Linux Basics of Iptables

Linux iptables Related:

iptables usage

iptables [-ttable] command chain ( chain ) [Cretiria(matching standard)]–jaction

-T [Raw,mangle,net, filter]

Command: manage operations on chains, or on rules in a chain

Rules in the chain:

-A Add a rule

- I. # insert a rule after the first few rules

- R # Modify the rules of the paragraph

- D # To Delete a few rules

Chain:

- N Increase

- x Delete Empty chain

- e Renaming a custom chain

- F empties the specified chain and, if not specified, clears all the chains in the table

- P default policy for the set chain

- Z 0 (each rule, including the default policy, has two counters, one is the number of all packets that are matched by this rule, and the other is the sum of the packets that are matched to this rule)

- L View

- v More Information

- N Digital Standard

iptables corresponding service script: /etc/rc.d/init.d/iptables

Service Script configuration file: /etc/rc.d/init.d/iptables-config

Rule Save location: /etc/sysconfig/iptables

Matching Criteria:

Basic match

- S Source Address

- D Destination Address

- p [ICMP|TCP|UDP] Protocol

- I. come in Network interface

- o go out network interface

Extended Match

Implicit extension

-P TCP

--sportport [Port2]

--dportport [Port2]

-P UDP

--sport

--dport

-P ICMP

--icmp-type

0: Response 8 : Request

Explicit Extension (/lib/iptables)

NetFilter Extensions introduced by extension modules for extending matching criteria, often requiring additional options to define

- M Specify Module

- m state stateful detection for link implementation

--state

-mmultiport

--source-ports Source Port

--destination-ports Destination Port

--ports

-M limit

--limit 3/min

--limit-burst 30

-mconnlimit

--connlimit-above N Connection Limit N

-M IPRange

--src-range Ip-ip A certain range IP

--dst-range Ip-ip

-M string

--algo

--string

Action:

ACCEPT

DROP

REJECT

REDIRECT

DNET

SNet

Masquerade

LOG

RETURN

This article from the "source clean is clear, the shape of the end of the shadow straight" blog, please be sure to keep this source http://zhouxt.blog.51cto.com/8743763/1641566

Linux Basics of Iptables