Iptables is user space program to perform packet filtering via the defined rules. Although Iptables can also be used to perform Network Address Translation(NAT) and Quality Of Service(QOS) on packets, but in preliminary stage Iptables was suppose to filter packets passing through kernel. In this post, I will discover iptables as a packet filtering tool.
Like all other firewalls, Iptables also filters packets using the rules. Rule define the filtering conditions and corresponding action on packets. For example we may to define rule for "Reject all incoming traffic coming from IP 192.168.1.1"
When you suppose to write a rule, you will have to cope with "Where" and "What" question.
Where to write the rule?
what will be Condition and Action in rule? (Statement of Rule)
Let us first address "Where" part
Iptables consists many tables such as filter,nat, mangle etc. You have to put your rule in any one of iptables table. Selection of table depends on purpose of rule, for all filtering rules filter table will be selected. filter table is also the default table for rules, I mean if no table is defined in rule then you must understand that rule is defined in filter table.
After selection of table, you have to select chain inside table. There are three chain in filter table INPUT, OUTPUT and FORWARD. For filter table you can use any one of them. Selection of chain will depend on flow of traffic on which rule has to be applied
For incoming traffic - INPUT chain
For outgoing traffic - OUTPUT chain
For traffic forwarding through system - FORWARD chain
Now let us proceed with our example case "Reject all incoming traffic coming from IP 192.168.1.1".
Table selection: Since here packets from 192.168.1.1 has be filtered for rejection so, here we will use filter table.
Chain Selection: Since rule has be applied on incoming traffic so INPUT chain of filter table will be used.
By answering Table and Chain selection "Where" part cleared.
What rule
What part define condition and action part of rule. As per given example "Reject all incoming traffic coming from IP 192.168.1.1"
Condition: Source IP of traffic should be 192.168.1.1
Action: Reject the traffic
So once "where" and "what" part become crystal clear, You write define iptables rules as below
iptables -t filter -I INPUT -s 192.168.1.1 -j REJECT
In above rule,Inside filter table(-t filter) a rule has been inserted on top of INPUT chain(-I) . Rule's condition part is match the source IP and if it is 192.168.1.1 (-s 192.168.1.1) then action part is (-j REJECT)
You may also watch below video to understand Basics of iptables.
