NOTE: CentOS Enterprise Linux is built from the Red Hat Enterprise Linux source code. Other than logo and name changes CentOS Enterprise Linux is compatible with the equivalent Red Hat version. This document applies equally to both Red Hat and CentOS Enterprise Linux.
NAME="GENERATOR" CONTENT="Modular DocBook HTML
Stylesheet Version 1.7">
At first glance, ipchains and
iptables appear to be quite similar. Both
methods of packet filtering use chains of rules operating within
the Linux kernel to decide what to do with packets that match the
specified rule or set of rules. However, iptables offers a more extensible way of filtering
packets, giving the administrator a greater amount of control
without building a great deal of complexity into the system.
Specifically, users comfortable with ipchains should be aware of the following
significant differences between ipchains
and iptables before attempting to use
each filtered packet is processed using rules from only one chain
rather than multiple chains. For instance, a FORWARD packet
coming into a system using ipchains would
have to go through the INPUT, FORWARD, and OUTPUT chains to move
along to its destination. However, iptables only sends packets to the INPUT chain if
they are destined for the local system and only sends them to the
OUTPUT chain if the local system generated the packets. For this
reason, it is important to place the rule designed to catch a
particular packet within the rule that actually handles the
The DENY target has been changed to
DROP. In ipchains, packets that
matched a rule in a chain could be directed to the DENY target.
This target must be changed to DROP under iptables.
Order matters when placing options in a
rule. With ipchains, the order of the
rule options does not matter. The iptables
command uses stricter syntax. In iptables
commands, the protocol (ICMP, TCP, or UDP) must be specified before
the source or destination ports.
When specifying network interfaces to be
used with a rule, you must only use incoming interfaces (-i option) with INPUT or FORWARD chains and outgoing
interfaces (-o option) with FORWARD or
OUTPUT chains. This is necessary because OUTPUT chains are no
longer used by incoming interfaces, and INPUT chains are not seen
by packets moving through outgoing interfaces.
This is not a comprehensive list of the changes, given that
iptables is a fundamentally rewritten
network filter. For more specific information, refer to the
Linux Packet Filtering HOWTO referenced in