Buscar

48.9.3.4. IPTables Match Options

download PDF
Different network protocols provide specialized matching options which can be configured to match a particular packet using that protocol. However, the protocol must first be specified in the iptables command. For example, -p <protocol-name> enables options for the specified protocol. Note that you can also use the protocol ID, instead of the protocol name. Refer to the following examples, each of which have the same effect:
iptables -A INPUT -p icmp --icmp-type any -j ACCEPT
iptables -A INPUT -p 5813 --icmp-type any -j ACCEPT
Service definitions are provided in the /etc/services file. For readability, it is recommended that you use the service names rather than the port numbers.

Important

Secure the /etc/services file to prevent unauthorized editing. If this file is editable, crackers can use it to enable ports on your machine you have otherwise closed. To secure this file, type the following commands as root:
chown root.root /etc/services
chmod 0644 /etc/services
chattr +i /etc/services
This prevents the file from being renamed, deleted or having links made to it.
48.9.3.4.1. TCP Protocol
These match options are available for the TCP protocol (-p tcp):
  • --dport — Sets the destination port for the packet.
    To configure this option, use a network service name (such as www or smtp); a port number; or a range of port numbers.
    To specify a range of port numbers, separate the two numbers with a colon (:). For example: -p tcp --dport 3000:3200. The largest acceptable valid range is 0:65535.
    Use an exclamation point character (!) after the --dport option to match all packets that do not use that network service or port.
    To browse the names and aliases of network services and the port numbers they use, view the /etc/services file.
    The --destination-port match option is synonymous with --dport.
  • --sport — Sets the source port of the packet using the same options as --dport. The --source-port match option is synonymous with --sport.
  • --syn — Applies to all TCP packets designed to initiate communication, commonly called SYN packets. Any packets that carry a data payload are not touched.
    Use an exclamation point character (!) after the --syn option to match all non-SYN packets.
  • --tcp-flags <tested flag list> <set flag list> — Allows TCP packets that have specific bits (flags) set, to match a rule.
    The --tcp-flags match option accepts two parameters. The first parameter is the mask; a comma-separated list of flags to be examined in the packet. The second parameter is a comma-separated list of flags that must be set for the rule to match.
    The possible flags are:
    • ACK
    • FIN
    • PSH
    • RST
    • SYN
    • URG
    • ALL
    • NONE
    For example, an iptables rule that contains the following specification only matches TCP packets that have the SYN flag set and the ACK and FIN flags not set:
    --tcp-flags ACK,FIN,SYN SYN
    Use the exclamation point character (!) after the --tcp-flags to reverse the effect of the match option.
  • --tcp-option — Attempts to match with TCP-specific options that can be set within a particular packet. This match option can also be reversed with the exclamation point character (!).
Red Hat logoGithubRedditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

© 2024 Red Hat, Inc.