iptable

agak kompleks banding dengan pf(bsd).

1) secara default(table filter) rantaian(flow) paket seperti rajah dibawah.

2) arahan
iptables -F   ;# flush semua
iptables -P INPUT DROP -t filter   ;# default policy INPUT adalah DROP dlm tbl filter
iptables -L -t filter ;# list rules dalam table filter
iptables -t filter -A INPUT -s 192.168.117.57/32 -i eth0 -j ACCEPT ;# add dlm chain INPUT tbl filter

iptables-save  > rules.txt ;# boleh pipe ke file (utk restore )
iptables-restore < rules.txt


contoh:

#!/bin/sh

iptables -F INPUT 

iptables -F OUTPUT

iptables -F FORWARD

iptables -P INPUT DROP

iptables -P OUTPUT DROP

iptables -P FORWARD DROP

#Permit DNS traffic

iptables -A INPUT -p udp --sport 53 -j ACCEPT

iptables -A OUTPUT -p udp --sport 53 -j ACCEPT

#Accept local-network return traffic for clients

iptables -A INPUT -m state -p tcp --dport 1024:65535 --state ESTABLISHED,RELATED -s 192.168.9.0/24 -j ACCEPT

iptables -A OUTPUT -m state -p tcp --dport 1024:65535 ! --state INVALID -d 192.168.9.0/24 -j ACCEPT

#Accept local (192.168.9.0/24) SSH traffics

iptables -A INPUT -m state -p tcp --dport 22 ! --state INVALID -s 192.168.9.0/24 -j ACCEPT

iptables -A OUTPUT -m state -p tcp --sport 22 --state ESTABLISHED,RELATED -d 192.168.9.0/24 -j ACCEPT

Cara baca rules berbeza dengan pf,  bila dah match rules pada line tertentu, tak baca lagi rules yg kat bawah. Sama macam 'quick' dalam pf.

3) nat
   iptables -t nat -A POSTROUTING -o <external-interface> -j MASQUERADE

4) port forwarding
   iptables -t nat -A PREROUTING -p tcp -i <external-interface> --dport <port-num> -j DNAT --to <int_ip>:<port>
contoh 1:
   iptables -t nat -A PREROUTING -p tcp -i eth0 --dport 8080 -j DNAT --to 192.168.9.35:22
contoh 2:
   iptables -t nat -A PREROUTING -i eth0 -j DNAT -d 202.1.1.4 --to 192.168.1.1
  # any packet to 202.1.1.4 will be forward to 192.168.1.1 tanpa disedari(transparent)


5) iptables ada 3 tables

1. filter: ada 3 chain
1. FORWARD
2. INPUT
3. OUTPUT
2. nat: ada 3 chain
1. PREROUTING
2. POSTROUTING
3. OUTPUT
3. mangle (jarang guna, boleh abaikan je)
1. PREROUTING
2. POSTROUTING
3. OUTPUT
4. INPUT
5. FORWARD

Rujuk rajah utk lebih detail

ref: http://www.linuxhomenetworking.com/wiki/index.php/Quick_HOWTO_:_Ch14_:_Linux_Firewalls_Using_iptables