recommends the use of the Shoreline Firewall, mentioned
above .
MOXA:~# iptables [-t table] [-AI] [INPUT, OUTPUT, FORWARD] [-io interface] /
[-p tcp, udp, icmp, all] [-s IP/network] [--sport ports] [-d IP/network] /
[--dport ports] –j [ACCEPT. DROP]
-A: Append one or more rules to the end of the selected chain
-I: Insert one or more rules in the selected chain as the given rule number
-i: Identifies an interface which will received a packet
-o: Identifies an interface over which a packet will be sent
-p: Identifies the protocol to be filtered
-s: Identifies a source address (network name, host name, network IP address, or plain IP address)
--sport: Identifies the source port, or the port where the packet originated
-d: Identifies the destination address (network name, host name, NAT or IP address)
--dport: Identifies the destination port, or the port where the packet will terminate
-j: Jump target. Specifies the target of the rules; i.e., how to handle matched packets.
For example, ACCEPT the packet, DROP the packet, or LOG the packet.
WARNING
For all firewalls using a strict DROP policy on incoming packets, be sure to include a rule that accepts packets
on the loopback interface:
moxa@MOXA:~# iptables –A INPUT –i lo –j ACCEPT
Examples:
REQUIRED RULE for all firewalls:
Accept all packets from the loopback interface:
# iptables –A INPUT –i lo –j ACCEPT
RECOMMENDED RULE from the sample firewall provided in Appendix C: Sample Scripts:
Allow all traffic from that belongs to established connections, or new, related traffic:
# iptables -A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
RECOMMENDED RULE from the sample firewall provided in Appendix C: Sample Scripts:
Drops all traffic with an invalid state, e.g. “Port Unreachable” when nothing was sent to the host, invalid
headers or checksums, and out-of-sequence packets:
# iptables -A INPUT -m conntrack --ctstate INVALID -j DROP
Basic Filter Rules show examples of how you can open commonly opened ports:
Web server / HTTP:
# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
Secure-sockets web server / HTTPS:
# iptables -A INPUT -p tcp --dport 443 -j ACCEPT
Remote SSH Connections (REQUIRED RULE):
# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
Incoming UDP Streams:
# iptables -A INPUT -p udp --dport 53 -j ACCEPT

Содержание

Похожие устройства

Скачать