Iptables running logic and-I-A Parameter Parsing

The running logic of iptables and resolution of the-I-A parameter are confusing when I first came into contact with Iptables.-I inserts one or more rules, -A is to append one or more rules. Add a rule. What is the difference between the two rules? Experiment: www.2cto.com has two machines, one with a PING packet and the other with a PING packet. Use iptables-nvL INPUT to view the two machines, iptables is empty. Then, add iptables-a input-p icmp -- icmp-type 8-s 0/0-j DROP to the pinged machine and use iptables-nvL INPUT to view the following information: chain INPUT (policy ACCEPT 592 packets, 55783 bytes) pkts bytes target prot opt in out source destination 8 672 DROP icmp -- ** 0.0.0.0/0 0.0.0.0/0 icmp type 8 at this time, the PING packet displayed by the machine that sent the PING packet stops. In this case, add iptables-a input-p icmp -- icmp-type 8-s 0/0-j ACCEPT to the pinged machine and use iptables-nvL INPUT to view the following information: www.2cto.com Chain INPUT (policy ACCEPT 678 packets, 62701 bytes) pkts bytes target prot opt in out source destination 21 1764 DROP icmp -- ** 0.0.0.0/0 0.0.0.0/0 icmp type 8 0 0 0 ACCEPT icmp -- ** 0.0.0.0/0 0.0.0.0/0 icmp type 8. iptables is appended with a rule, however, the PING packet displayed by the machine sending the PING packet is still stopped, proving that the new rule cannot allow the PING packet to be added to the pinged machine. Iptables-I INPUT-p icmp -- icmp-type 8-s 0/0-j ACCEPT and use iptables-nvL INPUT to view the following information: Chain INPUT (policy ACCEPT 770 packets, 70223 bytes) pkts bytes target prot opt in out source destination 2 168 ACCEPT icmp -- ** 0.0.0.0/0 0.0.0.0/0 icmp type 8 31 2604 DROP icmp -- ** 0.0.0.0/0 0.0.0.0/0 icmp type 8 0 0 ACCEPT icmp -- ** 0.0.0.0/0 0.0.0.0/0 icmp type 8 display iptables Add a rule, at this time, the PING packet displayed by the machine that sent the PING packet is beating again, The difference between the two rules is that-A and-I, and-A append rule after the DROP rule, -I: Add a rule before the DROP rule. Iptables matches rules from top to bottom. The rules must be effective before they are banned.