Chapter 6 · System security·v1.0.0·Updated 7/7/2026·~12 min
What's changed: Initial version (topic 2.12, subtopics 2.12.1–2.12.4)
6.1Packet Filtering with iptables/firewalld
Key points
Learn packet filtering with iptables/ip6tables and the higher-level firewalld (firewall-cmd) and ufw. Cover kernel parameters under /proc/sys/net/ipv4///proc/sys/net/ipv6/, the routing table, port redirection, /etc/services, and persisting rules with iptables-save/iptables-restore.
Once a server faces the outside world, a firewall must state clearly what traffic passes and what is blocked. On Linux, iptables is the traditional way to drive the kernel's packet filter directly, while firewalld and ufw wrap it in more manageable zones and services.
6.1.1iptables/ip6tables fundamentals
- iptables configures the IPv4 packet filter. ip6tables is the IPv6 counterpart—a separate command with a separate ruleset (IPv4 rules do not apply to IPv6 traffic).
- Kernel forwarding and response behavior is controlled via virtual files under /proc/sys/net/ipv4/ and /proc/sys/net/ipv6/ (e.g., setting
net.ipv4.ip_forwardto 1 enables routing). - The routing table decides where a packet goes; the firewall permits or denies traffic around that decision. Port redirection (destination port translation) is done in the NAT table's
PREROUTINGchain; /etc/services maps port numbers to service names.
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.