在linux下执行iptables --help
可以看到iptables命令行的格式为:
iptables 操作类型(增删替捡等) 链(chains) 规则参数 动作
这种情况下操作的表是filter,链和规则都是对filter表的操作。完整的iptables命令行为
iptables [-t table] COMMAND chain CRETIRIA -j ACTION
iptables [-t 表] 操作类型 链 匹配规则 -j 动作
二、iptables的表(tables)
filter:默认表,提供数据包过滤功能。
nat:网络地址转换,主要提供源地址转换(SNAT)和目的地址转换(DNAT)。NAT转换的对象包括ip和port(四层端口)。
mangle:提供数据包修改功能。用于修改数据包的TOS(Type Of Service,服务类型)、TTL(Time To Live,生存周期)指以及为数据包设置Mark标记,以实现Qos(Quality Of Service,服务质量)调整以及策略路由等应用,由于需要相应的路由设备支持,因此应用并不广泛。
raw:可以提供日志跟踪功能。
filter、nat、mangle提供基本功能,raw提供辅助功能。nat修改的是数据包的源ip/源port/目的ip/目的port,mangle修改的是数据包的ip层属性。
三、iptables的链(chains)
iptables的链分为五个:
PREROUTING (路由前) 内核空间中:从一个网络接口进来,在路由判决前的位置。
INPUT (数据包流入口) 路由判决后,上报本地的数据包,从内核流入用户空间的位置。
FORWARD (转发管卡) 路由判决后,从本地转发的数据包,从用户空间流出的位置。
OUTPUT(数据包出口) 从本机发出的数据包,从用户空间进入内核的位置。
POSTROUTING(路由后) 从本机网卡发出的数据包,进入网卡前的位置。
这五个链对应的是内核netfilter架构的5个hook点。
mangle可以作用于五个链。
filter作用于INPUT、FORWARD、OUTPUT。
nat作用于 PREROUTING 、 OUTPUT、 POSTROUTING。
raw则作用于 PREROUTING 、 OUTPUT。
四、操作类型
标准的target:
<user-defined-chain>
— A user-defined chain within the table. User-defined chain names must be unique. This target passes the packet to the specified chain.
ACCEPT
— Allows the packet through to its destination or to another chain.
DROP
— Drops the packet without responding to the requester. The system that sent the packet is not notified of the failure.
QUEUE
— The packet is queued for handling by a user-space application.
RETURN
— Stops checking the packet against rules in the current chain. If the packet with a
RETURN
target matches a rule in a chain called from another chain, the packet is returned to the first chain to resume rule checking where it left off. If the
RETURN
rule is used on a built-in chain and the packet cannot move up to its previous chain, the default target for the current chain is used.
扩展的target:
-
LOG
— Logs all packets that match this rule. Because the packets are logged by the kernel, the/etc/syslog.conf
file determines where these log entries are written. By default, they are placed in the/var/log/messages
file.Additional options can be used after the
LOG
target to specify the way in which logging occurs:-
--log-level
— Sets the priority level of a logging event. Refer to thesyslog.conf
man page for a list of priority levels. -
--log-ip-options
— Logs any options set in the header of an IP packet. -
--log-prefix
— Places a string of up to 29 characters before the log line when it is written. This is useful for writing syslog filters for use in conjunction with packet logging. -
--log-tcp-options
— Logs any options set in the header of a TCP packet. -
--log-tcp-sequence
— Writes the TCP sequence number for the packet in the log.
-
-
REJECT
— Sends an error packet back to the remote system and drops the packet.The
REJECT
target accepts--reject-with
(where<type>
<type>
is the rejection type) allowing more detailed information to be returned with the error packet. The messageport-unreachable
is the default error type given if no other option is used. Refer to theiptables
man page for a full list of<type>
options.
六、举例
对于源ip在172.16.0.0/16、目的端口53的udp包丢弃
iptables -t filter -A INPUT -s 172.16.0.0/16 -p udp --dport 53-j DROP
DNAT 202.103.96.112的访问到192.168.0.112上
iptables -t nat -A PREROUTING -d 202.103.96.112 -j DNAT --to-destination 192.168.0.112
192.168.0.0/24网段发出的数据包SNAT为58.20.51.66
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to-source 58.20.51.66
iptables -t mangle -A PREROUTING -i eth0 -p tcp --dport 80 -j MARK --set-mark 1
指定目的80端口的包不进入链接跟踪/NAT子系统
iptables -t raw -A PREROUTING -d 1.2.3.4 -p tcp --dport 80 -j NOTRACK
参考:
2、http://blog.jobbole.com/90008/