The Linux kernel contains advanced tools for packet filtering, the process of controlling network packets as they attempt to enter, move through, and exit your system. Pre-2.4 kernels contained the ability to manipulate packets using ipchains which used lists of rules that apply to packets at each step of the filtering process. The introduction of the 2.4 kernel brought with it iptables, which is similar to ipchains but greatly expands on the scope and control available when filtering packets.
This chapter focuses on essential packet filtering basics, defining the differences between ipchains and iptables, explaining various options available with iptables commands, and showing how filtering rules can be preserved between system reboots.
If you require instructions for constructing iptables rules or setting up a firewall based on these rules, please see the Official Red Hat Linux Customization Guide.
Traffic moves through a network in packets, which are collections of data in particular sizes. A file sent over a network between two computers may be comprised of many packets, each of which holds a small part of the file data. The sending computer takes the file and breaks it into packets to be sent over the network, using the rules of the particular network protocol being utilized. The other computer receives the packets and, using the method specified by the protocol, reassembles the packets into the file.
Every packet contains information which helps it navigate the network and move to its destination. The packet can tell computers along the way, as well as the destination machine, where it came from, where it is going, and what type of packet it is, among other things. Most packets are designed to carry data, although some protocols use packets in special ways. The Transmission Control Protocol (TCP), for example, uses a SYN packet, which contains no data, to initiate a communication between two systems.
The Linux kernel contains the built-in ability to filter packets, allowing some of them into the system while stopping others in their tracks. The 2.4 kernel contains three tables of chains; here we describe the filter table. The filter table contains three sets of rule lists by default, called the INPUT, OUTPUT, and FORWARD chains; every packet being sent in or out of the machine is subject to one of these lists of rules. When a packet enters the system via a network interface, the kernel decides if it is destined for the local system (INPUT chain) or another destination (FORWARD chain) to determine the rule list to use with it. In the same way, if a packet originates on the system and attempts to leave the system, the kernel will check it against the OUTPUT chain.
Each packet may need be checked against many, many rules before emerging at the end of the chain. The structure and purpose of these rules may vary, but they usually seek to identify a packet coming from or going to a particular IP address or set of addresses when using a particular protocol and network service.
Regardless of their destination, when packets match a particular rule on one of the rule lists, they are designated for a particular target, or action to be applied to them. If the rule specifies an ACCEPT target for a matching packet, the packet skips the rest of the rule checks and is allowed to continue to its destination. If a rule specifies a DROP target, the packet is "dropped," meaning that the packet is refused access to the system and nothing is sent back to the host that sent the packet. If a rule specifies a REJECT target, the packet is dropped, but an error packet is sent to the packet's originator.
Every chain has a default policy to ACCEPT, DROP, or REJECT the packet, or possibly, QUEUE the packet to be passed to userspace. If none of the rules in the chain apply to the packet, then the packet is dealt with in accordance with the chain's defualt policy.
The iptables command allows you to configure these rule lists, as well as set up new chains and tables to be used for your particular situation.