Iptables Tutorial 1.2.2

https://www.frozentux.net/iptables-tutorial/iptables-tutorial.html

by federicoponzi • 9 years ago

69 30 9 years ago

samueloph• 9 years ago

www.frozentux.net uses an invalid security certificate. The certificate expired on October 19, 2017, 9:59 PM. The current time is October 20, 2017, 11:04 AM.

Here's an alternate url

https://web.archive.org/web/20170921014253/https://www.froze...

gtirloni• 9 years ago

nftables is iptables' successor:

http://www.netfilter.org/projects/nftables

https://hn.algolia.com/?query=nftables

emddudley• 9 years ago

How mature is nftables? Do people regularly use it in production? I see that it was added to the kernel in 2014.

ahartmetz3• 9 years ago

nftables probably works but usability is god-awful. AFAIK it was created by the same people who created tc, which is so unusable that Linux might as well not support traffic shaping. If you don't believe me, please go ahead and try using it.

atomt2• 9 years ago

It was declared ready for "experimentation" about a year ago or so, so not very mature. If you are on current upstream versions it is not too bad, I'm using it here and there on not very important things.

It is a bit hit and miss with kernel/nftables versions on release distributions. I probably would not use it with any kernels older than 4.10 for example. So any current LTS kernel is out.

jug5• 9 years ago

Surprising to see iptables articles still being posted. Guess with the article being from a decade ago it makes sense, but here?

brunoqc• 9 years ago

I wanted to use nftables but I think Docker doesn't support it.

dsr_• 9 years ago

Given that the underlying kernel implementation will be the same, it seems likely that you can fix that easily.

https://wiki.nftables.org/wiki-nftables/index.php/Main_diffe...

trappist• 9 years ago

spapas82• 9 years ago

Please keep in mind that RHEL / Centos 7 has changed the default firewall from iptables to firewalld.

rantanplan• 9 years ago

Isn't firewalld just a front-end for iptables?

jlgaddis2• 9 years ago

Pretty much. It's basically a front-end for netfilter, which is actually what iptables is -- a way for the user/admin to interact with netfilter.

It's also an overly complex pain in the ass, IMO (but I've already dealt with ipfwadm -> ipchains -> iptables and not excited about having to learn yet another way to do it).

ausjke• 9 years ago

This tutorial is pretty old actually. Hope someone updates it, then we have nftables on the way to replace iptables, so might be just update to nftables directly.

I found 'nft', along with other commands such as 'ip' and 'tc' are pretty hard to use. I hope someone can create all possible auto-completion to guide the users, it is so hard to memorize those abbrev tags/options for those commands.

as-j• 9 years ago

Being old and of itself isn’t bad. A lot of us are still using IPv4, and everything still applies. To few people know the basic concepts in this tutorial and can’t patch/fix problems that are trivial on any server.

OTOH, it’s really long for a tutorial and starts with a dissection of IP headers, the audience who needs it most have probably tuned out after the first dozen, and certainly by STCP.

arca_vorago• 9 years ago

I'm currently working on an nftables setup script (removes iptables). I plan to release under gplv3. As I understand it nftables is designed to replace iptables (though they both use netfilter methinks), so I am ripping out iptables everywhere currently.

That said, I love the effort in this documentation.

nwmcsween• 9 years ago

Eventually someone or me should make a firewall 'fs' with fuse, it would map nicely and would be much less of a pain in the ass to work with.

tra3• 9 years ago

Does anyone know of a humane QoS tutorial? I've tried to understand it a few times but it's been beyond me.

iakie• 9 years ago

For those referring nftables, there’s a LOT of stuff in iptables that doesn't work in nftables: from simple things like xt_time to complex ones like xt_TPROXY. so nftables isn't a viable replacement for iptables just yet. In theory there's a compat layer in nftables to get around those, but I have never able to successfully build a binary that works.

krylon• 9 years ago

I hate to say it, but I will never forget the day I first stumbled upon PF.

Up to that point, setting up a router/firewall had been exceedingly painful, using Linux and iptables.

The syntax of pf.conf is beautiful. Somebody (I forgot who) once said that in order to write a rule set one needs to consult the (excellent) man page constantly, but once it is done, reading and understanding it takes no effort at all. As far as the "UI" goes, PF is so far ahead of anything I know of that most other metrics to judge a firewall / packet filter by seem to disappear.

Just to be clear: I have nothing against Linux, in fact most of my computers run Linux. But the syntax of pf.conf is just so sweet, once I tasted it, it spoiled me forever. And now iptables scripts look like something out of a Lovecraftian nightmare.

Iptables Tutorial 1.2.2

Related Stories