tollan/iptables repository overview

# SSH access
ssh root@<container_ip>
# Password: pass

# Or use GNS3 console

# Apply sysctl settings
sysctl -p

# Start logging service
rsyslogd

# Start SSH service
/usr/sbin/sshd -D

# List all rules
iptables -L -n -v

# List with line numbers
iptables -L -n -v --line-numbers

# List specific table
iptables -t filter -L -n -v
iptables -t nat -L -n -v
iptables -t mangle -L -n -v

# Set default policies
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT

# Allow loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow established connections
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# Allow SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT

# Allow ping
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT

# Allow specific network
iptables -A INPUT -s 192.168.1.0/24 -j ACCEPT

# Block specific IP
iptables -A INPUT -s 192.168.1.100 -j DROP

# Allow port range
iptables -A INPUT -p tcp --dport 8000:9000 -j ACCEPT

# Log dropped packets
iptables -A INPUT -j LOG --log-prefix "DROPPED: "
iptables -A INPUT -j DROP

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward

# SNAT (Source NAT)
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# DNAT (Destination NAT)
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.1.10:80

# Save current rules
iptables-save > /etc/iptables/rules.v4

# Restore rules
iptables-restore < /etc/iptables/rules.v4

# Use iptables-persistent
netfilter-persistent save
netfilter-persistent reload

# Test from another container
ping <firewall_ip>
nmap -p 22,80,443 <firewall_ip>

# Monitor traffic
tcpdump -i any host <target_ip>

# Check connection tracking
cat /proc/net/nf_conntrack