Iptableas Chinese manual

Overview
Use iptables-ADC to specify the chain rules.-A Add-D Delete-C modify

Iptables-[RI] chain rule num rule-specification [option]
Use iptables-RI to specify the sequence of rules

Iptables-D chain rule num [option]
Deletes a specified rule.
Iptables-[LFZ] [chain] [option]
Use iptables-LFZ chain name [Option]

Iptables-[NX] chain
Use-NX to specify a chain

Iptables-P chain target [options]
Default target of the specified chain

Iptables-E old-chain-name new-chain-name
-E old chain name New Chain name
Replace old chain names with new chain names
Description
Iptalbes is used to set, maintain, and check the IP packet filtering rules of the Linux kernel.
Different tables can be defined. Each table contains several internal chains and user-defined chains. Each chain is a rule list that matches the corresponding package: each rule specifies how the matching package should be processed. This is called the 'target' object). You can also jump to a user-defined chain in the same table.

TARGETS
The firewall rules specify the features and targets of the checked packets. If the package does not match, it is sent to the next rule check in the chain. If yes, the next rule is determined by the target value. the target value can be a user-defined chain name or a specific value, such as ACCEPT [pass], DROP [delete], QUEUE [QUEUE], or RETURN [RETURN].
ACCEPT indicates that the package passes. DROP indicates dropping this package. QUEUE indicates to pass this package to the user space. RETURN indicates that the matching of the chain is stopped and the rule of the previous chain starts again. If a built-in chain is reached, or the rule of the built-in chain is RETURN, the fate of the package will be determined by the target specified by the chain criterion.

TABLES
Currently, three tables are available. Which table is the current table depends on the Kernel configuration option and the current module ).
-T table
This option specifies the table of matching packages to be operated by the command. If the kernel is configured to automatically load modules, if the modules are not loaded, the system will try to load the appropriate modules (for this table. These tables are as follows: filter, which is the default table and contains the packages imported by the built-in chain INPUT processing), the packages processed by FORWORD, And the locally generated packages processed by OUTPUT ). Nat. When this table is queried, it indicates that a new connection packet is generated, which consists of three built-in chains: PREROUTING), OUTPUT to modify the local package before the route), POSTROUTING to modify the prepared package ). The mangle table is used to modify the specified package. It has two built-in rules: the package entered before the PREROUTING modifies the route) and the local package before the OUTPUT modifies the route ).
OPTIONS
These options that can be recognized by iptables can be different types.

COMMANDS
These options specify to execute a specific action: If there is no other rule under the command line, this row can only specify one option. for long-Format Commands and option names, you only need to ensure that the iptables command can be distinguished from other options.
-A-append
Add one or more rules at the end of the selected chain. When the source address) or/and Destination Address) are converted to multiple addresses, this rule will be added to the end of all possible addresses (combinations.

-D-delete
Delete one or more rules from the selected chain. This command can be used to specify the deleted rule as the serial number in the chain (the first serial number is 1) or as the rule to be matched.

-R-replace
Replaces a rule from the selected chain. If the source address) or/or the target address is converted to multiple addresses, the command fails. The rule sequence number starts from 1.

-I-insert
Insert one or more rules to the selected Chain Based on the given rule sequence number. Therefore, if the rule number is 1, the rule will be inserted into the chain header. This is the default method when no rule serial number is specified.

-L-list
Displays all the rules of the selected chain. If no link is selected, all links are displayed. It can also be used with the z option, and the chain will be automatically listed and zeroed. Precise output is affected by other parameters.

-F-flush
Clear the selected chain. This means that all rules are deleted one by one.

-- Z-zero
Clears the packets and byte counters of all links. It can be used with-L to view the counter before clearing. See the previous article.

-N-new-chain
Create a new user-defined Chain Based on the given name. This must ensure that no chain with the same name exists.

-X-delete-chain
Deletes a specified user-defined chain. This chain must not be referenced. If it is referenced, you must delete or replace the relevant rules before deleting it. If no parameter is provided, this command will try to delete each non-built chain.

-P-policy
Set the target rule of the chain.

-E-rename-chain
Rename the specified Chain Based on the name given by the user. This is only a modifier and does not affect the structure of the entire table. The TARGETS parameter provides a valid target. Rules can be used only for non-user-defined chains, and both built-in and user-defined chains cannot be the target of rules.

