Tables
|
Chains
|
FILTER
|
|
NAT
|
- PREROUTING
- OUTPUT
- POSTROUTING
|
MANGLE
(modify ip headers)
|
- PREROUTING
- POSTROUTING
- OUTPUT
- INPUT
- FORWARD
|
RAW
(connection tracking)
|
|
SECURITY
|
|
|
|
Targets
|
valid in
|
REJECT
|
|
DROP
|
|
ACCEPT
|
|
RETURN
|
|
MASQUERADE
|
POSTROUTING
|
REDIRECT
|
NAT: PREROUTING + NAT: OUTPUT
|
|
Basics
iptables
-A (append - add rule at end) -i (input interface) -j (target)
-C (check) -o (output interface)
-D (delete - remove rule) -s (source address)
-F (flush - remove all rules) -d (destination address)
-I (insert - add at position)
-L (list - show all rules in chain) -p (protocol (tcp/udp))
-N (new chain) --dport (port)
-X (delete chain)
-t (table to manipulate (default: filter)
-n (numeric output of addresses and ports)
View state
iptables -L
raspi wifi to ethernet
- rc.local
- iptables --table nat --append POSTROUTING --out-interface wlan0 -j MASQUERADE
- iptables --append FORWARD --in-interface eth0 -j ACCEPT