iptables 命令详解

iptables -h

  1. iptables v1.4.21
  3. Usage: iptables -[ACD] chain rule-specification [options]
  4.        iptables -I chain [rulenum] rule-specification [options]
  5.        iptables -R chain rulenum rule-specification [options]
  6.        iptables -D chain rulenum [options]
  7.        iptables -[LS] [chain [rulenum]] [options]
  8.        iptables -[FZ] [chain] [options]
  9.        iptables -[NX] chain
  10.        iptables -E old-chain-name new-chain-name
  11.        iptables -P chain target [options]
  12.        iptables -h (print this help information)
  14. Commands:
  15. Either long or short options are allowed.
  16.   --append  -A chain        Append to chain
  17.   --check   -C chain        Check for the existence of a rule
  18.   --delete  -D chain        Delete matching rule from chain
  19.   --delete  -D chain rulenum
  20.                 Delete rule rulenum (1 = first) from chain
  21.   --insert  -I chain [rulenum]
  22.                 Insert in chain as rulenum (default 1=first)
  23.   --replace -R chain rulenum
  24.                 Replace rule rulenum (1 = first) in chain
  25.   --list    -L [chain [rulenum]]
  26.                 List the rules in a chain or all chains
  27.   --list-rules -S [chain [rulenum]]
  28.                 Print the rules in a chain or all chains
  29.   --flush   -F [chain]        Delete all rules in  chain or all chains
  30.   --zero    -Z [chain [rulenum]]
  31.                 Zero counters in chain or all chains
  32.   --new     -N chain        Create a new user-defined chain
  33.   --delete-chain
  34.             -X [chain]        Delete a user-defined chain
  35.   --policy  -P chain target
  36.                 Change policy on chain to target
  37.   --rename-chain
  38.             -E old-chain new-chain
  39.                 Change chain name, (moving any references)
  40. Options:
  41.     --ipv4    -4        Nothing (line is ignored by ip6tables-restore)
  42.     --ipv6    -6        Error (line is ignored by iptables-restore)
  43. [!] --protocol    -p proto    protocol: by number or name, eg. `tcp'
  44. [!] --source    -s address[/mask][...]
  45.                 source specification
  46. [!] --destination -d address[/mask][...]
  47.                 destination specification
  48. [!] --in-interface -i input name[+]
  49.                 network interface name ([+] for wildcard)
  50.  --jump    -j target
  51.                 target for rule (may load target extension)
  52.   --goto      -g chain
  53.                               jump to chain with no return
  54.   --match    -m match
  55.                 extended match (may load extension)
  56.   --numeric    -n        numeric output of addresses and ports
  57. [!] --out-interface -o output name[+]
  58.                 network interface name ([+] for wildcard)
  59.   --table    -t table    table to manipulate (default: `filter')
  60.   --verbose    -v        verbose mode
  61.   --wait    -w [seconds]    maximum wait to acquire xtables lock before give up
  62.   --wait-interval -W [usecs]    wait time to try to acquire xtables lock
  63.                 default is 1 second
  64.   --line-numbers        print line numbers when listing
  65.   --exact    -x        expand numbers (display exact values)
  66. [!] --fragment    -f        match second or further fragments only
  67.   --modprobe=<command>        try to insert modules using this command
  68.   --set-counters PKTS BYTES    set the counter during insert/append
  69. [!] --version    -V        print package version.

常用参数

  1. --table    -t table    table to manipulate (default: `filter')
  3. --list    -L [chain [rulenum]]
  4.                 List the rules in a chain or all chains
  6. --verbose    -v        verbose mode

查看filter表中的规则

  • iptables -vL INPUT ``` Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
    473 53337 ACCEPT all — any any anywhere anywhere ctstate RELATED,ESTABLISHED 33 2772 ACCEPT all — lo any anywhere anywhere
    722 70195 INPUT_direct all — any any anywhere anywhere
    722 70195 INPUT_ZONES_SOURCE all — any any anywhere anywhere
    722 70195 INPUT_ZONES all — any any anywhere anywhere
    30 2043 DROP all — any any anywhere anywhere ctstate INVALID 692 68152 REJECT all — any any anywhere anywhere reject-with icmp-host-prohibited
  1. ```
  2. pkts:对应规则匹配到的报文的个数。
  4. bytes:对应匹配到的报文包的大小总和。
  6. target:规则对应的target，往往表示规则对应的”动作”，即规则匹配成功后需要采取的措施。
  8. prot:表示规则对应的协议，是否只针对某些协议应用此规则。
  10. opt:表示规则对应的选项。
  12. in:表示数据包由哪个接口(网卡)流入，我们可以设置通过哪块网卡流入的报文需要匹配当前规则。
  14. out:表示数据包由哪个接口(网卡)流出，我们可以设置通过哪块网卡流出的报文需要匹配当前规则。
  16. source:表示规则对应的源头地址，可以是一个IP，也可以是一个网段。
  18. destination:表示规则对应的目标地址。可以是一个IP，也可以是一个网段。