blog

12020-04-05

SEAN K.H. LIAO

iptables basics

FILTER is the default table, traffic passes through 1 of 3 chains { INPUT, FORWARD, OUTPUT } (most of the time)

container traffic passes through FORWARD

PREROUTING, POSTROUTING only available on RAW, MANGLE

PREROUTING ─┬──── FORWARD ────┬─ POSTROUTING
            │                 │
      INPUT │                 │ OUTPUT
            │                 │
            └─ local process ─┘

filter traffic

chain modifiers:

selectors:

actions:

iptables -P FORWARD ACCEPT
iptables -A FORWARD -s 0.0.0.0/0 -d 1.2.3.4/32 -p tcp --dport 80 -j ACCEPT

allow established connections through

iptables -A INPUT -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT
iptables -A FORWARD -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT