IPTables - Revision history

Kamran: /* Diagram */

2011-04-03T18:20:09Z

Diagram

← Older revision		Revision as of 18:20, 3 April 2011
Line 63:		Line 63:
	</pre>		</pre>

-	===~~Diagram~~===	+	===Packet Traversal between various chains===
	[[File:IPTables-Chains-1.png]]		[[File:IPTables-Chains-1.png]]

Kamran: /* CBTs */

2011-04-03T07:04:51Z

CBTs

← Older revision		Revision as of 07:04, 3 April 2011
Line 69:		Line 69:
	A series of CBTs is also released on WBITT, covering the same topic, in Urdu. English version will soon be released.		A series of CBTs is also released on WBITT, covering the same topic, in Urdu. English version will soon be released.

-	[[http://techsnail.com/cbts-training-videos/urdu-cbt-understanding-iptables/ ~~[Urdu CBT]~~ Understanding IPTables]]	+	[[http://techsnail.com/cbts-training-videos/urdu-cbt-understanding-iptables/ Understanding IPTables, Urdu CBT]]

	==References==		==References==

Kamran: /* CBTs */

2011-04-03T07:02:34Z

CBTs

← Older revision		Revision as of 07:02, 3 April 2011
Line 67:		Line 67:

	==CBTs==		==CBTs==
-	A series of CBTs is also released covering the same topic in Urdu.	+	A series of CBTs is also released on WBITT, covering the same topic, in Urdu. English version will soon be released.

-	[[http://techsnail.com/cbts-training-videos/urdu-cbt-understanding-iptables/ Urdu CBT Understanding IPTables]]	+	[[http://techsnail.com/cbts-training-videos/urdu-cbt-understanding-iptables/ [Urdu CBT] Understanding IPTables]]

	==References==		==References==

Kamran: /* References */

2011-04-03T07:00:27Z

References

← Older revision		Revision as of 07:00, 3 April 2011
Line 65:		Line 65:
	===Diagram===		===Diagram===
	[[File:IPTables-Chains-1.png]]		[[File:IPTables-Chains-1.png]]
		+
		+	==CBTs==
		+	A series of CBTs is also released covering the same topic in Urdu.
		+
		+	[[http://techsnail.com/cbts-training-videos/urdu-cbt-understanding-iptables/ Urdu CBT Understanding IPTables]]

	==References==		==References==

Kamran: /* References */

2011-04-02T20:17:32Z

References

← Older revision		Revision as of 20:17, 2 April 2011
Line 71:		Line 71:
	* http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html		* http://www.frozentux.net/iptables-tutorial/iptables-tutorial.html
	* http://people.netfilter.org/~rusty/unreliable-guides/		* http://people.netfilter.org/~rusty/unreliable-guides/
		+	* http://www.linfo.org/kernel_space.html

Kamran: /* Introduction */

2011-04-02T18:24:26Z

Introduction

← Older revision		Revision as of 18:24, 2 April 2011
Line 19:		Line 19:

	==Introduction==		==Introduction==
-	IPTables is the mechanism for packet "Filter"-ing, in modern Linux distributions. In addition to packet filtering, it also does other interesting things such as "NAT"-ing and "Mangle"-ing. To be more specific, IPTables (originally from the NetFileter project), is the user-land application, which is used to manage/configure various packet handling "tables" provided in the Linux kernel (Linux Kernel Firewall).	+	IPTables is the mechanism for packet "Filter"-ing, in modern Linux distributions. In addition to packet filtering, it also does other interesting things such as "NAT"-ing and "Mangle"-ing. To be more specific, IPTables (originally from the NetFileter project), is the user-land application, which is used to manage/configure various packet handling "tables" provided in the Linux kernel (Linux Kernel Firewall). Check http://www.linfo.org/kernel_space.html for a definition of Kernel Space and User Space.

	[[File:Kerner-user-space.png]]		[[File:Kerner-user-space.png]]

Kamran: /* Introduction */

2011-04-02T18:14:44Z

Introduction

← Older revision		Revision as of 18:14, 2 April 2011
Line 19:		Line 19:

	==Introduction==		==Introduction==
-	IPTables is the mechanism for packet "Filter"-ing, in modern Linux distributions. In addition to packet filtering, it also does other interesting things such as "NAT"-ing and "Mangle"-ing. To be more specific, IPTables (originally from the NetFileter project), is the user-land application, which is used to manage/configure various packet handling "tables" provided in the Linux kernel (Linux Kernel Firewall). Each table has certain "chains" in it, and each chain has certain "rules", against which each packet is evaluated. IPTables is the default packet handling application in 2.4 and 2.6 series kernels. In 2.2 series kernels the application was "IPChains"; and in 2.0 series kernel, it was "IPFWAdm".	+	IPTables is the mechanism for packet "Filter"-ing, in modern Linux distributions. In addition to packet filtering, it also does other interesting things such as "NAT"-ing and "Mangle"-ing. To be more specific, IPTables (originally from the NetFileter project), is the user-land application, which is used to manage/configure various packet handling "tables" provided in the Linux kernel (Linux Kernel Firewall).
		+
		+	[[File:Kerner-user-space.png]]
		+
		+	Each table has certain "chains" in it, and each chain has certain "rules", against which each packet is evaluated. IPTables is the default packet handling application in 2.4 and 2.6 series kernels. In 2.2 series kernels the application was "IPChains"; and in 2.0 series kernel, it was "IPFWAdm".

