This chapter focuses on essential packet filtering basics, defining the
differences between ipchains and
iptables, explaining various options available with
iptables commands, and showing how
filtering rules can be preserved between system reboots.
Traffic moves through a network in packets, which
are collections of data in particular sizes. A file sent over a network
between two computers may be comprised of many packets, each of which
holds a small part of the file data. The sending computer takes the file
and breaks it into packets to be sent over the network, using the rules
of the particular network protocol being utilized. The other computer
receives the packets and, using the method specified by the protocol,
reassembles the packets into the file.
Every packet contains information which helps it navigate the network and
move to its destination. The packet can tell computers along the way, as
well as the destination machine, where it came from, where it is going,
and what type of packet it is, among other things. Most packets are
designed to carry data, although some protocols use packets in special
ways. The Transmission Control Protocol (TCP),
for example, uses a SYN packet, which contains no data, to initiate
a communication between two systems.
The Linux kernel contains the built-in ability to filter packets,
allowing some of them into the system while stopping others in their
tracks. The 2.4 kernel contains three tables of chains; here we describe
the filter table. The filter table contains three sets of rule lists by
default, called the INPUT, OUTPUT, and FORWARD chains; every packet
being sent in or out of the machine is subject to one of these lists of
rules. When a packet enters the system via a network interface, the
kernel decides if it is destined for the local system (INPUT chain) or
another destination (FORWARD chain) to determine the rule list to use
with it. In the same way, if a packet originates on the system and
attempts to leave the system, the kernel will check it against the
OUTPUT chain.
Each packet may need be checked against many, many rules before emerging
at the end of the chain. The structure and purpose of these rules may
vary, but they usually seek to identify a packet coming from or going to
a particular IP address or set of addresses when using a particular
protocol and network service.
Regardless of their destination, when packets match a particular rule on
one of the rule lists, they are designated for a particular
target, or action to be applied to them. If the
rule specifies an ACCEPT target for a matching packet, the packet skips
the rest of the rule checks and is allowed to continue to its
destination. If a rule specifies a DROP target, the packet is "dropped,"
meaning that the packet is refused access to the system and nothing is
sent back to the host that sent the packet. If a rule specifies a REJECT
target, the packet is dropped, but an error packet is sent to the
packet's originator.
Every chain has a default policy to ACCEPT, DROP, or REJECT the packet, or
possibly, QUEUE the packet to be passed to userspace. If none of the
rules in the chain apply to the packet, then the packet is dealt with in
accordance with the chain's defualt policy.
The iptables command allows you to configure these
rule lists, as well as set up new chains and tables to be used for your
particular situation.
