> For the complete documentation index, see [llms.txt](https://taqiyeddine.gitbook.io/exploring-it/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://taqiyeddine.gitbook.io/exploring-it/lpic-2-linux-engineer-202-450/lpic-2-linux-professional/iptables.md).

# IPTABLES

How to use iptables

## IPTABLES

*GET STARTED WITH IPTABLES*

1. Disable any other firewall:

   By default most linux distros use iptables, but due to it’s complexity they offer end users with a front end, in ubutntu we have ufw ‘uncomplicated firewall’. In RedHat we have systemd and firewalld responsible for the routing rules

2. Persist iptables saves before starting:

   iptables rules need to be persisted and its stored under /etc/iptables, by default ‘iptables-persistent’ which the package responsible for writing it’s configuration to this directory

   This is why we need to install it:

   Lets see all the iptables packages: <mark style="color:orange;">`sudo apt list iptables*`</mark>&#x20;

   <pre class="language-bash"><code class="lang-bash"><strong>azureuser@server:~$ sudo apt list iptables*
   </strong>Listing... Done
   iptables-netflow-dkms/focal-updates 2.4-2ubuntu0.5 amd64
   iptables-persistent/focal-updates,now 1.0.14ubuntu1 all 
   iptables/focal-updates,now 1.8.4-3ubuntu2.1 amd64 [installed,automatic]
   </code></pre>

   Now, let’s install it: <mark style="color:orange;">`sudo apt install iptables-persistent`</mark>

3. Turn your linux into a router!

   > 💡 <mark style="color:yellow;">IMPORTANT NOTE: Turning your wifi into a router will possible cause excessive processing or network traffic, leading to performance issues</mark>

   For that, linux do not allow traffic to flow between interfaces and this is why we need to enable that

   The sysctl.conf is not an iptable config file but its a kernel configuration file

   <mark style="color:orange;">`sudo vim /etc/sysctl.conf`</mark>

   inside this file search for :

   ```bash
   # Uncomment the next line to enable packet forwarding for IPv4
   #net.ipv4.ip_forward=1
   ```

   uncomment it to activate Ip forwarding. If you want to start this immediately you have let the kernel know that:

   <mark style="color:orange;">`sudo sysctl -p`</mark>

   and now everything is being written to disk inside /etc/iptables

   **`sysctl`:** is used to view and modify kernel parameters (also known as sysctl variables) on a running system.

4. Check iptables rules!

   For that let’s head to <mark style="color:orange;">`/etc/iptables`</mark>

   ```bash
   azureuser@server:~$ ls /etc/iptables
   rules.v4  rules.v6
   ```

   let’s check the content related to IPV4 :

   <mark style="color:orange;">`sudo vim /etc/iptables/rules.v4`</mark>

   Hmmm, you might see some complex stuff, let’s break it down. This is the output&#x20;

   ```bash
   # Generated by iptables-save v1.8.4 on Thu Aug 10 10:15:41 2023
   *filter
   :INPUT ACCEPT [5245:912294]
   :FORWARD ACCEPT [0:0]
   :OUTPUT ACCEPT [6203:1531528]
   COMMIT
   ```

   The rules are organized in chains within the **`filter`** table, and here's a brief explanation of each section:

   <mark style="color:purple;">**`:INPUT ACCEPT [5245:912294]:`**</mark>

   * This rule defines the default policy for incoming traffic (INPUT chain).
   * It specifies that the firewall should accept all incoming packets.
   * The numbers in square brackets indicate packet and byte counters.

   <mark style="color:purple;">`:FORWARD ACCEPT [0:0]:`</mark>

   * This rule defines the default policy for forwarded traffic (FORWARD chain).
   * It specifies that the firewall should accept all forwarded packets.
   * The numbers in square brackets represent packet and byte counters, which are both initially set to zero.

   <mark style="color:purple;">`:OUTPUT ACCEPT [6203:1531528]:`</mark>

   * This rule defines the default policy for outgoing traffic (OUTPUT chain).
   * It specifies that the firewall should accept all outgoing packets.
   * The numbers in square brackets indicate packet and byte counters.

   <mark style="color:purple;">`COMMIT:`</mark>

   * This keyword marks the end of the rules and commits the changes to the firewall configuration.
   * Any rules added after this point will be part of the active firewall ruleset.
   * It indicates that the rules defined above are complete and should take effect.

   Right now i am allowing every thing, this is a true router but not a firewall. It’s not filtering anything

5. Let’s Configure NAT as an example:

   > 💡 <mark style="color:yellow;">Quick note: Sometimes configuring iptables rule via the command-line instead of modifying the file, is better and much easier because you can spot typos!</mark>

   Lets learn a new command :

   <mark style="color:orange;">`sudo iptables -t nat -A POSTROUTING -j`</mark>` ``MASQUERADE`

   <mark style="color:orange;">**`-t nat`**</mark>: `t` Specifies the table in which the rule should be added. This specifies that we're working with the "nat" table,

   <mark style="color:orange;">**`-A POSTROUTING`**</mark>: `A` stands for append. This indicates that the rule is being added to the "POSTROUTING" chain. This chain is typically used for modifying packets as they are about to leave the network interface

   <mark style="color:orange;">**`-j MASQUERADE`**</mark>: **`j`** flag is used to specify the "target" or "jump" action for a rule. This specifies the target of the rule, which is "MASQUERADE." When MASQUERADE is used in the POSTROUTING chain, it's commonly used for dynamic source NAT (SNAT). It replaces the source IP address of outgoing packets with the IP address of the outgoing interface

   This NAT everybody, so we must be specific:

   ```bash
   azureuser@server:~$ sudo iptables -t nat -s 10.0.0.0/24 -A POSTROUTING -j MASQUERADE
   ```

   Now i am usong the <mark style="color:orange;">`-s`</mark> to specify a source

6. View IPTABLES config:

   <mark style="color:orange;">`sudo iptables-save`</mark>

   Now, i know that this sounds like this command is going to save the rules, but it actually doesn’t, it outputs on the screen the config

   Now let’s save it:

   <mark style="color:orange;">`sudo iptables-save | sudo tee /etc/iptables/rules.v4`</mark>