-H Help.
Help. The syntax of the current command is very short.

PARAMETERS
Parameters
The following parameters constitute detailed rules, such as the add, delete, replace, append, and check commands.

-P-protocal [!] Protocol
Protocol for rule or package check (package to be checked. The specified protocol can be either one or all of tcp, udp, or icmp, or a numerical value, representing one of these protocols. You can also use the Protocol name defined in/etc/protocols. Add "! "Indicates the opposite rule. The number 0 is equivalent to all. Protocol all matches all protocols, and this is a time-saving option. When combined with the check command, all can be disabled.
-S-source [!] Address [/mask]
Specifies the source address, which can be the host name, network name, and clear IP address. The mask can be a network mask or a clear number. specify the number of "1" on the left of the network mask. Therefore, the value of the mask is 24 or 255.255.255.0. Add "! "Indicates that the opposite address segment is specified. Flag -- src is short for this option.

-D -- destination [!] Address [/mask]
Specify the target address. For more information, see the description of the-s flag. The flag-dst is short for this option.

-J -- jump target
-J target jump
Specify the target of the rule, that is, what to do if the package matches. The target can be a custom chain that does not belong to this rule), a private built-in target that will immediately determine the fate of the package, or an extension can be found in EXTENSIONS below ). If the rule option is ignored, the matching process will not affect the package, but the rule counter will increase.

-I-in-interface [!] [Name]
I-Access Network) interface [!] [Name]
This is the optional entry name received by the package through this interface. The package receives the packages entered in the chain INPUT, FORWORD, and PREROUTING through this interface ). Before the Interface Name, use "! "After description, it refers to the opposite name. If the interface name is followed by "+", all interfaces starting with this interface name will be matched. If this option is ignored, it is assumed to be "+", then any interface will be matched.

-O -- out-interface [!] [Name]
-O -- output interface [name]
This is the optional exit name sent by the package through this interface. The package outputs the packages in the chain FORWARD, OUTPUT, and POSTROUTING through this port ). Before the Interface Name, use "! "After description, it refers to the opposite name. If the interface name is followed by "+", all interfaces starting with this interface name will be matched. If this option is ignored, it is assumed as "+", then all arbitrary interfaces will be matched.

[!] -F, -- fragment
[!] -F -- multipart
This means that in the fragmented package, the rule only asks for the second and later parts. Since then, because the source port, target port, or ICMP Type of the packet cannot be determined, such packets cannot match any rules specified for matching them. If "! "The description is used before the"-f "sign to indicate the opposite.

OTHER OPTIONS
Other options
You can also specify the following additional options:

-V -- verbose
-V -- details
Detailed output. This option enables the list command to display the interface address, rule options, and TOSType of Service mask. The package and byte counter will also be displayed. K, M, and G (prefix) are used to indicate 1000, 1,000,000, and 1,000,000,000 times respectively. However, please refer to the-x flag to change it). For addition, insert, delete, and replace commands. This prints detailed information about one or more rules.

-N -- numeric
-N -- number
Digital output. The IP address and port are printed in numbers. By default, the program displays the host name, network name, or service as long as it is available ).

-X-exact
-X-precision
Extended number. Display the exact value of the package and byte counter, instead of the approximate number expressed in K, M, G. This option can only be used for the-L command.

-- Line-numbers
When a rule is displayed in the list, add a row number before each rule to match the rule's position in the chain.

MATCH EXTENSIONS
Corresponding extension
Iptables can use some extension packages that match the module. The following are the extension packages included in the basic package, and most of them can be added in front! To indicate the opposite.

Tcp
When -- protocol tcp is specified and other matching extensions are not specified, these extensions are loaded. It provides the following options:

-- Source-port [!] [Port [: port]
Specifies the source port or port range. This can be the service name or port number. Format port: You can specify the port range. If the first port number is ignored, the default value is "0". If the end port number is ignored, the default value is "65535". If the second port number is greater than the first port number, it is switched. You can use the -- sport alias for this option.

-- Destionation-port [!] [Port: [port]
Specify the target port or port range. This option can be replaced by the -- dport alias.

