# Iptables

The iptables modules handles iptables rules

## `iptables.chain`

Manage iptables chains.

    iptables.chain(name, present=True, table=filter, policy=None, version=4)

- name: the name of the chain
- present: whether the chain should exist
- table: the iptables table this chain should belong to
- policy: the policy this table should have
- version: whether to target iptables or ip6tables

Policy:
  These can only be applied to system chains (FORWARD, INPUT, OUTPUT, etc).

## `iptables.rule`

Manage iptables rules.

    iptables.rule(
        chain, jump, present=True, table=filter, append=True, version=4, protocol=None,
        not_protocol=None, source=None, not_source=None, destination=None, not_destination=None,
        in_interface=None, not_in_interface=None, out_interface=None, not_out_interface=None,
        to_destination=None, to_source=None, to_ports=None, log_prefix=None,
        destination_port=None, source_port=None, extras=
    )

- chain: the chain this rule should live in
- jump: the target of the rule
- table: the iptables table this rule should belong to
- append: whether to append or insert the rule (if not present)
- version: whether to target iptables or ip6tables

Iptables args:

- protocol/not_protocol: filter by protocol (tcp or udp)
- source/not_source: filter by source IPs
- destination/not_destination: filter by destination IPs
- in_interface/not_in_interface: filter by incoming interface
- out_interface/not_out_interface: filter by outgoing interface
- to_destination: where to route to when jump=DNAT
- to_source: where to route to when jump=SNAT
- to_ports: where to route to when jump=REDIRECT
- log_prefix: prefix for the log of this rule when jump=LOG

Extras:

- extras: a place to define iptables extension arguments (eg –limit, –physdev)
- destination_port: destination port (requires protocol)
- source_port: source port (requires protocol)

Examples:

    # Block SSH traffic

    iptables.rule(
        'INPUT', 'DROP',
        destination_port=22
    )

    # NAT traffic on from 8.8.8.8:53 to 8.8.4.4:8080

    iptables.rule(
        'PREROUTING', 'DNAT', table='nat',
        source='8.8.8.8', destination_port=53,
        to_destination='8.8.4.4:8080'
    )