IPtables - Rules

- Overview
- Operations
- Field Definition

Firewall support in our system is based on the NetFilter, a raw framework for filtering and mangling packets, included in the standard Linux kernel. You can learn more about NetFilter on the official project site, http://netfilter.samba.org/. IPtables package is used to build the firewall on this framework, and it is possible to extend iptables functionality over your virtual server.

Overview

IPtables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains. Each chain is a list of rules which can match a set of packets. A firewall rule specifies a criteria for a packet, and a target (what to do with the packet that matches a criteria: one of the special values: ACCEPT or DROP).

This screen shows you the list of firewall rules for incoming (Input Chain) or outgoing (Output Chain) packets.

Operations

You can drill down to the particular Rule details by clicking on Rule number (in 'Order' column).

All changes made to firewall configuration take effect immediately. However, to make them working after virtual server restart, it is necessary to save them in a file. To this effect, click 'General' tab'-> 'Save to File' button. Note that it is impossible to upload the firewall configuration from an arbitrary file. You can only restore the previously saved firewall configuration from the default file. To this effect, click the 'General' tab -> 'Restore from file' button.

To change the order rules are applied, click on the 'Move Up' or 'Move Down' link in 'Actions' column - this will move the given Rule one position up or down the list.

Fields Definition

Field Name | Description
Order | The order firewall rules are applied.
Protocol | The network protocol a rule is created for (tcp, udp, imcp)
Source Address | This is the source match which is used to match packets based on their source IP address. It could be used with a netmask in a bits form (the number of ones (1's) on the left side of the network mask).
Source Port(s) | For tcp or udp protocols source port or ports (within the certain range, e.x. 45000:54000) can be specified. For imcp protocol the message type can be specified in this column.
Destination Address | This is the destination match. It is is used to match packets based on their destination address or addresses. It works pretty much the same as the source match, except that it based on where the packets are going.
Destination Port(s) | For tcp or udp protocols the destination port or ports (within the certain range, e.x. 45000:54000) can be specified. For imcp protocol the message type can be specified in this column.
Policy | What to do with the packet that matches. ACCEPT allows the packet through. DROP just drops the packet and refuses to process it any more.
Actions | The links in this column allow changing the order rules are applied. Click on the 'Move Up' or 'Move Down' link - this will move the given Rule one position up or down the list.