root@ubuntu:~# sysctl -a | grep 'ip_forward'
net.ipv4.ip_forward = 0
net.ipv4.ip_forward_use_pmtu = 0

echo 1 > /proc/sys/net/ipv4/ip_forward

net.ipv6.conf.all.disable_ipv6 = 1

Eine neue Kette erstellen (new-chain) (-N).
Eine leere Kette löschen (-X). (geht nicht mit INPUT, OUTPUT und FORWARD)
Die Policy für eine eingebaute Kette ändern (policy) (-P).
Die Regeln einer Kette auflisten (list) (-L).
Die Regeln aus einer Kette entfernen (flush) (-F).
Paket- und Bytezähler aller Regeln einer Kette auf Null stellen (zero) (-Z).

Verwaltung der Regeln in einer Kette:
Eine neue Regel an eine Kette anhängen (append) (-A).
Eine neue Regel an eine bestimmte Position in der Kette einfügen (insert) (-I).
Eine Regel an bestimmter Position in der Kette ersetzen (replace) (-R).
Eine Regel an einer bestimmten Position in der Kette löschen (delete) (-D).
Die erste passende Regel in einer Kette löschen (delete) (-D).

rule-specification = [matches...] [target]
match = -m matchname [per-match-options]
target = -j targetname [per-target-options]

$ iptables -m state --help
...
state match options:
 [!] --state [INVALID|ESTABLISHED|NEW|RELATED|UNTRACKED][,...]
                                 State(s) to match

$ iptables -p icmp --help
icmp match options:
[!] --icmp-type typename        match icmp type
[!] --icmp-type type[/code]     (or numeric type or type/code)
Valid ICMP Types:
any
echo-reply (pong)
destination-unreachable
   network-unreachable
   host-unreachable
   protocol-unreachable
   port-unreachable
   fragmentation-needed
   source-route-failed
   network-unknown
   host-unknown
   network-prohibited
   host-prohibited
   TOS-network-unreachable
   TOS-host-unreachable
   communication-prohibited
   host-precedence-violation
   precedence-cutoff
source-quench
redirect
   network-redirect
   host-redirect
   TOS-network-redirect
   TOS-host-redirect
echo-request (ping)
router-advertisement
router-solicitation
time-exceeded (ttl-exceeded)
   ttl-zero-during-transit
   ttl-zero-during-reassembly
parameter-problem
   ip-header-bad
   required-option-missing
timestamp-request
timestamp-reply
address-mask-request
address-mask-reply

DNAT
    This target is only valid in the nat table, in the PREROUTING and OUTPUT chains, and user-defined chains which are only called from those chains.  It specifies that the destination address of the packet should  be  modified
    (and all future packets in this connection will also be mangled), and rules should cease being examined.  It takes the following options:

    --to-destination [ipaddr[-ipaddr]][:port[-port]]
           which can specify a single new destination IP address, an inclusive range of IP addresses. Optionally a port range, if the rule also specifies one of the following protocols: tcp, udp, dccp or sctp.  If no port range
           is specified, then the destination port will never be modified. If no IP address is specified then only the destination port will be modified.  In Kernels up to 2.6.10 you can add  several  --to-destination  options.
           For  those  kernels,  if  you  specify more than one destination address, either via an address range or multiple --to-destination options, a simple round-robin (one after another in cycle) load balancing takes place
           between these addresses.  Later Kernels (>= 2.6.11-rc1) don't have the ability to NAT to multiple ranges anymore.

    --random
           If option --random is used then port mapping will be randomized (kernel >= 2.6.22).

    --persistent
           Gives a client the same source-/destination-address for each connection.  This supersedes the SAME target. Support for persistent mappings is available from 2.6.29-rc2.

    IPv6 support available since Linux kernels >= 3.7.

[root@centos ~]# iptables  -L --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
2    ACCEPT     icmp --  anywhere             anywhere
3    ACCEPT     all  --  anywhere             anywhere
4    ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
5    ACCEPT     tcp  --  10.191.17.9          anywhere             state NEW tcp dpt:ftp
6    REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination
1    REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  anywhere             10.191.17.9          state NEW tcp dpt:http
2    DROP       all  --  anywhere             10.191.17.0/24       state NEW

[root@centos ~]# systemctl stop firewalld
[root@centos ~]# systemctl mask firewalld

[root@centos ~]# yum install iptables-services
[root@centos ~]# systemctl enable iptables
[root@centos ~]# systemctl enable ip6tables

[root@centos ~]# cat /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
[root@centos ~]# cat /etc/sysconfig/ip6tables
# sample configuration for ip6tables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p ipv6-icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp --dport 22 -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -d fe80::/64 -p udp -m udp --dport 546 -m state --state NEW -j ACCEPT
-A INPUT -j REJECT --reject-with icmp6-adm-prohibited
-A FORWARD -j REJECT --reject-with icmp6-adm-prohibited
COMMIT

[root@centos ~]# iptables -vnL
Chain INPUT (policy ACCEPT 10507 packets, 15M bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 6139 packets, 336K bytes)
 pkts bytes target     prot opt in     out     source               destination
[root@centos ~]# systemctl status iptables
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
   Active: inactive (dead)
[root@centos ~]# systemctl start iptables
[root@centos ~]# systemctl restart iptables
[root@centos ~]# iptables -vnL
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.191.17.9/32 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

[root@centos ~]# yum install vsftpd
[root@centos ~]# systemctl enable vsftpd
[root@centos ~]# systemctl start vsftpd
[root@centos ~]# netstat -tulpn | grep ':21 '
tcp6       0      0 :::21                   :::*                    LISTEN      2194/vsftpd

[root@centos sysconfig]# ip a | grep 'inet '
    inet 127.0.0.1/8 scope host lo
    inet 10.0.2.15/24 brd 10.0.2.255 scope global noprefixroute dynamic eth0
    inet 10.191.17.6/24 brd 10.191.17.255 scope global noprefixroute eth1

root@ubuntu:~# ip a | grep 'inet '
    inet 127.0.0.1/8 scope host lo
    inet 10.0.2.15/24 brd 10.0.2.255 scope global dynamic eth0
    inet 10.191.17.9/24 brd 10.191.17.255 scope global eth1
root@ubuntu:~# telnet 10.191.17.6 21
Trying 10.191.17.6...
telnet: Unable to connect to remote host: No route to host

# persistieren:
# Debian/Ubuntu:
iptables-save > /etc/iptables/rules.v4
# RHEL/CentOS:
iptables-save > /etc/sysconfig/iptables

# wiederherstellen:
# Debian/Ubuntu:
iptables-restore < /etc/iptables/rules.v4
# RHEL/CentOS:
iptables-restore < /etc/sysconfig/iptables

# ip v6
# Debian/Ubuntu:
ip6tables-save > /etc/iptables/rules.v6
# RHEL/CentOS:
ip6tables-save > /etc/sysconfig/ip6tables

-A INPUT -s 10.191.17.9/32 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.191.17.9/32 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

root@ubuntu:~# telnet 10.191.17.6 21
Trying 10.191.17.6...
Connected to 10.191.17.6.
Escape character is '^]'.
220 (vsFTPd 3.0.2)

-A OUTPUT -d 10.191.17.9/32 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

-A OUTPUT -d 10.191.17.0/24 -m state --state NEW -j DROP

[root@centos ~]# cat /etc/sysconfig/iptables
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.191.17.9/32 -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
-A OUTPUT -d 10.191.17.9/32 -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A OUTPUT -d 10.191.17.0/24 -m state --state NEW -j DROP
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT