So far, we've learned mostly about the usage of iptables filtering options. I will now build up a small firewall script that I think should be default when installing any Linux distribution.
By default, all Linux distributions have the default policy ACCEPT on all filter chains. Also, on a default installation, most Linux distributions leave a lot of services running. If you install an old Linux distribution and decide to go for lunch after you have just booted up without any firewall and with a public IP address, good chances are that by the time you've eaten your soup, a rootkit is already installed on your computer.
Let's take a look at the following simple script:

So, what we did here was to set the INPUT and FORWARD chains policy to DROP. The OUTPUT chain policy is set to ACCEPT, which is the default policy for this chain.
We will not append any rules in the FORWARD chain because this is a personal computer and not a router, and so the forwarding will be off. We will also not append any rules in the OUTPUT chain—anything we originate is OK.
Next, we flush all existing rules out from the filter table. At this point, nothing really works. Some applications use TCP/IP connections on the loopback interface; so it's safe to allow packets that come in on the interface "lo".
We learned about ICMP attacks in Article 2. However, it is my opinion that ICMP should be allowed. Filtering ICMP will not allow you to test your internet connection using ping, traceroute, mtr, etc., and also path MTU discovery will not work, which is a very important protocol in many cases.

The last thing we need for our internet connection to work is to allow incoming TCP traffic for already established TCP connections. Better phrased, deny any incoming TCP traffic that doesn't belong to a TCP connection that this computer initiated (deny TCP SYN packets).

iproute2 and Traffic Control

iproute2 is a software package that provides various tools for advanced routing, tunnels, and traffic control.
iproute2 was originally designed by Alexey Kuznetsov, and is well known for implementing QoS in Linux kernels and is now maintained by Stephen Hemminger. The primary site for iproute2 is http://linux-net.osdl.org/index.php/Iproute2  and its main documentation site is http://www.lartc.org.
The most important tools that iproute2 provides are ip and tc.
Network Configuration: "ip" Tool

The ip tool provides most of the networking configuration a Linux box needs. You can configure interfaces, ARP, policy routing, tunnels, etc.
Now, with IPv4 and IPv6, ip can do pretty much anything (including a lot that we don't need in our particular situations). The syntax of ip is not difficult, and there is a lot of documentation on this subject. However, the most important thing is knowing what we need and when we need it.
First of all, ip is the main tool we need for dynamic routing protocols (BGP, OSPF, and RIP) on Linux provided by Zebra, which will be discussed later in this article.
Let's have a look at the ip command help to see what ip knows:

The ip link command shows the network device's configurations that can be changed with ip link set. This command is used to modify the device's proprieties and not the IP address.
The IP addresses can be configured using the ip addr command. This command can be used to add a primary or secondary (alias) IP address to a network device (ip addr add), to display the IP addresses for each network device (ip addr show), or to delete IP addresses from interfaces (ip addr del). IP addresses can also be flushed using different criteria, e.g. ip addr flush dynamic will flush all routes added to the kernel by a dynamic routing protocol.
Neighbor/Arp table management is done using ip neighbor, which has a few commands expressively named add, change, replace, delete, and flush.
ip tunnel is used to manage tunneled connections. Tunnels can be gre, ipip, and sit. We will include an example later in the article on how to build IP tunnels.
The ip tool offers a way for monitoring routes, addresses, and the states of devices in real-time. This can be accomplished using ip monitor, rtmon, and rtacct commands included in the iproute2 package.
One very important and probably the most used object of the ip tool is ip route, which can do any operations on the kernel routing table. It has commands to add, change, replace, delete, show, flush, and get routes.
One of the things iproute2 introduced to Linux that ensured its popularity was policy routing. This can be done using ip rule and ip route in a few simple steps.

Traffic Control: tc

The tc command allows administrators to build different QoS policies in their networks using Linux instead of very expensive dedicated QoS machines. Using Linux, you can implement QoS in all the ways any dedicated QoS machine can and even more. Also, one can make a bridge using a good PC running Linux that can be transformed into a very powerful and very cheap dedicated QoS machine.
For that, QoS support must be configured in the Linux kernel (CONFIG_NET_QOS="Y" and CONFIG_NET_SCHED="Y").

Classless Queuing Disciplines (Classless qdiscs)

Classless qdiscs are the simplest ones because they only accept, drop, delay or reschedule data. They can be attached to one interface and can only shape the entire interface.

There are several qdisc implementations on Linux, most of them included in the Linux kernel.

1. FIFO (pfifo and bfifo): The simplest qdisc, which functions by the First In, First Out rule. FIFO algorithms have a queue size limit (buffer size), which can be defined in packets for pfifo or in bytes for bfifo.
2. pfifo_fast: The default qdisc on all Linux interfaces. It's important to know how pfifo_fast works; so we'll explain it soon.
3. Token Bucket Filter (tbf): A simple qdisc that is perfect for slowing down an interface to a specified rate. It can allow short bursts over the specified rate and is very processor friendly.
4. Stochastic Fair Queuing (SFQ): One of the most widely used qdiscs. SFQ tries to fairly distribute the transmitting data among a number of flows.
5. Enhanced Stochastic Fair Queuing (ESFQ): Not included in the Linux kernel, it works in the same manner as SFQ with the exception that the user can control more of the algorithm's parameters such as depth (flows) limit, hash table size options (hardcoded in original SFQ) and hash types.
6. Random Early Detection and Generic Random Early Detection (RED and GRED): qdiscs suitable for backbone data queuing, with data rates over 100 Mbps.

There are more qdiscs than the ones I have stated here. However, from my experience, SFQ and ESFQ do a great job, and are the qdiscs that I have got the best results with.
As I said earlier, the default qdisc on Linux for all interfaces is pfifo_fast. Normally, one would think that this is just like pfifo, meaning there is a buffer and packets pass through the buffer using the First In First Out rule. Actually, it's not quite true. pfifo_fast has 3 bands—0, 1, and 2—in which packets are placed according to their TOS byte. Packets are sent out from those bands as follows:

1. Packets in the 0 band have the highest priority
2. Packets in the 1 band are sent out only if there aren't any packets in the 0 band
3. Packets in the 2 band have the lowest priority and are sent out only if there aren't any packets in the 0 and 1 bands.

It's important to know this because this can be a way to optimize how packets travel through the network interfaces of our Linux routers.