iptables简单使用方法
规则链与策略:
规则:
ACCEPT:允许通过
LOG:记录日志
REJECT:拒绝通过,给出返回值
DROP:丢弃
规则链:
PREROUTING:路由前处理
INPUT:处理入站数据
OUTPUT:处理出站数据
FORWARD:处理转发数据
POSTROUTING:路由后处理
raw表:确定是否对数据包状态跟踪
mangle表:设置标记
nat表:修改数据包源、目标IP或端口
filter表:过滤
规则顺序
规则表先后顺序:raw表→mangle表→nat表→filter表
规则链先后顺序:
入站:PREROUTING→INPUT
出站:OUTPUT→POSTROUTING
转发:PREROUTING→FORWARD→POSTROUTING
基本参数:
iptables -[ACD] chain rule-specification [options]
iptables -I chain [rulenum] rule-specification [options]
iptables -R chain rulenum rule-specification [options]
iptables -D chain rulenum [options]
iptables -[LS] [chain [rulenum]] [options]
iptables -[FZ] [chain] [options]
iptables -[NX] chain
iptables -E old-chain-name new-chain-name
iptables -P chain target [options]
iptables -h (print this help information)
Commands:
Either long or short options are allowed.
--append -A chain Append to chain
--check -C chain Check for the existence of a rule
--delete -D chain Delete matching rule from chain
--delete -D chain rulenum
Delete rule rulenum (1 = first) from chain
--insert -I chain [rulenum]
Insert in chain as rulenum (default 1=first)
--replace -R chain rulenum
Replace rule rulenum (1 = first) in chain
--list -L [chain [rulenum]]
List the rules in a chain or all chains
--list-rules -S [chain [rulenum]]
Print the rules in a chain or all chains
--flush -F [chain] Delete all rules in chain or all chains
--zero -Z [chain [rulenum]]
Zero counters in chain or all chains
--new -N chain Create a new user-defined chain
--delete-chain
-X [chain] Delete a user-defined chain
--policy -P chain target
Change policy on chain to target
--rename-chain
-E old-chain new-chain
Change chain name, (moving any references)
Options:
--ipv4 -4 Nothing (line is ignored by ip6tables-restore)
--ipv6 -6 Error (line is ignored by iptables-restore)
[!] --protocol -p proto protocol: by number or name, eg. `tcp'
[!] --source -s address[/mask][...]
source specification
[!] --destination -d address[/mask][...]
destination specification
[!] --in-interface -i input name[+]
network interface name ([+] for wildcard)
--jump -j target
target for rule (may load target extension)
--goto -g chain
jump to chain with no return
--match -m match
extended match (may load extension)
--numeric -n numeric output of addresses and ports
[!] --out-interface -o output name[+]
network interface name ([+] for wildcard)
--table -t table table to manipulate (default: `filter')
--verbose -v verbose mode
--wait -w wait for the xtables lock
--line-numbers print line numbers when listing
--exact -x expand numbers (display exact values)
[!] --fragment -f match second or further fragments only
--modprobe=<command> try to insert modules using this command
--set-counters PKTS BYTES set the counter during insert/append
[!] --version -V print package version.
基本使用方法:
查看已有规则:iptables -L
iptables -L
清空所有规则:iptables -F
iptables -F
拒绝INPUT:iptables -P INPUT DROP
iptables -P INPUT DROP
允许所有ping:iptables -I INPUT -p icmp -j ACCEPT
iptables -I INPUT -p icmp -j ACCEPT
在末尾加入允许未被其他规则匹配的数据包:iptables -t filter -A INPUT -j -ACCEPT
iptables -t filter -A INPUT -j -ACCEPT
删除INPUT第二条规则:iptables -D INPUT 2
iptables -D INPUT 2
仅允许来自172.27.8.0/22的用户连接ssh服务
iptables -I INPUT -s 172.27.8.0/22 -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j REJECT
不允许任何用户访问本机3306端口
iptables -I INPUT -p tcp --dport 3306 -j REJECT
iptables -I INPUT -p udp --dport 3306 -j REJECT
拒绝其他用户通过网卡eth1访问本机http服务
iptables -I INPUT -i eth1 -p tcp --dport 80 -j REJECT
禁止用户访问www.baidu.com
iptables -I FORWARD -d www.baidu.com -j DROP
禁止172.27.8.22的用户上网
iptables -I FORWARD -s 172.27.8.22 -j DROP