What have been the most useful resources for learning how to use IPTables well?

Question

I'm trying to get a good grip of how IP Tables work on Linux (I'm using Centos as my main OS), and I've found the Peepcode series of screencasts about the command line extremely useful, and I'm wandering if there's anything similar for some of Linux's less well known parts, like administering IP Tables, SeLinux and so on.

Are there any screencasts you'd recommend?

Also which web pages, or slideshows have been the most useful to you when trying to get an understanding of how IPtables work?

Answer 1

I'm fond of the iptables/netfilter flowchart for a general overview of where/how things get passed around, which makes reading the iptables manual pages a bit more pleasant.

Answer 2

Mine aren't web sites but rather a couple of IPTables rules themselves:

# --- Log blocked on input:
-A INPUT -j LOG  --log-prefix "BLOCK_IN: " --log-level info
-A INPUT -j DROP

and

# --- Log blocked on output then drop everything not listed above:
-A OUTPUT -j LOG --log-prefix "BLOCK_OUT: " --log-level info
-A OUTPUT -j REJECT

and also:

# --- Log new connections:
-A INPUT -m state --state NEW -j LOG  --log-prefix "NEW: " --log-level info

they will write to /var/log/messages like so:

Feb 17 19:33:01 test001 kernel: BLOCK_IN: IN=eth0 OUT=\ MAC=00:0c:29:e6:35:ef:00:50:56:c0:00:02:08:00 SRC=10.0.0.1 \
DST=10.0.0.20 LEN=60 TOS=0x10 PREC=0x00 TTL=64 ID=7834 DF \
PROTO=TCP SPT=52196 DPT=1522 WINDOW=5840 RES=0x00 SYN URGP=0

Once you get use to looking for the BLOCK_IN/BLOCK_OUT and the DPT (Destination Port) you start to understand a lot of what the rules are doing. Watch what happens when you nmap it from another machine and so on.

VMWare/Virtual PC environments are also perfect for this kind of hands on learning.

Answer 3

I haven't watched it yet but a quick Google turned up this one. However, the most useful resources are the billion or so article on the subject you can find all over the Internet. I tend to search for specifics, rather than general articles.

Answer 4

As well as screencasts, web pages and slideshows there's always books:

Linux IPTables Pocket Reference