Any attack must be justified by military necessity: An attack or action must be intended to help in the military defeat of the enemy, it must be an attack on a military objective, and the harm caused to civilians or civilian property must be proportional and not "excessive in relation to the concrete and direct military advantage anticipated".
Some targets are clearly legitimate. These include all military personnel who are not Hors de combat. It also includes anyone who takes a direct part in military hostilities. It also include military equipment and bases and any buildings used as fortifications whether designed as such or used by the military ad hoc.
Civilian infrastructure such as, rail, road, ports, airports and telecommunications used for the transportation of military assets, or used by the military for electronic communications are all considered to be legitimate military targets.
Where it start to get more nuanced is if the harm to civilians or civilian property is "excessive in relation to the concrete and direct military advantage anticipated". During the Second World War there was a song called a thing-ummy-bob which contain the lines "And it's the girl that makes the thing that holds the oil, that oils the ring that works the thing-ummy-bob, that's going to win the war". Whether such a girl is a legitimate target is an area that probably has to be decided on a case by case basis. However Protocol I suggests that if it is not clear, then the parties to the conflict should err on the side of caution as Article 52 states "In case of doubt whether an object which is normally dedicated to civilian purposes, such as a place of worship, a house, or other dwelling or a school, is being used to make an effective contribution to military action, it shall be presumed not to be so used".