	<b>Note:</b> IPTables deal with IPV4 traffic. IP6Tables are used to control IPV6 traffic. ARPTables are used to control ARP traffic. And ebtables are used to control traffic crossing bridges.		<b>Note:</b> IPTables deal with IPV4 traffic. IP6Tables are used to control IPV6 traffic. ARPTables are used to control ARP traffic. And ebtables are used to control traffic crossing bridges.

Kamran: /* The moving parts of IPTables */

2011-04-01T20:00:59Z

The moving parts of IPTables

← Older revision		Revision as of 20:00, 1 April 2011
Line 39:		Line 39:
	Commonly used tables are: filter, nat, mangle. Each table has specific role in handling the traffic passing through it, briefly described below.		Commonly used tables are: filter, nat, mangle. Each table has specific role in handling the traffic passing through it, briefly described below.
	* Filter table: Consists of INPUT, FORWARD and OUTPUT chains. Any filtering decisions to ACCEPT, REJECT, or DROP packets are made here.		* Filter table: Consists of INPUT, FORWARD and OUTPUT chains. Any filtering decisions to ACCEPT, REJECT, or DROP packets are made here.
-	* NAT table: Consists of PREROUTING, POSTROUTING and OUTPUT chains. The chains in the NAT table cannot be used for filtering. Possible targets are: DNAT, SNAT, MASQUERADE.	+	* NAT table: Consists of PREROUTING, POSTROUTING and OUTPUT chains. The chains in the NAT table cannot be used for filtering. Possible targets are: DNAT, SNAT, MASQUERADE, REDIRECT.
	* Mangle table: Consists of PREROUTING, INPUT, FORWARD, OUTPUT and POSTROUTING chains. Packets are marked with special "markers", which are later used to identify / differentiate different traffic. Mangle is also used to manipulate various parts of the packet, such as modifying the TTL value, etc.		* Mangle table: Consists of PREROUTING, INPUT, FORWARD, OUTPUT and POSTROUTING chains. Packets are marked with special "markers", which are later used to identify / differentiate different traffic. Mangle is also used to manipulate various parts of the packet, such as modifying the TTL value, etc.

Kamran: /* The moving parts of IPTables */

2011-04-01T19:53:16Z

The moving parts of IPTables

← Older revision		Revision as of 19:53, 1 April 2011
Line 39:		Line 39:
	Commonly used tables are: filter, nat, mangle. Each table has specific role in handling the traffic passing through it, briefly described below.		Commonly used tables are: filter, nat, mangle. Each table has specific role in handling the traffic passing through it, briefly described below.
	* Filter table: Consists of INPUT, FORWARD and OUTPUT chains. Any filtering decisions to ACCEPT, REJECT, or DROP packets are made here.		* Filter table: Consists of INPUT, FORWARD and OUTPUT chains. Any filtering decisions to ACCEPT, REJECT, or DROP packets are made here.
-	* NAT table: Consists of PREROUTING, POSTROUTING and OUTPUT chains. The chains in the NAT table cannot be used for filtering.	+	* NAT table: Consists of PREROUTING, POSTROUTING and OUTPUT chains. The chains in the NAT table cannot be used for filtering. Possible targets are: DNAT, SNAT, MASQUERADE.
	* Mangle table: Consists of PREROUTING, INPUT, FORWARD, OUTPUT and POSTROUTING chains. Packets are marked with special "markers", which are later used to identify / differentiate different traffic. Mangle is also used to manipulate various parts of the packet, such as modifying the TTL value, etc.		* Mangle table: Consists of PREROUTING, INPUT, FORWARD, OUTPUT and POSTROUTING chains. Packets are marked with special "markers", which are later used to identify / differentiate different traffic. Mangle is also used to manipulate various parts of the packet, such as modifying the TTL value, etc.

Kamran: /* The moving parts of IPTables */

2011-04-01T19:19:30Z

The moving parts of IPTables

← Older revision		Revision as of 19:19, 1 April 2011
Line 58:		Line 58:
	LocalService/Port-->--[Output]-->--[POSTROUTING]-->--NetworkInterfaceCard-->--Wire		LocalService/Port-->--[Output]-->--[POSTROUTING]-->--NetworkInterfaceCard-->--Wire
	</pre>		</pre>
		+
		+	===Diagram===
		+	[[File:IPTables-Chains-1.png]]

	==References==		==References==