Monthly Archives: September 2016

Basic Guide on IPTables (Linux Firewall) Tips / Commands

This tutorial guides you how firewall works in Linux Operating system and what is IPTables in Linux? Firewall decides fate of packets incoming and outgoing in system. IPTables is a rule based firewall and it is pre-installed on most of Linux operating system. By default it runs without any rules. IPTables was included in Kernel 2.4, prior it was called ipchains or ipfwadm. IPTables is a front-end tool to talk to the kernel and decides the packets to filter. This guide may help you to rough idea and basic commands of IPTables where we are going to describe practical iptables rules which you may refer and customized as per your need.

Different services is used for different protocols as:

  1. iptables applies to IPv4.
  2. ip6tables applies to IPv6.
  3. arptables applies to ARP.
  4. ebtables applies to Ethernet frames..

IPTables main files are:

  1. /etc/init.d/iptables – init script to start|stop|restart and save rulesets.
  2. /etc/sysconfig/iptables – where Rulesets are saved.
  3. /sbin/iptables – binary.

There are at present three tables.

  • Filter
  • NAT
  • Mangle

Continue reading →

The Beginner’s Guide to iptables, the Linux Firewall

About iptables

iptables is a command-line firewall utility that uses policy chains to allow or block traffic. When a connection tries to establish itself on your system, iptables looks for a rule in its list to match it to. If it doesn’t find one, it resorts to the default action.

iptables almost always comes pre-installed on any Linux distribution. To update/install it, just retrieve the iptables package:

sudo apt-get install iptables

 

Continue reading →

Block an IP address or an IP range with Iptables

1. Block an IP address or an IP range with Iptables

To block a hacker, you need to block its IP address in the firewall on your Linux server.
For this, we will use iptables to block incoming traffic from the IP address “xx.xx.xx.xx” (where xx.xx.xx.xx is the IP address of the hacker).

Code : Bash

1
iptables -I INPUT -s xx.xx.xx.xx -j DROP

If the hacker uses an IP range (for example : 10.0.0.10, 10.0.0.11, 10.0.0.12, … 10.0.0.20), simply use this command :

Code : Bash

1
iptables -I INPUT -m iprange --src-range 10.0.0.10-10.0.0.20 -j DROP

If you want to block the outgoing connection (your server => other servers) to an IP range, use the “–dst-range” parameter instead of the “–src-range” parameter.
Thus, your server will no longer be able to send data to this IP range.

Code : Bash

1
iptables -I INPUT -m iprange --dst-range 10.0.0.10-10.0.0.20 -j DROP

 

Continue reading →