iptables源码

# Generated by iptables-save v1.4.7 on Wed Mar 29 16:50:09 2017
*filter
:INPUT DROP [908:112872]
:FORWARD DROP [0:0]
:OUTPUT DROP [2:127]
-A INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -d 11.100.45.65/32 -p tcp -m multiport –dports 80,21,22 -m state –state NEW -j ACCEPT
-A INPUT -d 11.100.45.65/32 -p udp -m multiport –dports 69,161,162 -j ACCEPT
-A INPUT -d 11.100.65.45/32 -p tcp -m tcp –dport 80 -m state –state NEW -m time –weekdays Tue,Wed,Thu,Fri,Sat,Sun –datestop 2038-01-19T11:14:07 -m limit –limit 100/sec -m string —
string “admin” –algo bm –to 65535 -j ACCEPT
-A INPUT -s 172.16.0.0/24 -d 11.100.45.65/32 -p tcp -m tcp –dport 21 -m time –timestart 08:30:00 –timestop 18:30:00 –weekdays Mon,Tue,Wed,Thu,Fri –datestop 2038-01-19T11:14:07 -m
limit –limit 5/min -j ACCEPT
-A INPUT -d 11.100.45.65/32 -p tcp -m tcp –dport 22 -m iprange –src-range 172.16.1.0-172.16.1.100 -m limit –limit 2/min -j ACCEPT
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE -j DROP
-A INPUT -p tcp -m tcp –tcp-flags FIN,SYN,RST,PSH,ACK,URG FIN,SYN,RST,PSH,ACK,URG -j DROP
-A INPUT -p tcp -m tcp –dport 22 -m connlimit –connlimit-above 3 –connlimit-mask 32 -j DROP
-A INPUT -p tcp -m tcp –dport 22 -m state –state NEW -m recent –set –name SSH –rsource
-A INPUT -p tcp -m tcp –dport 22 -m state –state NEW -m recent –update –seconds 300 –hitcount 3 –name SSH –rsource -j LOG –log-prefix “SSH Attach: ”
-A INPUT -p tcp -m tcp –dport 22 -m state –state NEW -m recent –update –seconds 300 –hitcount 3 –name SSH –rsource -j DROP
-A OUTPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -s 11.100.45.65/32 -p udp -m multiport –dports 161,69 -j ACCEPT
-A OUTPUT -d 172.16.31.125/32 -p udp -m multiport –dports 53,123 -j ACCEPT
-A OUTPUT -d 172.16.31.125/32 -p tcp -m tcp –dport 80 -j ACCEPT
-A OUTPUT -s 11.100.45.65/32 -p icmp -m icmp –icmp-type 8 -j ACCEPT
COMMIT
# Completed on Wed Mar 29 16:50:09 2017

# Generated by iptables-save v1.4.7 on Wed Mar 29 16:52:21 2017
*nat
:PREROUTING ACCEPT [3978825:205571740]
:POSTROUTING ACCEPT [2:120]
:OUTPUT ACCEPT [10:704]
-A PREROUTING -d 192.168.0.82/32 -p tcp -m tcp –dport 80 -j DNAT –to-destination 172.16.31.125:80
-A POSTROUTING -m iprange –src-range 172.16.31.0-172.16.31.254 ! –dst-range 172.16.31.0-172.16.31.254 -j MASQUERADE
COMMIT
# Completed on Wed Mar 29 16:52:21 2017
# Generated by iptables-save v1.4.7 on Wed Mar 29 16:52:21 2017
*filter
:INPUT DROP [26479:2366665]
:FORWARD DROP [3:180]
:OUTPUT DROP [8:584]
-A INPUT -s 172.16.31.123/32 -d 172.16.31.250/32 -p tcp -m tcp –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp –sport 80 -j ACCEPT
-A FORWARD -m state –state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -p tcp -m multiport –dports 80,443,873,21 -m state –state NEW -m iprange –src-range 172.16.31.1-172.16.31.254 -j ACCEPT
-A FORWARD -p udp -m multiport –dports 53,123 -m iprange –src-range 172.16.31.1-172.16.31.254 -j ACCEPT
-A FORWARD -p icmp -m icmp –icmp-type 8 -m iprange –src-range 172.16.31.1-172.16.31.254 -j ACCEPT
-A FORWARD -p tcp -m tcp –dport 80 -m iprange –src-range 192.168.0.1-192.168.1.254 -j ACCEPT
-A OUTPUT -s 172.16.31.250/32 -d 172.16.31.123/32 -p tcp -m state –state ESTABLISHED -m tcp –sport 22 -j ACCEPT
-A OUTPUT -p tcp -m tcp –dport 80 -j ACCEPT
COMMIT
# Completed on Wed Mar 29 16:52:21 2017