Moxa TC-6110-T-LX [36/117] User defined chains

Moxa TC-6110-T-LX [36/117] User defined chains
TC-6110 Linux User's Manual Managing Communications
3-18
4. The OUTPUT chain receives all outbound packets which are addressed to computers outside the local
intranet. All packets which are addressed to the local intranet served by the firewall will be filtered here, before
they continue outwards, onto the Internet.
5. The POSTROUTING chain is the very last chain that is applied; all outbound packets which are leaving the
local machine (or subnet) will pass through this chain. Packets which are processed by the POSTROUTING
chain have already been routed, but have not been sent over the Ethernet. This is where Netfilter performs
source address translation (SNAT), altering the source address forom the IP address that is used on the
local intranet to the one which identifies the firewall on the open Internet.
User-Defined Chains
User-defined chains are used to create customized filters for a wide variety of needs; however, there are some
commonly used chains which most administrators call when building a firewall. One example follows:
moxa@Moxa:~# iptables –N TCP && iptables –N UDP
This creates a user-defned chain called TCP and another called UDP, which you may use to manage protocols
later on. To see how to implement these chains in the INPUT chain, see below, Rule Examples: Applying
User-Defined Chains.
ATTENTION
To find out what rules are currently written into each table and chain, use the commands described below, in
the section
Viewing and Manipulating Rulesets.
Understanding Basic Traffic Flows
Users should recognize that these five chains may be used to build three fundamental traffic flows. Additionally,
certain chains are only associated with certain tables. For more information on which tables use which chains,
see the next section,
A) Forwarded packets will traverse this set of chains in the following order:
PREROUTING FORWARD
POSTROUTING
(in the NAT table)
(in the Filter table)
(in the NAT table)
B) Inbound traffic that is destined for the local subnet will traverse this set of chains:
PREROUTING INPUT
INPUT
(in the NAT table) (in the Mangle table) (in the Filter table)
A) Outbound traffic that is leaving the firewall will traverse this set of chains:
OUTPUT OUTPUT
POSTROUTING
(in the NAT table) (in the Mangle table) (in the Filter table)
ATTENTION
Building complex firewalls using the Netfilter rules and interface can become overwhelming, even for
experienced administrators. If you require advanced firewall capabilities, Moxa recommends using a Netfilter
configuration interface. One of the easi
est to learn and most powerful is the Shorewall Firewall. Shorewall is
available as a standard Debian package, and may be downloaded using apt
-
get. Shorewall documentation is
available at the Shorewall website, found at
http://www.shorewall.net.

Содержание

Похожие устройства

Скачать