iptables 学习总结--操作以及规则查找(二)

浅浅的花香味﹌ 2022-05-23 04:48 195阅读 0赞

**查看raw mangle nat filter 其中的某张表的链的信息**  
例如查看表filter中INPUT链的规则

[root@localhost ~]# iptables -t filter -L INPUT
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination         
    ACCEPT     all  -- anywhere anywhere ctstate RELATED,ESTABLISHED
    ACCEPT     all  -- anywhere anywhere 
    INPUT_direct  all  -- anywhere anywhere 
    INPUT_ZONES_SOURCE  all  -- anywhere anywhere 
    INPUT_ZONES  all  -- anywhere anywhere 
    DROP       all  -- anywhere anywhere ctstate INVALID
    REJECT     all  -- anywhere anywhere reject-with icmp-host-prohibited

查看其他表规则的命令

iptables -t raw -L
    iptables -t mangle -L 
    iptables -t nat -L

查看某个具体的链的信息

iptables -t filter -L INPUT
    iptables -t filter -L OUTPUT
    iptables -t filter -L PREROUTING
    iptables -t filter -L POSTROUTING
    iptables -t filter -L FORWARD

加上`-v`参数

[root@localhost ~]# iptables -t filter -vL INPUT
    Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
     pkts bytes target     prot opt in     out     source               destination         
      205 20451 ACCEPT     all  --  any    any     anywhere             anywhere             ctstate RELATED,ESTABLISHED
        0     0 ACCEPT     all  --  lo     any     anywhere             anywhere            
        3   551 INPUT_direct  all  --  any    any     anywhere             anywhere            
        3   551 INPUT_ZONES_SOURCE  all  --  any    any     anywhere             anywhere            
        3   551 INPUT_ZONES  all  --  any    any     anywhere             anywhere            
        0     0 DROP       all  --  any    any     anywhere             anywhere             ctstate INVALID
        2   487 REJECT     all  --  any    any     anywhere             anywhere             reject-with icmp-host-prohibited

报文字段的含义

pkts --报文规则的个数
     bytes --报文包的总和大小
     target  --执行的动作
     prot --协议 
     opt  --规则选项
     in  --网卡(入口) 
      out --网卡(流出) 
      source --源地址 
       destination --目标地址

加上`-n`参数

[root@localhost ~]# iptables -t filter -nvL INPUT --line
    Chain INPUT (policy ACCEPT 0 packets, 0 bytes) //默认略
    num   pkts bytes target     prot opt in     out     source               destination         
    1      296 27091 ACCEPT     all  -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
    2        0     0 ACCEPT     all  -- lo * 0.0.0.0/0 0.0.0.0/0 
    3        9  1474 INPUT_direct  all  -- * * 0.0.0.0/0 0.0.0.0/0 
    4        9  1474 INPUT_ZONES_SOURCE  all  -- * * 0.0.0.0/0 0.0.0.0/0 
    5        9  1474 INPUT_ZONES  all  -- * * 0.0.0.0/0 0.0.0.0/0 
    6        0     0 DROP       all  -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
    7        8  1410 REJECT     all  -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

最后，要学会使用help来查看详细描述

[root@fabric-cli ~]# iptables --help
    iptables v1.4.21
    
    Usage: iptables -[ACD] chain rule-specification [options]
           iptables -I chain [rulenum] rule-specification [options]
           iptables -R chain rulenum rule-specification [options]
           iptables -D chain rulenum [options]
           iptables -[LS] [chain [rulenum]] [options]
           iptables -[FZ] [chain] [options]
           iptables -[NX] chain
           iptables -E old-chain-name new-chain-name
           iptables -P chain target [options]
           iptables -h (print this help information)
    
    Commands:
    Either long or short options are allowed.
      --append -A chain Append to chain
      --check -C chain Check for the existence of a rule
      --delete -D chain Delete matching rule from chain
      --delete -D chain rulenum
                    Delete rule rulenum (1 = first) from chain
      --insert -I chain [rulenum]
                    Insert in chain as rulenum (default 1=first)
      --replace -R chain rulenum
                    Replace rule rulenum (1 = first) in chain
      --list -L [chain [rulenum]]
                    List the rules in a chain or all chains
      --list-rules -S [chain [rulenum]]
                    Print the rules in a chain or all chains
      --flush -F [chain] Delete all rules in chain or all chains
      --zero -Z [chain [rulenum]]
                    Zero counters in chain or all chains
      --new -N chain Create a new user-defined chain
      --delete-chain
                -X [chain]      Delete a user-defined chain
      --policy -P chain target
                    Change policy on chain to target
      --rename-chain
                -E old-chain new-chain
                    Change chain name, (moving any references)
    Options:
        --ipv4 -4 Nothing (line is ignored by ip6tables-restore)
        --ipv6 -6 Error (line is ignored by iptables-restore)
    [!] --protocol -p proto protocol: by number or name, eg. `tcp'
    [!] --source -s address[/mask][...]
                    source specification
    [!] --destination -d address[/mask][...]
                    destination specification
    [!] --in-interface -i input name[+]
                    network interface name ([+] for wildcard)
     --jump -j target
                    target for rule (may load target extension)
      --goto -g chain
                                  jump to chain with no return
      --match -m match
                    extended match (may load extension)
      --numeric -n numeric output of addresses and ports
    [!] --out-interface -o output name[+]
                    network interface name ([+] for wildcard)
      --table -t table table to manipulate (default: `filter')
      --verbose -v verbose mode
      --wait -w [seconds] maximum wait to acquire xtables lock before give up
      --wait-interval -W [usecs] wait time to try to acquire xtables lock
                    default is 1 second
      --line-numbers print line numbers when listing
      --exact -x expand numbers (display exact values)
    [!] --fragment -f match second or further fragments only
      --modprobe=<command> try to insert modules using this command
      --set-counters PKTS BYTES set the counter during insert/append
    [!] --version -V print package version.

参考:  
[操作以及规则查找][Link 1]

[Link 1]: http://www.zsythink.net/archives/1493