SSD202D-tool-添加app-iptables

移植1.4.21

IPTABLES_DIR ?= $(shell pwd)
IPTABLES_BALL := iptables-1.4.21.tar.bz2
IPTABLES_NAME := iptables-1.4.21
IPTABLES_BIN := sbin
OSDRV_CROSS ?= arm-linux-gnueabihf
OSDRV_CROSS_CFLAGS ?= -mcpu=cortex-a7 -mfloat-abi=hard -mfpu=neon

all:
	-rm $(IPTABLES_DIR)/$(IPTABLES_NAME) -rf;
	tar -jxvf $(IPTABLES_BALL);
	mkdir -p $(IPTABLES_DIR)/$(IPTABLES_BIN)/;
	mkdir -p $(IPTABLES_DIR)/$(IPTABLES_NAME)/$(IPTABLES_BIN)/;
	
	pushd $(IPTABLES_DIR)/$(IPTABLES_NAME)/; \
		./configure --host=$(OSDRV_CROSS) CFLAGS="$(OSDRV_CROSS_CFLAGS)" \
		--enable-static --disable-shared \
		--prefix=$(IPTABLES_DIR)/$(IPTABLES_NAME)/$(IPTABLES_BIN) ; \
		make -j 20; \
		make install; \
		cp $(IPTABLES_BIN)/* $(IPTABLES_DIR)/$(IPTABLES_BIN) -rf; \
	popd

.PHONY: clean

	-pushd $(IPTABLES_DIR)/$(IPTABLES_NAME)/ &&\
	make -C $(IPTABLES_DIR)/$(IPTABLES_NAME)/ clean && \
	popd

.PHONY: distclean
distclean:
	-rm $(IPTABLES_DIR)/$(IPTABLES_NAME) -rf;
	-rm $(IPTABLES_DIR)/$(IPTABLES_BIN) -rf;

 内核:make ARCH=arm menuconfig

CONFIG_NET_INGRESS=y
CONFIG_NETFILTER=y
CONFIG_NETFILTER_ADVANCED=y
CONFIG_NETFILTER_INGRESS=y
CONFIG_NF_CONNTRACK=y
CONFIG_NF_CONNTRACK_MARK=y
CONFIG_NF_CONNTRACK_PROCFS=y
CONFIG_NF_CT_PROTO_DCCP=y
CONFIG_NF_CT_PROTO_SCTP=y
CONFIG_NF_CT_PROTO_UDPLITE=y
CONFIG_NF_NAT=y
CONFIG_NF_NAT_NEEDED=y
CONFIG_NF_NAT_PROTO_DCCP=y
CONFIG_NF_NAT_PROTO_UDPLITE=y
CONFIG_NF_NAT_PROTO_SCTP=y
CONFIG_NF_NAT_REDIRECT=y
CONFIG_NETFILTER_XTABLES=y
CONFIG_NETFILTER_XT_NAT=y
CONFIG_NETFILTER_XT_TARGET_NETMAP=y
CONFIG_NETFILTER_XT_TARGET_REDIRECT=y
CONFIG_NF_DEFRAG_IPV4=y
CONFIG_NF_CONNTRACK_IPV4=y
CONFIG_NF_REJECT_IPV4=y
CONFIG_NF_NAT_IPV4=y
CONFIG_NF_NAT_MASQUERADE_IPV4=y
CONFIG_IP_NF_IPTABLES=y
CONFIG_IP_NF_FILTER=y
CONFIG_IP_NF_TARGET_REJECT=y
CONFIG_IP_NF_NAT=y
CONFIG_IP_NF_TARGET_MASQUERADE=y
CONFIG_IP_NF_TARGET_NETMAP=y
CONFIG_IP_NF_TARGET_REDIRECT=y

 

查看规则：
iptables -L
iptables -nL
iptables -t filter -L
iptables -L -n --line-number
删除规则：
iptables -D INPUT 1  //行号，第几行

添加规则：
iptables -A INPUT -s 192.168.1.199 -j ACCEPT
iptables -I INPUT 1 -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -s 198.168.1.199/24 -p tcp --dport 22 -j ACCEPT


设置默认规则：（-P）
iptables -P INPUT DROP 

插入规则：（-I）
=============================================================================
iptables [-t表名]  选项  [链名]  [条件]  [-j满足条件的操作]

选项大写：-L、-P、-A、-I、 -D、 -F
链名大写：INPUT、OUTPUT、FORWARD
目标操作大写：DROP、 ACCEPT、 REJECT..
其他小写： -s  -p  --sport --deport...

INPUT：数据包的目标地址是自己，则进入INPUT链 
OUTPUT：数据包的源地址是自己，则进入OUTPUT链
FORWARD：数据包穿过自己，则进入FORWARD链

应用层      ssh http ftp   (后新增表示层、会话层)
传输层      tcp / udp端口号
网络层      icmp (ping)    #icmp不放开，就不用考虑上面两层的的传输了
数据链路层
物理层

============================已淘汰iptables-1.8..9版本==========================

IPTABLES_DIR ?= $(shell pwd)
IPTABLES_BALL := iptables-1.8.9.tar.xz
IPTABLES_NAME := iptables-1.8.9
IPTABLES_BIN := sbin
OSDRV_CROSS ?= arm-linux-gnueabihf
OSDRV_CROSS_CFLAGS ?= -mcpu=cortex-a7 -mfloat-abi=hard -mfpu=neon

all:
	-rm $(IPTABLES_DIR)/$(IPTABLES_NAME) -rf;
	tar -xvf $(IPTABLES_BALL);
	mkdir -p $(IPTABLES_DIR)/$(IPTABLES_BIN)/;
	mkdir -p $(IPTABLES_DIR)/$(IPTABLES_NAME)/$(IPTABLES_BIN)/;
	
	pushd $(IPTABLES_DIR)/$(IPTABLES_NAME)/; \
		./configure --host=$(OSDRV_CROSS) CFLAGS="$(OSDRV_CROSS_CFLAGS)" \
		--enable-static --disable-shared --disable-ipv6 --disable-largefile --disable-nftables\
		--prefix=$(IPTABLES_DIR)/$(IPTABLES_NAME)/$(IPTABLES_BIN) ; \
		make -j 20; \
		make install; \
		cp $(IPTABLES_BIN)/* $(IPTABLES_DIR)/$(IPTABLES_BIN) -rf; \
	popd

.PHONY: clean

	-pushd $(IPTABLES_DIR)/$(IPTABLES_NAME)/ &&\
	make -C $(IPTABLES_DIR)/$(IPTABLES_NAME)/ clean && \
	popd

.PHONY: distclean
distclean:
	-rm $(IPTABLES_DIR)/$(IPTABLES_NAME) -rf;
	-rm $(IPTABLES_DIR)/$(IPTABLES_BIN) -rf;

详细参考：iptables的使用简单测试_destination port unreachable iptables_daydayup9527的博客-CSDN博客仅自己学习笔记_destination port unreachable iptableshttps://blog.csdn.net/weixin_60092693/article/details/126091381