0

Please explain me the use of bold character below

iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT

-A -i -p -m state --state -j

  • 2
    Do you try reading iptables's manpage? – cuonglm May 15 '14 at 6:47
3

man iptables will tell you most of this and has an extensive list of examples.

-t Specify the table to add the rule to (by default, the filter table)

-A Append the rule to the specified chain of rules (as opposed to -I for insert at the beginning).

-i Set the interface for this rule to match on (default of * or all)

-p match on the protocol of the packet

-m Use an extended packet matching module as specified, in you case packet states.

--state For the state extended module, match any NEW or ESTABLISHED packets (via ip_conntrack - ip connection tracking info stored in memory)

-j "Jump" the packet to the specified target, the builtin ACCEPT is to allow the packet through

For some of these concepts it helps to know how packets traverse iptables as well:

http://en.wikibooks.org/wiki/Communication_Networks/IP_Tables

Each of the square boxes is a table (-t) The columns are chains (what you append/insert/delete rules in)

Image from http://en.wikibooks.org/wiki/Communication_Networks/IP_Tables

1

i -specifies the interfaces on which a packet was received

p - indicates the protocol as tcp, udp or icmp

The -A a parameter does not mean ACCEPT but append the rule to the end of the iptables INPUT chain

-m state - specifies a match to use here it loads the state module and allow only NEW and ESTABLISHED connections

-j - specifies the jump target (what to do if the packet matches it) here to ACCEPT the connection

other targets are DROP, DENY, LOG

0

-A = ACCEPT

-i = Interface

-p= Protocol

I have read this while I am trying to learn

http://www.thegeekstuff.com/2011/01/iptables-fundamentals/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.