iptables--命令行解析

 一、iptabls命令行初探:
        在linux下执行iptables --help 
iptables --help
iptables v1.4.21

Usage: iptables -[ACD] chain rule-specification [options]
       iptables -I chain [rulenum] rule-specification [options]
       iptables -R chain rulenum rule-specification [options]
       iptables -D chain rulenum [options]
       iptables -[LS] [chain [rulenum]] [options]
       iptables -[FZ] [chain] [options]
       iptables -[NX] chain
       iptables -E old-chain-name new-chain-name
       iptables -P chain target [options]
       iptables -h (print this help information)

Commands:
Either long or short options are allowed.
  --append  -A chain Append to chain
  --check   -C chain Check for the existence of a rule
  --delete  -D chain Delete matching rule from chain
  --delete  -D chain rulenum
Delete rule rulenum (1 = first) from chain
  --insert  -I chain [rulenum]
Insert in chain as rulenum (default 1=first)
  --replace -R chain rulenum
Replace rule rulenum (1 = first) in chain
  --list    -L [chain [rulenum]]
List the rules in a chain or all chains
  --list-rules -S [chain [rulenum]]
Print the rules in a chain or all chains
  --flush   -F [chain] Delete all rules in  chain or all chains
  --zero    -Z [chain [rulenum]]
Zero counters in chain or all chains
  --new     -N chain Create a new user-defined chain
  --delete-chain
            -X [chain] Delete a user-defined chain
  --policy  -P chain target
Change policy on chain to target
  --rename-chain
            -E old-chain new-chain
Change chain name, (moving any references)
Options:
    --ipv4 -4 Nothing (line is ignored by ip6tables-restore)
    --ipv6 -6 Error (line is ignored by iptables-restore)
[!] --protocol -p proto protocol: by number or name, eg. `tcp'
[!] --source -s address[/mask][...]
source specification
[!] --destination -d address[/mask][...]
destination specification
[!] --in-interface -i input name[+]
network interface name ([+] for wildcard)
 --jump -j target
target for rule (may load target extension)
  --goto      -g chain
                              jump to chain with no return
  --match -m match
extended match (may load extension)
  --numeric -n numeric output of addresses and ports
[!] --out-interface -o output name[+]
network interface name ([+] for wildcard)
  --table -t table table to manipulate (default: `filter')
  --verbose -v verbose mode
  --wait -w wait for the xtables lock
  --line-numbers print line numbers when listing
  --exact -x expand numbers (display exact values)
[!] --fragment -f match second or further fragments only
  --modprobe= try to insert modules using this command
  --set-counters PKTS BYTES set the counter during insert/append
[!] --version -V print package version.

可以看到iptables命令行的格式为:
iptables 操作类型(增删替捡等) 链(chains) 规则参数  动作
这种情况下操作的表是filter,链和规则都是对filter表的操作。完整的iptables命令行为
iptables [-t table] COMMAND chain CRETIRIA -j ACTION 
iptables [-t 表]    操作类型      链    匹配规则    -j  动作

二、iptables的表(tables)
iptables可以作用的表为:
filter:默认表,提供数据包过滤功能。
nat:网络地址转换,主要提供源地址转换(SNAT)和目的地址转换(DNAT)。NAT转换的对象包括ip和port(四层端口)。
mangle:提供数据包修改功能。用于修改数据包的TOS(Type Of Service,服务类型)、TTL(Time To Live,生存周期)指以及为数据包设置Mark标记,以实现Qos(Quality Of Service,服务质量)调整以及策略路由等应用,由于需要相应的路由设备支持,因此应用并不广泛。
raw:可以提供日志跟踪功能。
filter、nat、mangle提供基本功能,raw提供辅助功能。nat修改的是数据包的源ip/源port/目的ip/目的port,mangle修改的是数据包的ip层属性。

三、iptables的链(chains)
iptables的链分为五个:
PREROUTING (路由前)        内核空间中:从一个网络接口进来,在路由判决前的位置。
INPUT (数据包流入口)          路由判决后,上报本地的数据包,从内核流入用户空间的位置。
FORWARD (转发管卡)         路由判决后,从本地转发的数据包,从用户空间流出的位置。
OUTPUT(数据包出口)          从本机发出的数据包,从用户空间进入内核的位置。
POSTROUTING(路由后)  从本机网卡发出的数据包,进入网卡前的位置。
这五个链对应的是内核netfilter架构的5个hook点。
mangle可以作用于五个链。
filter作用于INPUT、FORWARD、OUTPUT。
nat作用于 PREROUTING 、 OUTPUT、 POSTROUTING。
raw则作用于 
PREROUTING 、 OUTPUT。
 

