man iptables when installed. It may also be found in /sbin/iptables, but since iptables is more like a service rather than an "essential binary", the preferred location remains .
The term ''iptables'' is also commonly used to inclusively refer to the kernel-level components. ''x_tables'' is the name of the kernel module carrying the shared code portion used by all four modules that also provides the API used for extensions; subsequently, ''Xtables'' is more or less used to refer to the entire firewall (v4, v6, arp, and eb) architecture.
iptables superseded Overview
iptables allows thePREROUTING: Packets will enter this chain before a routing decision is made.
* INPUT: Packet is going to be locally delivered. It does not have anything to do with processes having an opened socket; local delivery is controlled by the "local-delivery" routing table: ip route show table local.
* FORWARD: All packets that have been routed and were not for local delivery will traverse this chain.
* OUTPUT: Packets sent from the machine itself will be visiting this chain.
* POSTROUTING: Routing decision has been made. Packets enter this chain just before handing them off to the hardware.
A chain does not exist by itself; it belongs to a ''table''. There are three tables: ''nat'', ''filter'', and ''mangle''. Unless preceded by the option ''-t'', an iptables command concerns the ''filter'' table by default. For example, the command iptables -L -v -n, which shows some chains and their rules, is equivalent to iptables -t filter -L -v -n. To show chains of table ''nat'', use the command iptables -t nat -L -v -n
Each rule in a chain contains the specification of which packets it matches. It may also contain a ''target'' (used for extensions) or ''verdict'' (one of the built-in decisions). As a packet traverses a chain, each rule in turn is examined. If a rule does not match the packet, the packet is passed to the next rule. If a rule does match the packet, the rule takes the action indicated by the target/verdict, which may result in the packet being allowed to continue along the chain or may not. Matches make up the large part of rulesets, as they contain the conditions packets are tested for. These can happen for about any layer in the OSI model, as with e.g. the --mac-source and -p tcp --dport parameters, and there are also protocol-independent matches, such as -m time.
The packet continues to traverse the chain until either
# a rule matches the packet and decides the ultimate fate of the packet, for example by calling one of the ACCEPT or DROP, or a module returning such an ultimate fate; or
# a rule calls the RETURN verdict, in which case processing returns to the calling chain; or
# the end of the chain is reached; traversal either continues in the parent chain (as if RETURN was used), or the base chain policy, which is an ultimate fate, is used.
Targets also return a verdict like ACCEPT (NAT modules will do this) or DROP (e.g. the REJECT module), but may also imply CONTINUE (e.g. the LOG module; CONTINUE is an internal name) to continue with the next rule as if no target/verdict was specified at all.
Userspace utilities
Front-ends
There are numerous third-party software applications for iptables that try to facilitate setting up rules. Front-ends in textual or graphical fashion allow users to click-generate simple rulesets; scripts usually refer to shell scripts (but other scripting languages are possible too) that call iptables or (the faster)iptables-restore with a set of predefined rules, or rules expanded from a template with the help of a simple configuration file. Linux distributions commonly employ the latter scheme of using templates. Such a template-based approach is practically a limited form of a rule generator, and such generators also exist in standalone fashion, for example, as PHP web pages.
Such front-ends, generators and scripts are often limited by their built-in template systems and where the templates offer substitution spots for user-defined rules. Also, the generated rules are generally not optimized for the particular firewalling effect the user wishes, as doing so will likely increase the maintenance cost for the developer. Users who reasonably understand iptables and want their ruleset optimized are advised to construct their own ruleset.
Other notable tools
* FireHOL – a shell script wrapping iptables with an easy-to-understand plain-text configuration file * NuFW – an authenticating firewall extension to Netfilter * Shorewall – a gateway/firewall configuration tool, making it possible to use easier rules and have them mapped to iptablesSee also
* nftables * NPF (firewall) * PF (firewall) *References
Literature
*External links