iptables学习

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39

iptables [-t table] {-A|-C|-D} chain rule-specification
-A: append
-C: check
-D: delete

iptables [-t table] -I chain [rulenum] rule-specification
-I: insert

iptables [-t table] -R chain rulenum rule-specification
-R: replace

iptables [-t table] -D chain rulenum
-D: delete

iptables [-t table] -S [chain [rulenum]]
-S: --list-rules

iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...]
-F: flush
-L: list
-Z: zero

iptables [-t table] -N chain
-N: --new-chain

iptables [-t table] -X [chain]
-X: --delete-chain

iptables [-t table] -P chain target
-P: --policy

iptables [-t table] -E old-chain-name new-chain-name
-E: --rename-chain

rule-specification = [matches...] [target]

match = -m matchname [per-match-options]

target = -j targetname [per-target-options]

1

iptables -L

1
2

iptables -t nat -L
iptables -t mangle -L

1
2
3

iptables -L INPUT
iptables -L FORWARD
iptables -L OUTPUT

1

iptables -v -L

1

iptables -n -L

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

-p: 指定协议，可以写tcp/udp等
-s: source
-d: destination
-m: match
-j: jump可以指定rule的target
-g: goto指定下一个chain
-i: interface指定网络接口
-o: out interface
-f: fragment
-c: set counter初始化rule的包统计器

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

       iptables-save and ip6tables-save are used to dump the contents of IP or IPv6 Table in easily parseable format to STDOUT. Use I/O-redirection provided by your shell to write to a file.

       -M,--modprobe modprobe_program
              Specify the path to the modprobe program. By default, iptables-save will inspect /proc/sys/kernel/modprobe  to determine the executable's path.

       -c, --counters
              include the current values of all packet and byte counters in the output

       -t, --table tablename
              restrict output to only one table. If the kernel is configured with automatic module loading, an attempt will be made to load the appropriate module for that table if it is not already there. If not specified, output includes all available tables.

1
2
3
4
5

*filter
...规则...
...规则...
...规则...
COMMIT

1
2
3

:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]

1

-A INPUT -i lo -j ACCEPT

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

DESCRIPTION
       iptables-restore  and ip6tables-restore are used to restore IP and IPv6 Tables from data specified on STDIN. Use I/O redirection provided by your shell to read from a file

       -c, --counters
              restore the values of all packet and byte counters

       -h, --help
              Print a short option summary.

       -n, --noflush
              don't flush the previous contents of the table. If not specified, both commands flush (delete) all previous contents of  the  respective table.

       -t, --test
              Only parse and construct the ruleset, but do not commit it.

       -v, --verbose
              Print additional debug info during ruleset processing.

       -V, --version
              Print the program version number.

       -w, --wait [seconds]
              Wait for the xtables lock. To prevent multiple instances of the program from running concurrently, an attempt will be made to obtain an exclusive lock at launch.  By default, the program will exit if the lock cannot be obtained. This option will make the program wait (indefinitely or for optional seconds) until the exclusive lock can be obtained.

       -W, --wait-interval microseconds
              Interval  to  wait  per each iteration.  When running latency sensitive applications, waiting for the xtables lock for extended durations may not be acceptable. This option will make each iteration take the amount of time specified. The default interval is  1  second. This option only works with -w.

       -M, --modprobe modprobe_program
              Specify  the  path to the modprobe program. By default, iptables-restore will inspect /proc/sys/kernel/modprobe to determine the executable's path.

       -T, --table name
              Restore only the named table even if the input stream contains other ones.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

7    MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0            vaddr 10.255.250.21
8    MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0            vaddr 10.255.50.229
9    MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0            vaddr 10.255.110.226
10   MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0            vaddr 10.255.161.85
11   MASQUERADE  all  --  0.0.0.0/0            0.0.0.0/0            vaddr 10.255.238.113

ipvs
Match IPVS connection properties.

       [!] --ipvs
              packet belongs to an IPVS connection

       Any of the following options implies --ipvs (even negated)

       [!] --vproto protocol
              VIP protocol to match; by number or name, e.g. "tcp"

       [!] --vaddr address[/mask]
              VIP address to match

       [!] --vport port
              VIP port to match; by number or name, e.g. "http"

       --vdir {ORIGINAL|REPLY}
              flow direction of packet

       [!] --vmethod {GATE|IPIP|MASQ}
              IPVS forwarding method used

       [!] --vportctl port
              VIP port of the controlling connection to match, e.g. 21 for FTP