-- Tcp-flags [!] Mask comp
Matches the specified TCP tag. The first parameter is the tag we want to check, a list separated by commas, and the second parameter is a tag table separated by commas, which must be set. Mark as follows: syn ack fin rst urg psh all none. Therefore, this command: iptables-a forward-p tcp -- tcp-flags SYN, ACK, FIN, rst syn only matches the packets whose SYN flag is set but the ACK, FIN, and RST tags are not set.

[!] -- Syn
Only TCP packets whose SYN bit is set and ACK and FIN bit are cleared. These packages are used to send requests during TCP connection initialization. For example, a large number of such packages will block the TCP connection when an interface is blocked, and the outgoing TCP connection will not be affected. This is equal to -- tcp-flags SYN, RST, and ack syn. If "-- syn" is preceded "! "Mark, indicating the opposite.

-- Tcp-option [!] Number
Match the TCP option.

Udp
When protocol udp is specified and other matching extensions are not specified, these extensions are loaded and provide the following options:

-- Source-port [!] [Port: [port]
Specifies the source port or port range. For details, see the description of the TCP extended -- source-port option.

-- Destination-port [!] [Port: [port]
Specify the target port or port range. For details, see the -- destination-port option of TCP extension.

Icmp
When protocol icmp is specified and other matching extensions are not specified, the extension is loaded. It provides the following options:
-- Icmp-type [!] Typename
This option allows you to specify the ICMP type, which can be a numeric ICMP type, or an icmp type name displayed by the command iptables-p ICMP-h.

Mac
-- Mac-source [!] Address
Match the physical address. The format must be XX: XX. Note that it is only valid for packets from the Ethernet device that enter the PREROUTING, FORWORD, and INPUT chains.

Limit
This module matching flag matches with a tag bucket filter at a certain speed. It is used with LOG targets to provide a limited number of logins. when the limit value is reached, the rules that use this extension package will match. (Unless "! "Mark)

-- Limit rate
Maximum average matching rate: The value can be assigned to units such as '/second','/minute ','/hour', or '/Day'. The default value is 3/hour.

-- Limit-burst number
Maximum initial number of packages to be matched: if the limit specified earlier has not reached this value, the total number is increased by 1. The default value is 5.

Multiport
This module matches a group of source or target ports. You can specify up to 15 ports. It can only be used with-p tcp or-p udp.

-- Source-port [port [, port]
If the source port is one of the given ports

-- Destination-port [port [, port]
If the target port is one of the given ports, it matches

-- Port [port [, port]
If the source port and destination port are the same and are the same as a given port, they match.
Mark
This module matches the netfilter tag field and can be set to MARK with MARK below ).

-- Mark value [/mask]
If the mask is specified for packages that match the unsigned tag value, the mask is added with a logical tag before comparison ).

Owner
This module generates a local package to match different features of the package creator. It can only be used for the OUTPUT chain, and even some packets such as ICMP ping response) may not have an owner, so it will never match.

-- Uid-owner userid
If a valid user id is provided, it matches the package generated by the process.

-- Gid-owner groupid
If a valid group id is provided, it matches the package generated by the process.

-- Sid-owner seessionid
Match the packets generated by the process according to the given session group.

State
This module allows the connection trace status of the access package when used in conjunction with the connection trace.

-- State
The state is a comma-separated list of matched connection statuses. The possible status is: INVALID indicates that the package is an unknown connection, ESTABLISHED indicates a two-way transmission connection, and NEW indicates that the package is a NEW connection. Otherwise, the package is not transmitted in two directions, RELATED indicates that the package starts from a new connection, but is connected with an existing connection, such as FTP data transmission or an ICMP error.

Unclean
This module has no options, but it tries to match those strange and uncommon packages. In the lab.

Tos
This module matches the eight-bit tos service type of the IP package header. That is, the field is included in the priority ).

-- Tos
This parameter can be a standard name, which can be viewed by iptables-m tos-h) or a value.

TARGET EXTENSIONS
Iptables can be used to expand the target module: The following are included in the Standard Edition.

LOG
Enable the kernel record for the matching package. After this option is set in the rule, the Linux kernel prints some information about all matching packages, such as the IP header field, through printk ).
-- Log-level
Record level number or see syslog. conf (5 )).
-- Log-prefix
Add a specific prefix before the record information: a maximum of 14 letters are used to distinguish it from other information in the record.

