Detailed introduction to the Chinese man document on Linux iptables

Use IPTABLES-ADC to specify the rules of the chain-a add-D Delete-C modification

Iptables-[RI] chain rule num Rule-specification[option]

specified by Iptables-ri in the order of the Rules

iptables-d chain Rule num[option]

Delete specified rule

Iptables-[LFZ] [chain][option]

With IPTABLES-LFZ chain name [options]

Iptables-[NX] Chain

To specify a chain with-NX

Iptables-p chain Target[options]

Specify the default target for the chain

IPTABLES-E Old-chain-name New-chain-name

-e old chain name new chain name

Replace the old chain name with the new chain name

Description

Iptalbes is used to set up, maintain, and check the IP packet filtering rules of the Linux kernel.

You can define different tables, each of which contains several internal chains, and can contain user-defined chains. Each chain is a list of rules that match the corresponding package: Each rule specifies how the package that matches it should be handled. This is called ' target ', or it can jump to a user-defined chain within the same table.

TARGETS

The rules of the firewall specify the characteristics of the package being checked, and the target. If the package does not match, will be sent to the next rule in the chain, and if so, the following rule is determined by the target value. The target value can be a user-defined chain name, or a private value such as accept[through, drop[Delete, queue[queued up, or return[return.

ACCEPT said let the package pass. Drop indicates that the package is discarded. The queue represents the delivery of this package to user space. Return means to stop the match of this chain and start again with the rules of the previous chain. If a built-in chain (the end) is reached, or if the rule of the built-in chain is return, the fate of the package is determined by the goal specified by the chain guideline.

TABLES

There are currently three tables (which table is the current table depending on the kernel configuration option and the current module).

-T table

This option specifies the table of matching packages to be manipulated by the command. If the kernel is configured to load the module automatically, the (System) will attempt to load the appropriate module (for the table) if the module is not loaded. These tables are as follows: Filter, which is the default table, contains the built-in chain input (processing incoming packages), ForWord (processing through packages), and output (processing locally generated packages). NAT, this table is queried to indicate that the package that generated the new connection was encountered, consisting of three built-in chains: prerouting (Modified package), OUTPUT (the local package before modifying the route), postrouting (modifying the package to be ready to go). Mangle This table is used to modify the specified package. It has two built-in rules: Prerouting (the packets entered before modifying the route) and output (the local package before modifying the route).