四、操作类型
  --append          -A chain                            Append to chain                           
  --check             -C chain                           Check for the existence of a rule         
  --delete            -D chain                            Delete matching rule from chain           
  --delete            -D chain rulenum              Delete rule rulenum (1 = first) from chain
  --insert             -I chain [rulenum]              Insert in chain as rulenum (default 1=firs
  --replace          -R chain rulenum              Replace rule rulenum (1 = first) in chain 
  --list                  -L [chain [rulenum]]          List the rules in a chain or all chains   
  --list-rules         -S [chain [rulenum]]          Print the rules in a chain or all chains  
  --flush               -F [chain]                          Delete all rules in  chain or all chains  
  --zero                -Z [chain [rulenum]]          Zero counters in chain or all chains      
  --new                -N chain                            Create a new user-defined chain           
  --delete-chain   -X [chain]                          Delete a user-defined chain               
  --policy              -P chain target                 Change policy on chain to target          
  --rename-chain -E old-chain new-chain     Change chain name, (moving any references)

五、动作(target)
标准的target:
 — A user-defined chain within the table. User-defined chain names must be unique. This target passes the packet to the specified chain.
ACCEPT — Allows the packet through to its destination or to another chain.
DROP — Drops the packet without responding to the requester. The system that sent the packet is not notified of the failure.
QUEUE — The packet is queued for handling by a user-space application.
RETURN — Stops checking the packet against rules in the current chain. If the packet with a  RETURN target matches a rule in a chain called from another chain, the packet is returned to the first chain to resume rule checking where it left off. If the  RETURN rule is used on a built-in chain and the packet cannot move up to its previous chain, the default target for the current chain is used.
扩展的target: 
  • LOG — Logs all packets that match this rule. Because the packets are logged by the kernel, the /etc/syslog.conf file determines where these log entries are written. By default, they are placed in the /var/log/messages file.

    Additional options can be used after the LOG target to specify the way in which logging occurs:

    • --log-level — Sets the priority level of a logging event. Refer to the syslog.conf man page for a list of priority levels.

    • --log-ip-options — Logs any options set in the header of an IP packet.

    • --log-prefix — Places a string of up to 29 characters before the log line when it is written. This is useful for writing syslog filters for use in conjunction with packet logging.

    • --log-tcp-options — Logs any options set in the header of a TCP packet.

    • --log-tcp-sequence — Writes the TCP sequence number for the packet in the log.

  • REJECT — Sends an error packet back to the remote system and drops the packet.

    The REJECT target accepts --reject-with  (where  is the rejection type) allowing more detailed information to be returned with the error packet. The message port-unreachable is the default error type given if no other option is used. Refer to the iptables man page for a full list of  options.

 此外,扩展的target还包括SNAT、DNAT、MASQUERADE 。用户也可以自己编写扩展target。

 六、举例
对于源ip在172.16.0.0/16、目的端口53的udp包丢弃
 
iptables -t filter -A INPUT -s 172.16.0.0/16 -p udp --dport 53-j DROP   

 DNAT  202.103.96.112的访问到192.168.0.112上  
 
iptables -t nat -A PREROUTING -d 202.103.96.112 -j DNAT --to-destination 192.168.0.112 
 

192.168.0.0/24网段发出的数据包SNAT为58.20.51.66
 
iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to-source 58.20.51.66
   
打标记  
 
iptables -t mangle -A PREROUTING -i eth0 -p tcp --dport 80 -j MARK --set-mark 1   
 
指定目的80端口的包不进入链接跟踪/NAT子系统
 
iptables -t raw -A PREROUTING -d 1.2.3.4 -p tcp --dport 80 -j NOTRACK    
 
参考:
1、http://blog.csdn.net/lic95/article/details/50670617
2、http://blog.jobbole.com/90008/ 
3、https://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-iptables-options-target.html






你可能感兴趣的:(network)