iptables multiport

action is ignored)1, multi-port matching.1) match multiple source ports.#iptables-A input-p tcp-m multiport–sport 22,53,80,1102) match multiple destination ports.#iptables-A input-p tcp-m multiport–dpoort 22,53,803) matching multiport (either source port or destination port

bm | kmp specifies the algorithm bm or kmp.-- String "STRING" specifies the string itself Iptables-A input-p tcp-m multiport -- dports110, 80, 25, 445,1863, 5222-j ACCEPTIptables-a input-p tcp-s 172.16.0.0/16 -- dport 139-jACCEPT# Allow dns resolution. if a DNS server (forwarder) is configured on the intranet, only the IP address of the forwarder can be used. modify the ip address (-s IP address) on your o

, and multiport... Target (Common Action ): Target descriptionAcceptDrop dropped data packetsReturn directly without comparisonThe application that the queue sends to the user-space to process the data packet.Snat nat: Translation Source AddressDnat nat: Translation addressDedicated for masquerade NAT: Translation source address becomes Nic MacDedicated for redirect NAT: A port transferred to the Local Machine Use/etc/rc. d/init. d/

)Num Target prot opt source destinationChain FORWARD (Policy ACCEPT)Num Target prot opt source destinationChain OUTPUT (Policy ACCEPT)Num Target prot opt source destinationYou can see that the rule has been deleted.5. Prohibit a network segment from accessing my eth0 network card, such as 10.10.10.0/24[Email protected] ~]# iptables-a input-i eth0-s 10.10.10.0/24-j DROP[Email protected] ~]# iptables-l-NChain

custom empty chain. ⑤ Use of extension options Eg: for http service requests, the connection status of the 192.168.5.1 server segment is controlled. Iptables-a input-d 192.168.5.1-p tcp-dport 80-m state-state NEW, ESTABLISHED-j ACCEPT Iptables-a output-s 192.168.5.1-p tcp-sport 80-m state-state ESTABLISHED-j ACCEPT // The server responds to the NEW and ESTABLISHED packets of the INPUT server. The OUTPUTo

used to compare the packets. It can be compared to a single port or a range, for example, -- sport 22: 80, which indicates that the port number ranges from 22 to 80. Ports are both qualified. To compare multiple ports that are not consecutive, you must use the -- multiport parameter. For details, see the following section. You can use it when comparing the port number! The operator performs reverse comparison. Parameter -- dport, -- destination-port

-- to-destination 192.168.100.2: 500 Iptables-t nat-a prerouting-p udp -- dport 4500-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.2: 4500 NAT of the FTP server Iptables-I PFWanPriv-p tcp -- dport 21-d 192.168.100.200-jACCEPT Iptables-t nat-a prerouting-p tcp -- dport 21-d $ INTERNET_ADDR-j DNAT -- to-destination 192.168.100.200: 21 Only access to the s

to 80 are qualified. To compare multiple ports that are not consecutive, you must use the -- multiport parameter. For details, see the following section. You can use it when comparing the port number! The operator performs reverse comparison. Parameter -- dport, -- destination-port example iptables-a input-p tcp -- dport 22 indicates the destination port number used to compare the packets. The setting meth

Iptables-a filter-p TCP--dport 53-j ACCEPT Iptables-a filter-d www.3322.org-j ACCEPT Iptables-a filter-d img.cn99.com-j ACCEPT Iptables-a filter-j DROP Open some ports for one IP, others are closed Iptables-a filter-p TCP--dport 80-s 192.168.100.200-d www.pconline.com

iptables-a input-d 192.168.1.1Description used to compare the destination IP address of the packet. the setting method is the same as above. Parameter-I, -- in-interfaceExample iptables-a input-I eth0The description is used to compare the network card from which the package Enters. you can use wildcard character + to perform large-scale comparison. for example,-I eth + indicates all ethernet network cards.