Docu review done: Mon 20 Feb 2023 11:05:57 CET

Table of content

Commands General

CommandsDescription
iptables -vxnLdetaild view
iptables -t nat -L -nshows nat table
iptables --flushflushes iptables config
iptables -t [table] --flushflushes only [table] e.g. nat table (INPUT/OUTPUT is a chain and no table)
iptables -A [chain] ...Appends rule to chain [chain]
iptables -I [chain] ...Prepends rule to chain [chain]

Commands Add/Remove Incomeming/Outgoing traffic allow/reject/drop

CommandsDescription
iptables -A INPUT -s [sourceip] -p [tcp/udp] -m [tcp/udp] --dport [destport] -j [ACCEPT/REJECT/DROP]Appends a rule to allow/reject/drop incoming trafic from [sourceip] on destination port [destport] with protocoll [tcp/udp] in chain INPUT
iptables -D INPUT -s [sourceip] -p [tcp/udp] -m [tcp/udp] --dport [destport] -j [ACCEPT/REJECT/DROP]Removes a rule to allow/reject/drop incoming trafic from [sourceip] on destination port [destport] with protocoll [tcp/udp] in chain INPUT
iptables -I OUTPUT -d [destip] -p [tcp/udp] -m [tcp/udp] --dport [destport] -j [ACCEPT/REJECT/DROP]Prepands a rule to allow/reject/drop outgoing trafic to [destip] on destination port [destport] with protocoll [tcp/udp] in chain OUTPUT
iptables -D OUTPUT -d [destip] -p [tcp/udp] -m [tcp/udp] --dport [destport] -j [ACCEPT/REJECT/DROP]Removes a rule to allow/reject/drop outgoing trafic to [destip] on destination port [destport] with protocoll [tcp/udp] in chain OUTPUT

The rules does not need to have a port defined, you ca just run it without --dport and it will allow/reject/drop for all ports

Commands for VPNs

CommandsDescription
iptables -I FORWARD -i tun0 -o eth0 -s vpn.ip.0/24 -d local.ip.0/24 -m conntrack --ctstate NEW -j ACCEPTallows vpn to enter local networks
iptables -I FORWARD -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPTuesed for way back into vpn

Commands Forwarding

CommandsDescription
iptables -t nat -A PREROUTING -s SOURCEIP -p tcp --dport PORT -j DNAT --to-destination DESTIP:PORTforwards sourceIP:SourcePort to destIP:Port

forward with ip rewrite

Allos external sources connecting to 37.120.185.132:23 which forwards trafick to internal 10.13.37.33:22 and back

$ sysctl net.ipv4.conf.all.forwarding=1                                                                       #enable ipv4 forwarding
$ sysctl -p                                                                                                   #load all sysctlsettings
$ iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 23 -j DNAT --to-destination 10.13.37.33:22             #forward external port 23 to internal destination 10.13.37.33:22
$ iptables -A FORWARD -p tcp -d  10.13.37.33 --dport 22 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT    #allow connections got get forwarded to internal 10.13.37.33 with port 22
$ iptables -t nat -A POSTROUTING -o eth0 -p tcp --dport 22 -d 10.13.37.33 -j SNAT --to-source 37.120.185.132  #rewrite source ip for internal communication

Drop ssh connects if 3 connects in timeframe

This two iptables command should drop IPs which are connecting more than 3 times in a timeframe (– seconds 10)

$ iptables -A INPUT -p tcp --dport 22 -m recent --update --seconds 10 --hitcount 3 --name SSH --rsource -j DROP
$ iptables -A INPUT -p tcp --dport 22 -m recent --set --name SSH --rsource -j ACCEPT

Reackt on percentage of package

With the match statistic you can add the mode random + --probability to specify a the amount of packagesa to deal with in percent.

To specify the amount in percent, add the value as parameter to --probability assuming that 1.0 is 100%.

This means, that e.g. 50% would be --probability 0.5 as parameter.

In the samples below, we are dropping 25% of udp packages and 35% of tcp packages for one specific host.

$ iptables -A INPUT -p udp -m statistic -s 10.10.10.11 --mode random --probability 0.25 -j DROP
$ iptables -A OUTPUT -p udp -m statistic -d 10.10.10.11 --mode random --probability 0.25 -j DROP

$ iptables -A INPUT -p tcp -m statistic -s 10.10.10.11 --mode random --probability 0.35 -j DROP
$ iptables -A OUTPUT -p tcp -m statistic -d 10.10.10.11 --mode random --probability 0.35 -j DROP