iptables--命令行解析

一、iptabls命令行初探：         在linux下执行iptables --help  iptables --help iptables v1.4.21 Usage: iptables -[ACD] chain rule-specification [options]        iptables -I chain [rulenum] rule-specification [options]        iptables -R chain rulenum rule-specification [options]        iptables -D chain rulenum [options]        iptables -[LS] [chain [rulenum]] [options]        iptables -[FZ] [chain] [options]        iptables -[NX] chain        iptables -E old-chain-name new-chain-name        iptables -P chain target [options]        iptables -h (print this help information) Commands: Either long or short options are allowed.   --append  -A chain Append to chain   --check   -C chain Check for the existence of a rule   --delete  -D chain Delete matching rule from chain   --delete  -D chain rulenum Delete rule rulenum (1 = first) from chain   --insert  -I chain [rulenum] Insert in chain as rulenum (default 1=first)   --replace -R chain rulenum Replace rule rulenum (1 = first) in chain   --list    -L [chain [rulenum]] List the rules in a chain or all chains   --list-rules -S [chain [rulenum]] Print the rules in a chain or all chains   --flush   -F [chain] Delete all rules in  chain or all chains   --zero    -Z [chain [rulenum]] Zero counters in chain or all chains   --new     -N chain Create a new user-defined chain   --delete-chain             -X [chain] Delete a user-defined chain   --policy  -P chain target Change policy on chain to target   --rename-chain             -E old-chain new-chain Change chain name, (moving any references) Options:     --ipv4 -4 Nothing (line is ignored by ip6tables-restore)     --ipv6 -6 Error (line is ignored by iptables-restore) [!] --protocol -p proto protocol: by number or name, eg. `tcp' [!] --source -s address[/mask][...] source specification [!] --destination -d address[/mask][...] destination specification [!] --in-interface -i input name[+] network interface name ([+] for wildcard)  --jump -j target target for rule (may load target extension)   --goto      -g chain                               jump to chain with no return   --match -m match extended match (may load extension)   --numeric -n numeric output of addresses and ports [!] --out-interface -o output name[+] network interface name ([+] for wildcard)   --table -t table table to manipulate (default: `filter')   --verbose -v verbose mode   --wait -w wait for the xtables lock   --line-numbers print line numbers when listing   --exact -x expand numbers (display exact values) [!] --fragment -f match second or further fragments only   --modprobe=<command> try to insert modules using this command   --set-counters PKTS BYTES set the counter during insert/append [!] --version -V print package version. 可以看到iptables命令行的格式为： iptables 操作类型（增删替捡等） 链（chains） 规则参数  动作 这种情况下操作的表是filter，链和规则都是对filter表的操作。完整的iptables命令行为 iptables [-t table] COMMAND chain CRETIRIA -j ACTION  iptables [-t 表]    操作类型      链    匹配规则    -j  动作 二、iptables的表（tables） iptables可以作用的表为： filter：默认表，提供数据包过滤功能。 nat：网络地址转换，主要提供源地址转换（SNAT）和目的地址转换（DNAT）。NAT转换的对象包括ip和port（四层端口）。 mangle：提供数据包修改功能。用于修改数据包的TOS（Type Of Service，服务类型）、TTL（Time To Live，生存周期）指以及为数据包设置Mark标记，以实现Qos(Quality Of Service，服务质量)调整以及策略路由等应用，由于需要相应的路由设备支持，因此应用并不广泛。 raw：可以提供日志跟踪功能。 filter、nat、mangle提供基本功能，raw提供辅助功能。nat修改的是数据包的源ip/源port/目的ip/目的port，mangle修改的是数据包的ip层属性。 三、iptables的链（chains） iptables的链分为五个： PREROUTING (路由前)        内核空间中：从一个网络接口进来，在路由判决前的位置。 INPUT (数据包流入口)          路由判决后，上报本地的数据包，从内核流入用户空间的位置。 FORWARD (转发管卡)         路由判决后，从本地转发的数据包，从用户空间流出的位置。 OUTPUT(数据包出口)          从本机发出的数据包，从用户空间进入内核的位置。 POSTROUTING（路由后）  从本机网卡发出的数据包，进入网卡前的位置。 这五个链对应的是内核netfilter架构的5个hook点。 mangle可以作用于五个链。 filter作用于INPUT、FORWARD、OUTPUT。 nat作用于 PREROUTING 、 OUTPUT、 POSTROUTING。 raw则作用于  PREROUTING 、 OUTPUT。   四、操作类型   --append          -A chain                            Append to chain                              --check             -C chain                           Check for the existence of a rule            --delete            -D chain                            Delete matching rule from chain              --delete            -D chain rulenum              Delete rule rulenum (1 = first) from chain   --insert             -I chain [rulenum]              Insert in chain as rulenum (default 1=firs   --replace          -R chain rulenum              Replace rule rulenum (1 = first) in chain    --list                  -L [chain [rulenum]]          List the rules in a chain or all chains      --list-rules         -S [chain [rulenum]]          Print the rules in a chain or all chains     --flush               -F [chain]                          Delete all rules in  chain or all chains     --zero                -Z [chain [rulenum]]          Zero counters in chain or all chains         --new                -N chain                            Create a new user-defined chain              --delete-chain   -X [chain]                          Delete a user-defined chain                  --policy              -P chain target                 Change policy on chain to target             --rename-chain -E old-chain new-chain     Change chain name, (moving any references) 五、动作（target） 标准的target： <user-defined-chain> — A user-defined chain within the table. User-defined chain names must be unique. This target passes the packet to the specified chain. ACCEPT — Allows the packet through to its destination or to another chain. DROP — Drops the packet without responding to the requester. The system that sent the packet is not notified of the failure. QUEUE — The packet is queued for handling by a user-space application. RETURN — Stops checking the packet against rules in the current chain. If the packet with a  RETURN target matches a rule in a chain called from another chain, the packet is returned to the first chain to resume rule checking where it left off. If the  RETURN rule is used on a built-in chain and the packet cannot move up to its previous chain, the default target for the current chain is used. 扩展的target： 

