iptables notes

finally getting round to remembering iptables

SEAN K.H. LIAO

iptables notes

finally getting round to remembering iptables

iptables basics

FILTER is the default table, traffic passes through 1 of 3 chains { INPUT, FORWARD, OUTPUT } (most of the time)

container traffic passes through FORWARD

PREROUTING, POSTROUTING only available on RAW, MANGLE

1PREROUTING ─┬──── FORWARD ────┬─ POSTROUTING
2            │                 │
3      INPUT │                 │ OUTPUT
4            │                 │
5            └─ local process ─┘

filter traffic

chain modifiers:

selectors:

actions:

1iptables -P FORWARD ACCEPT
2iptables -A FORWARD -s 0.0.0.0/0 -d 1.2.3.4/32 -p tcp --dport 80 -j ACCEPT

allow established connections through

1iptables -A INPUT -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT
2iptables -A OUTPUT -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT
3iptables -A FORWARD -m conntrack --cstate RELATED,ESTABLISHED -j ACCEPT