Linux 防火墙（Netfilter/iptables）

What is a firewall? It's like a security guard for your network, controlling what traffic goes in and out. In Linux, the core firewall framework is called Netfilter. We use a command-line tool called iptables to manage its rules.

Netfilter is a powerful framework built right into the Linux kernel. It allows different kernel modules to inspect, modify, and drop network packets.

Think of it as the engine behind the firewall. It provides "hooks" where packet processing can be intercepted.

While Netfilter is in the kernel, iptables is the command-line utility you use to interact with it. It lets you define rules that tell Netfilter what to do with specific packets.

These rules are organized into tables and chains, which we'll explore next.

iptables organizes rules into chains. These are ordered lists of rules that packets are checked against. The three most common built-in chains are:

• INPUT: For packets destined for the local system.
• OUTPUT: For packets originating from the local system.
• FORWARD: For packets passing through the system (e.g., a router).

Each chain has a default policy, which is the action taken if no rule in the chain matches a packet. Common policies are:

• ACCEPT: Let the packet through.
• DROP: Silently discard the packet (sender gets no response).
• REJECT: Discard the packet and send an error message back to the sender.

It's common to set default policies to DROP for security.

Before adding rules, it's good to see what's already there. You can list all current iptables rules with the -L option. Adding -n shows IP addresses numerically, and -v adds verbosity.

Let's add a rule to allow incoming SSH connections (port 22). We'll append (-A) this rule to the INPUT chain, specifying TCP protocol (-p tcp) and destination port (--dport 22). The action (-j) will be ACCEPT.

Now, let's block all outbound ping requests (ICMP protocol). We'll append this rule to the OUTPUT chain, specifying the ICMP protocol. The action will be DROP.

This means your system won't send ping requests, but might still receive them if not blocked on INPUT.

iptables rules are volatile; they disappear on reboot! To make them permanent, you need to save them. On many systems, you'd use iptables-save to export rules and iptables-restore to load them.

Some Linux distributions use specific services (like netfilter-persistent) or files (e.g., /etc/sysconfig/iptables) to manage persistence.

Based on what you've learned, which iptables chain would typically handle network packets that are trying to reach a service running on your local machine?

You've learned about Netfilter, the kernel's firewall framework, and iptables, the user-space tool to manage its rules. We covered the main chains (INPUT, OUTPUT, FORWARD) and policies (ACCEPT, DROP, REJECT).

You also saw how to list, add basic rules, and the importance of saving them for persistence. This is a crucial step in securing any Linux system!