Linux self-study note--iptables

1. View the Rules IPTABLES-NVL

2. Table Type-T Raw,mangle,nat,filter (default)

3. Chain Management

(1) New link: iptables-n test

(2) Delete empty chain: Iptables-x test

(3) Enable and disable: Iptables-p INPUT accept| DROP

(4) Renaming: IPTABLES-E test test2

(5) Empty: Iptables-t nat-f

4. Rule Management

(1) Append at the end:-A

(2) Start insert:-I number

(3) Delete:-D number

(4) Replacement:-R number

5. Basic Matching

(1) original address match:-S

(2) Target address match:-D

(3) Enable prohibitions and rejections:-j accept| drop| REJECT

(4) Protocol matching:-P tcp|udp|icmp

6. Extended Match

(1) TCP:

-P TCP [-M TCP]--sport|dport source port and destination port

-P tcp-m TCP multiport--sports|dports 22,80

-P tcp-m TCP iprange--src|dst-range x.x.x.x-x.x.x.x

-P tcp-m string--algo bm|kmp--string "xxxx"

-P tcp-m connlimit--connlimit-upto|above maximum minimum concurrency

-P tcp-m Stae invalid| established| new| related| untracked

INVALID: Unrecognized link

Established: A record exists in the template

NEW: not present in template

Related: Associated links

Untracked: Non-tracked links

Connections tracked and Recorded:/proc/net/nf_conntrack

Maximum number of connections:/proc/sys/net/nf_conntrack_max

Timeout Length:/proc/sys/net/netfilter/xxxx_timeout

(2) UDP:-p UDP [-m UDP]--sport|dport source port and destination port

(3) ICMP:-P ICMP [-m ICMP]--icmp-type 0|8 response code and request code

7.nat

(1) using Snat and Dnat conditions:

Turn on core forwarding: Echo ' 1 ' >/proc/sys/net/ipv4/ip_forward

Intranet network adapter that points the intranet host gateway address to the forwarding server

(2) SNAT:

Iptables-t nat-a postrouting-s 127.0.0.1/24-j SNAT--to-source x.x.x.x External network card address, or

-j Masquerade automatic access to extranet addresses

(3) DNAT: Allows the extranet host to access the 80 services on the forwarder, and the forwarder does not provide the service, directly to the intranet host processing

Iptables-t nat-a prerouting-s 0/0-D x.x.x.x External network card address-p TCP--dport 80-j DNAT--to-destination x.x.x.x Intranet host Address

8. Save and load

(1) Service iptables Save command:

It will be saved in the/etc/sysconfig/iptables file.

(2) Iptables-save command:

Iptables-save >/etc/sysconfig/iptables

(3) Iptables-restore command:

It will automatically load/etc/sysconfig/iptables when it is powered on

Iptables-restore </etc/sysconfig/iptables.2

(4) Boot from

Throw the order in the/etc/rc.d/rc.local.

Linux self-study note--iptables