{"id":488,"date":"2014-10-21T18:25:58","date_gmt":"2014-10-21T10:25:58","guid":{"rendered":"http:\/\/www.ipcpu.com\/?p=488"},"modified":"2014-10-21T18:25:58","modified_gmt":"2014-10-21T10:25:58","slug":"add-comments-iptables","status":"publish","type":"post","link":"https:\/\/c.ipcpu.com\/2014\/10\/add-comments-iptables\/","title":{"rendered":"\u5982\u4f55\u7ed9iptables\u52a0\u6ce8\u91caAdd Comments to iptables Rules"},"content":{"rendered":"
<\/div>\n

Add Comments to iptables Rules<\/h2>\n

By Scott Miller+ | 2014\/06\/03<\/p>\n

\"\"<\/p>\n

Impress your boss and co-workers by using comments in your iptables rules. Here\u2019s how it works!<\/p>\n

What are iptables comments?<\/h3>\n

Comments appear as follows when in use. (Ex: \/* allow SSH to this host from anywhere *\/ as seen below.)<\/p>\n

  1. $ sudo iptables <\/span>-<\/span>L<\/span><\/code><\/li>
  2. Chain<\/span> INPUT <\/span>(<\/span>policy DROP<\/span>)<\/span><\/code><\/li>
  3. target     prot opt source               destination         <\/span><\/code><\/li>
  4. ACCEPT     all  <\/span>--<\/span>  anywhere             anywhere             state RELATED<\/span>,<\/span>ESTABLISHED <\/span>\/* allow inbound traffic for established and related connections *\/<\/span><\/code><\/li>
  5. fail2ban<\/span>-<\/span>ssh  tcp  <\/span>--<\/span>  anywhere             anywhere             multiport dports ssh<\/span><\/code><\/li>
  6. ACCEPT     tcp  <\/span>--<\/span>  anywhere             anywhere             tcp dpt<\/span>:<\/span>ssh <\/span>\/* allow SSH to this host from anywhere *\/<\/span><\/code><\/li>
  7. ACCEPT     udp  <\/span>--<\/span>  anywhere             anywhere             udp dpt<\/span>:<\/span>route <\/span>\/* allow incoming RIP on the internal interface *\/<\/span><\/code><\/li>
  8. ACCEPT     all  <\/span>--<\/span>  localhost            localhost            <\/span>\/* allow any local-only traffic *\/<\/span><\/code><\/li>
  9. ACCEPT     ipv6 <\/span>--<\/span>  tserv2<\/span>.<\/span>ash1<\/span>.<\/span>he<\/span>.<\/span>net   anywhere             <\/span>\/* allow IPv6 tunnel traffic from HE *\/<\/span><\/code><\/li>
  10. ACCEPT     icmp <\/span>--<\/span>  anywhere             anywhere             <\/span>\/* allow ICMP traffic to this host from anywhere *\/<\/span><\/code><\/li>
  11. <\/code><\/li>
  12. Chain<\/span> FORWARD <\/span>(<\/span>policy DROP<\/span>)<\/span><\/code><\/li>
  13. target     prot opt source               destination         <\/span><\/code><\/li>
  14. ACCEPT     all  <\/span>--<\/span>  anywhere             anywhere             state RELATED<\/span>,<\/span>ESTABLISHED <\/span>\/* allow inbound traffic for established and related connections *\/<\/span><\/code><\/li>
  15. ACCEPT     all  <\/span>--<\/span>  anywhere             anywhere             <\/span>\/* allow all Internet bound traffic from the internal network *\/<\/span><\/code><\/li>
  16. ACCEPT     icmp <\/span>--<\/span>  anywhere             anywhere             <\/span>\/* forward any ICMP traffic *\/<\/span><\/code><\/li>
  17. <\/code><\/li>
  18. Chain<\/span> OUTPUT <\/span>(<\/span>policy ACCEPT<\/span>)<\/span><\/code><\/li>
  19. target     prot opt source               destination         <\/span><\/code><\/li>
  20. <\/code><\/li>
  21. Chain<\/span> fail2ban<\/span>-<\/span>ssh <\/span>(<\/span>1<\/span> references<\/span>)<\/span><\/code><\/li>
  22. target     prot opt source               destination         <\/span><\/code><\/li>
  23. RETURN     all  <\/span>--<\/span>  anywhere             anywhere  <\/span><\/code><\/li><\/ol><\/pre>\n
    Create comments with iptables rules<\/h3>\n
    To make comments with your iptables rules, the syntax is: comment \u2013comment \u201cmy cool text\u201d<\/p>\n
    Here is a rule to allow ssh traffic with a comment added:<\/p>\n
    1. $ sudo iptables <\/span>-<\/span>A INPUT <\/span>-<\/span>p tcp <\/span>-<\/span>m tcp <\/span>--<\/span>dport <\/span>22<\/span> <\/span>-<\/span>m comment <\/span>--<\/span>comment <\/span>\"allow SSH to this host from anywhere\"<\/span> <\/span>-<\/span>j ACCEPT<\/span><\/code><\/li><\/ol><\/pre>\n
      This rule then appears as following when listing rules:<\/p>\n
      1. $ sudo iptables <\/span>-<\/span>L<\/span><\/code><\/li>
      2. ACCEPT     tcp  <\/span>--<\/span>  anywhere             anywhere             tcp dpt<\/span>:<\/span>ssh <\/span>\/* allow SSH to this host from anywhere *\/<\/span><\/code><\/li><\/ol><\/pre>\n
        Hack on,<\/p>\n
        Tags: comments, documentation, firewall, firewall rules, iptables, linux, linux firewall, security<\/p>\n
        \u539f\u6587\u5730\u5740\uff1a https:\/\/scottlinux.com\/2014\/06\/03\/add-comments-to-iptables-rules\/<\/a><\/p>\n
        \u8f6c\u8f7d\u8bf7\u6ce8\u660e\uff1aIPCPU-\u7f51\u7edc\u4e4b\u8def<\/a> » \u5982\u4f55\u7ed9iptables\u52a0\u6ce8\u91caAdd Comments to iptables Rules<\/a><\/p>","protected":false},"excerpt":{"rendered":"
        Add Comments to iptables Rules By Scott Miller+ | 2014\/06\/03 Impress your boss and co-workers by using comments in your iptables rules. Here\u2019s how it works! What are iptables comments? Comments appear as follows when in use. (Ex: \/* allow SSH to this host from anywhere *\/ as seen below.) $ sudo iptables -LChain INPUT […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[13,1],"tags":[54,17],"_links":{"self":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/posts\/488"}],"collection":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/comments?post=488"}],"version-history":[{"count":0,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/posts\/488\/revisions"}],"wp:attachment":[{"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/media?parent=488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/categories?post=488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/c.ipcpu.com\/wp-json\/wp\/v2\/tags?post=488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}