[Iptables] Iptables command list

iptables -L –verbose (show flow list by iptables)
iptables -S –verbose (show flow list by iptables)

iptables -A FORWARD -o tun0 -i erouter0 -d 10.8.0.6 -j LOG (Can show message under dmesg)

Read More

[iptables] Enable or allow ICMP ping incoming client request

iptables -I INPUT  -p icmp --icmp-type 8 -s 0/0 -d 0/0 -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -I OUTPUT -p icmp --icmp-type 0 -s 0/0 -d 0/0 -m state --state ESTABLISHED,RELATED     -j ACCEPT

Reference:

• Linux Iptables allow or block ICMP ping request

Read More

[iptables] How to detect icmp request depend on limitation rules

Rate-limiting is a better way to control possible abuse. This first method implements a global limit (ie, only X packets per minute for all source addresses):

iptables -A INPUT -p icmp –icmp-type echo-request -m limit –limit 30/min –limit-burst 8 -j ACCEPT

-limit
followed by a number; specifies the maximum average number of matches to allow per second. The number can specify units explicitly, using /second’,/minute’, /hour’ or/day’, or parts of them (so 5/second’ is the same as5/s’).

–limit-burst
followed by a number, indicating the maximum burst before the above limit kicks in.

• iptables: How to use the limits module
• Firewall: Stateful Packet Inspection

Delete single iptables rules
iptables -D INPUT -s 127.0.0.1 -p tcp –dport 111 -j ACCEPT

• Delete single iptables rules

Read More

[iptables] Block time stamp

[iptable] Block time stamp

#星期一到星期六的8:00-12:30禁止qq通信

iptables -I FORWARD -p udp --dport 53 -m string --string "TENCENT" -m time --timestart 8:15 --timestop 12:30 --days Mon,Tue,Wed,Thu,Fri,Sat -j DROP

#星期一到星期六的8:00-12:30禁止qq通信

iptables -I FORWARD -p udp --dport 53 -m string --string "tencent" -m time --timestart 13:30 --timestop 20:30 --days Mon,Tue,Wed,Thu,Fri,Sat -j DROP

iptables -I FORWARD - p udp --dport 53 -m string --string "TENCENT" -m time --timestart 13:30 --timestop 20:30 --days Mon,Tue,Wed,Thu,Fri,Sat -j DROP

#星期一到星期六的13:30-20:30禁止QQ通信

iptables -I FORWARD -s 192.168.0.0/24 -m string --string "qq.com" -m time --timestart 8:15 --timestop 12: 30 --days Mon,Tue,Wed,Thu,Fri,Sat -j DROP

#星期一到星期六的8:00-12:30禁止qq網頁

iptables -I FORWARD -s 192.168.0.0/24 -m string - -string "qq.com" -m time --timestart 13:00 --timestop 20:30 --days Mon,Tue,Wed,Thu,Fri,Sat -j DROP

#星期一到星期六的13:30- 20:30禁止QQ網頁

iptables -I FORWARD -s 192.168.0.0/24 -m string --string "ay2000.net" -j DROP

iptables -I FORWARD -d 192.168.0.0/24 -m string --string "寬頻影院" -j DROP

iptables -I FORWARD -s 192.168.0.0/24 -m string --string "色情" -j DROP

iptables -I FORWARD -p tcp --sport 80 -m string --string "廣告" -j DROP

#禁止ay2000.net，寬頻影院，色情，廣告網頁連接！但中文不是很理想

iptables -A FORWARD -m ipp2p --edk --kazaa --bit -j DROP

iptables -A FORWARD -p tcp -m ipp2p --ares -j DROP

iptables -A FORWARD -p udp -m ipp2p --kazaa -j DROP

#禁止BT連接

iptables -A FORWARD -p tcp --syn --dport 80 -m connlimit --connlimit-above 15 --connlimit-mask 24 -j DROP

 

Reference :

• 
  不錯的iptables 文章

Read More