Moxa TC-6110-T-LX [39/117] Viewing and manipulating rulesets

Moxa TC-6110-T-LX [39/117] Viewing and manipulating rulesets
TC-6110 Linux User's Manual Managing Communications
3-21
INPUT, OUTPUT, FORWARD, PREROUTING, OUTPUT, and POSTROUTING. Possible policies that may be
enforced on these chains are ACCEPT, DROP, QUEUE, and RETURN (see below for explanation).
INPUT: Targets packets coming into the TC-6110-LX over the filter, mangle, or security tables.
OUTPUT: Targets locally-generated packets leaving the TC-6110-LX. All tables have an output chain.
FORWARD: Targets packets routed through the machine, on the filter, mangle, or security tables.
PREROUTING: Targets packets for alteration before they have traversed the firewall; used on the NAT,
mangle, and raw tables.
POSTROUTING: Targets packets as they are about to be sent out over the NAT and mangle tables.
Policy Arguments:
ACCEPT: By default, all packets are let through the chain.
DROP: Packets are dropped, with no notification or response sent back to the originating computer.
QUEUE: Passes the packet to userspace; see NFQUEUE in Netfilter/iptables documentation for more
information about how these targets are used.
RETURN: Stop traversing this chain and resume at the next rule in the previous (calling) chain.
REJECT: Equivalent to DROP, but it returns a message to the packets origin.
LOG: Turns on kernel logging for matching packets, printing information on all matching packets on the
kernel log where it may be read using dmesg or syslogd.
Netfilter Policy Examples:
moxa@Moxa:~# iptables –P INPUT DROP
This changes the default policy so that all incoming packets on all chains are dropped, with no notification.
This is Moxa’s recommended setting for the input interface.
moxa@Moxa:~# iptables –P OUTPUT ACCEPT
This rule acceps all outgoing packets that originate on the local network, and is acceptable for a strictly
secure internal network. If you change this policy to DROP it will considerably increase the complexity of the
firewall. However, you may wish to consider this for computers that will be serving as a firewall to untrusted
customers. For instance, to guarantee security on a train computer that will be serving wireless connections
from outside the train tolocal passengers, the default rule always be DROP, with only specific, secure protocols
and services allowed through on a rule-by-rule basis.
To help with the construction of advanced firewalls, Moxa recommends use of the Shoreline Firewall,
mentioned above.
moxa@Moxa:~# iptables –P FORWARD DROP
This sets the FORWARD chain in the filter table to DROP all packets. This is the recommended policy for
all firewalls, and may be safely used on devices occupying a terminal segment in the network topology, this
is the appropriate rule.
moxa@Moxa:~# iptables –t nat –P PREROUTING ACCEPT
The nat tables are for address translation, not for filtering. The PREROUTING chain for the NAT should be set
to ACCEPT, otherwise connection initialization packets will not be able to get through the firewall.
moxa@Moxa:~# iptables –t nat –P OUTPUT ACCEPT
The nat tables are for address translation, not for filtering. The OUTPUT chain for the NAT should be set to
ACCEPT, otherwise connection initialization packets will not be able to get through the firewall.
moxa@Moxa:~# iptables -t nat –P POSTROUTING ACCEPT
The nat tables are for address translation, not for filtering. The POSTROUTING chain for the NAT should be
set to ACCEPT, otherwise connection initialization packets will not be able to get through the firewall.
Viewing and Manipulating Rulesets
Beginning with this section you will be provided some examples of rules commonly used to manipulate, view,
and configure simple firewalls for industrial enviroments. For simple setups, typically only three or four rules
are needed to give a device strong protecation against unauthorized network intrusions.

Содержание

Похожие устройства

Скачать