Moxa TC-6110-T-LX [34/117] Ip tables and ip chains

Moxa TC-6110-T-LX [34/117] Ip tables and ip chains
TC-6110 Linux User's Manual Managing Communications
3-16
In Netfilter, a few fundamental rule tables are pre-defined, with each table containing built-in chains and
user-defined chains. Tables form the highest layer of organization for Netfilter’s rule sets, and rule chains
form the middle layer, by which individual rules are ordered. Each chain is a list of rules that are applied (or not)
to a packets as they traverse the chains. Each rule specifies what to do with a matching packet. A rule (such
as a jump to a user-defined chain in the same table, or an order to drop a certain type of packet) is also called
a target.
Netfilter is based around three fundamental tables: Filter tables, NAT tables, and Mangle tables. These
tables in turn are structured around a few basic, built-in rule chains. There are five basic rule chains:
PREROUTING, INPUT, FORWARDING, OUTPUT, and POSTROUTING. In addition to these five built-in chains, it
is possible for users to add user-defined chains of their own devising, and insert them into the filtering and
mangling procedures wherever they are needed. Thus, Netfilter may be said to have three layers: the most
basic is the rules layer, the next is the chains layer (which order the rules), and the final is the table layer,
which orders the rule chains.
Overview of Basic Netfilter Architecture:
(1) IP Tables and IP Chains Review
(a) The NAT Table
(b) The Filter Table
(c) The Mangle Table
(2) Understanding Basic Traffic Flows
(a) Netfilter Hierarchy for Incoming Packets
(3) Connection Tracking
Building the Firewall: Writing Filter Rules
(4) Policies: Setting Default Firewall Behavior
(5) Viewing and Manipulating Rulesets
(6) Writing Rulechains
Setting Up NAT
ATTENTION
For more information on configuri
ng Netfilter/iptables, you may consult the official project website.
Homepage:
http://www.netfilter.org/
Documentation:
http://www.netfilter.org/documentation/index.html#documentation-howto
Neftilter Extensions:
http://www.netfilter.org/documentation/HOWTO//netfilter-extensions-HOWTO.html
IP Tables and IP Chains
The highest layer of organization in Netfilter is the table layer. This is where all of the rule chains are
organized. Rule chains are ordered lists of packet filtering and packet mangling rules; each chain represents a
basic flow of operations to be performed on a packet at that stage. Where chains are prioritized lists of rules,
tables are prioritized lists of chains. Additionally, each of Netfilter’s built-in tables comes with a set of built-in
chains that are associated with it; these chains set the basic path packets will traverse as they are processed
by Netfilter. To view and manipulate (delete, flush, and add) rule tables, rulechains, and individual rules, refer
to the section below, Manipulating Rulesets.
The NAT Table
The NAT table is the first table that all packets will encounter; no filtering takes place in this table. The only
packet alterations enforced by the NAT table are changes to the source and destination addresses;
moreover, only the first packet of a new connection will traverse this table: after the first packet in a
connection has been processed, the result will be automatically applied to all future packets in the same
connection (for more information on connections, see the section Connection Tracking, in this same chapter,
below).

Содержание

Похожие устройства

Скачать