-- Log-tcp-sequence
Record the TCP serial number. If records can be read by users, this poses a security risk.

-- Log-tcp-options
Record the options from the TCP header.
-- Log-ip-options
Record the options from the IP packet header.

MARK
Set the netfilter flag value of the package. Only applicable to mangle tables.

-- Set-mark

REJECT
As a response to the matched package, an error package is returned: the package is the same as the DROP in other cases.

This target applies only to INPUT, FORWARD, and OUTPUT chains, and user-defined chains that call these chains. These options control the returned error Package features:

-- Reject-with type
The Type can be icmp-net-unreachable, icmp-host-unreachable, icmp-port-nreachable, icmp-proto-unreachable, icmp-net-prohibited, or icmp-host-prohibited, for this type, the corresponding ICMP error message is returned. The default value is port-unreachable ). The echo-reply option is also allowed. It can only be used to generate a ping response in the rule that specifies the ICMP ping packet. Finally, the tcp-reset option can be used in the INPUT chain or in the Rules called by the self-INPUT chain. Only the TCP protocol is matched: a tcp rst packet will be returned.
TOS
Set the first eight-bit tos of the IP package. It can only be used for mangle tables.

-- Set-tos
You can use a numeric TOS value or iptables-j TOS-h to view the list of valid TOS names.
MIRROR
This is a test demonstration target. It can be used to convert the source address and target address in the IP address header field, and then transfer the package. It is only applicable to INPUT, FORWARD, and OUTPUT chains, and user-defined chains that only call them.

SNAT
This target only applies to the POSTROUTING chain of the nat table. It specifies to modify the source address of the package. After the connection, all packages will be affected.) To stop checking the rule, it includes the following options:

-- To-source <ipaddr> [-<ipaddr>] [: port-port]
You can specify a single new IP address, a range of IP addresses, or a port range that can only be attached to a rule specifying-p tcp or-p udp ). If no port range is specified, ports lower than 512 in the source port will be placed as other ports lower than 512; ports between 512 and 1024 will be placed below 1024, other ports are placed as 1024 or above. If possible, the port is not modified.

-- To-destiontion <ipaddr> [-<ipaddr>] [: port-port]
You can specify a single new IP address, a range of IP addresses, or a port range that can only be attached to a rule specifying-p tcp or-p udp ). If no port range is specified, the target port is not modified.

MASQUERADE
Only used for the POSTROUTING chain of the nat table. Can only be used to dynamically obtain IP dialing.) connection: If you have a static IP address, you must use SNAT. Disguise is equivalent to setting an image for the IP address of the interface through which the packet is sent. When the interface is closed, the connection will be terminated. This is because the current dial-up may not be the same interface address, and all established connections will be closed ). It has an option:

-- To-ports <port> [-port>]
Specifies the source port range to be used. For more information about SNAT source address selection, see the preceding section ). This option applies only to rules with-p tcp or-p udp specified.

REDIRECT
Only applicable to the PREROUTING and OUTPUT chains of nat tables, and user-defined chains that only call them. It modifies the target IP address of the package to send the package to the local package generated by the machine to the address 127.0.0.1 ). It contains an option:

-- To-ports <port> [<port>]
Specified destination port or port range: If this parameter is not specified, the target port is not modified. Only rules with-p tcp or-p udp can be specified.

DIAGNOSTICS
Diagnosis
Different error messages are printed as standard errors: Exit code 0 to indicate correct. If the command line parameter is incorrect or the command line parameter is abused, error code 2 is returned, and other error codes are returned as 1.

BUGS
Bugs
Check is not implemented (yet ).
Check is not completed yet.

COMPATIBILITY WITH IPCHAINS
Compatibility with ipchains
Iptables is very similar to Rusty Russell's ipchains. The main difference is that the INPUT chain is only used to enter the package of the local host, and the OUTPUT is only used to generate the package from the local host. Therefore, each packet passes through only one of the three chains. The previously forwarded packet passes through all three chains. The other major difference is that-I references the incoming interface;-o references the output interface, both of which are applicable to the packets that enter the FORWARD chain. When the default filter table is used with the optional extension module, iptables is a pure package filter. This can greatly reduce the previous obfuscation of IP camouflage and packet filtering, so the following options are different:
-J MASQ
-M-S
-M-L
There are several different links in iptables.