Iptables application example

System environment: Debian632-bitiptables version: 1.4.8iptables-Ncracker create a new chain named cracker iptables-AINPUT add a rule iptables-IINPUT3 at the end of the INPUT chain insert a rule at the third rule of the INPUT chain (if you do not specify the inserted location, the system environment at the beginning of the INPUT chain: Debian 6 32-bit
IptablesVersion: 1.4.8
Iptables-Ncracker
Create a new chain named cracker
Iptables-AINPUT
Add a rule at the end of the INPUT chain
Iptables-I INPUT3
Insert a rule at the third rule of the INPUT chain (if the insertion location is not specified, insert the rule at the beginning of the INPUT chain to become the first rule of the INPUT chain)
Iptables-R INPUT3
Replace the third rule in the INPUT chain
Iptables-D INPUT3
Delete The third rule in the INPUT chain
Iptables-F
Clear all rules defined by iptables
Iptables-Fcracker
Clear all rules in the cracker chain
Iptables-X
Delete all custom links (provided that all rules in the custom links are cleared)
Iptables-Xcracker
Delete the custom chain cracker (provided that all rules in the current chain are cleared)
Iptables-L-vn -- line-numbers
Display the statistics of each rule in detail by number and the number of each rule
Iptables-l input-vn -- line-numbers
The statistical data of each rule in the INPUT chain is detailed in numbers, and the number of each rule is displayed.
Iptables-Z
Clear iptables statistics
Iptables-Z INPUT
Clear statistics in the INPUT chain
Iptables-P
Set the default action of the link
Iptables-save>/etc/firewall
Save the iptables rules in the current memory to the/etc/firewall file.
Iptables-restore </etc/firewall
Load the iptables rules in the/etc/firewall file to the memory.
Iptables rule instance:
Iptables-P INPUT ACCEPT
Set the default target of the INPUT chain to ACCEPT.
Iptables-a input-d 11.11.11.11-m state -- state INVALID-jDROP
Discard all data packets whose destination address is 11.11.11.11 and whose status is INVALID.
Iptables-a input-I lo-j ACCEPT
Accept all data packets from the lo interface
Iptables-a input-j cracker
Direct all data to a cracker chain
Iptables-a input-d 11.11.11.11-p icmp -- icmp-typeecho-request-m state -- state NEW-j ACCEPT
Accept all data packets whose destination address is 11.11.11.11 and whose protocol is icmp, whose type is echo-request, and whose connection status is NEW
Iptables-a input-d 11.11.11.11-p tcp-m state -- state NEW-mtcp -- dport 22-j ACCEPT
Accept all data packets whose destination address is 11.11.11.11 and whose protocol is tcp, destination port is 22, and connection status is NEW
Iptables-a input-d 11.11.11.11-p tcp-m state -- state NEW-mtcp -- dport 80-j ACCEPT
Accept all data packets whose destination address is 11.11.11.11 and whose protocol is tcp, destination port is 80, and connection status is NEW
Iptables-a input-d 11.11.11.11-m state -- stateRELATED, ESTABLISHED-j ACCEPT
Accept all data packets whose destination address is 11.11.11.11 and whose connection status is RELATED or ESTABLISHED (this rule is placed before the last and affects the effect of modules such as recent and limit)
Iptables-a input-j LOG -- log-prefix "GOD-IN :"
Logs are generated for all data through the INPUT chain, and the log prefix is "GOD-IN". The log level is warn (warn is also the default level, and the corresponding number is 4 ), the data packets to be logged will continue to match the rule (this rule is placed in the second to last to facilitate recording of all discarded data packets)
Iptables-a input-j DROP
Discard all data packets through the INPUT chain (because the default target statistics are not accurate, so I generally add this rule to the end of the INPUT chain, in this way, all data packets will not match the default target of the INPUT chain)
Iptables-a output-s 11.11.11.11-m state -- state INVALID-jDROP
Discard all data packets whose source is 11.11.11.11 and whose status is INVALID
Iptables-a output-o lo-j ACCEPT
Allow all data packets from the lo interface
Iptables-a output-s 11.11.11.11-p icmp-m state -- state NEW-m icmp -- icmp-type 8-j ACCEPT
Allow all data packets whose source is 11.11.11.11 and the protocol is icmp, the icmp type is echo-request, and the status is NEW.
Iptables-a output-s 11.11.11.11-p tcp-m state -- state NEW-mtcp -- dport 25-j ACCEPT
Allow all data packets whose source is 11.11.11.11 and the protocol is tcp, the destination port is 25, and the status is NEW
Iptables-a output-s 11.11.11.11-p tcp-m state -- state NEW-mudp -- dport 53-j ACCEPT
Allow all data packets whose source is 11.11.11.11 and the protocol is udp, the destination port is 53, and the status is NEW
Iptables-a output-s 11.11.11.11-p tcp-m state -- state NEW-mtcp -- dport 80-j ACCEPT
Allow all data packets whose source is 11.11.11.11 and the protocol is tcp, the destination port is 80, and the status is NEW
Iptables-a output-s 11.11.11.11-m state -- state