LOG — Logs all packets that match this rule. Because the packets are logged by the kernel, the /etc/syslog.conf file determines where these log entries are written. By default, they are placed in the /var/log/messages file.

Additional options can be used after the LOG target to specify the way in which logging occurs:

--log-level — Sets the priority level of a logging event. Refer to the syslog.conf man page for a list of priority levels.

--log-ip-options — Logs any options set in the header of an IP packet.

--log-prefix — Places a string of up to 29 characters before the log line when it is written. This is useful for writing syslog filters for use in conjunction with packet logging.

--log-tcp-options — Logs any options set in the header of a TCP packet.

--log-tcp-sequence — Writes the TCP sequence number for the packet in the log.

REJECT — Sends an error packet back to the remote system and drops the packet.

The REJECT target accepts --reject-with <type> (where <type> is the rejection type) allowing more detailed information to be returned with the error packet. The message port-unreachable is the default error type given if no other option is used. Refer to the iptables man page for a full list of <type> options.

 此外，扩展的target还包括SNAT、DNAT、MASQUERADE 。用户也可以自己编写扩展target。  六、举例 对于源ip在172.16.0.0/16、目的端口53的udp包丢弃  iptables -t filter -A INPUT -s 172.16.0.0/16 -p udp --dport 53-j DROP     DNAT  202.103.96.112的访问到192.168.0.112上     iptables -t nat -A PREROUTING -d 202.103.96.112 -j DNAT --to-destination 192.168.0.112    192.168.0.0/24网段发出的数据包SNAT为58.20.51.66   iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to-source 58.20.51.66     打标记    iptables -t mangle -A PREROUTING -i eth0 -p tcp --dport 80 -j MARK --set-mark 1      指定目的80端口的包不进入链接跟踪/NAT子系统   iptables -t raw -A PREROUTING -d 1.2.3.4 -p tcp --dport 80 -j NOTRACK       参考： 1、http://blog.csdn.net/lic95/article/details/50670617 2、http://blog.jobbole.com/90008/  3、https://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-iptables-options-target.html