常用规则示例

修改chain默认策略

#filter表在INPUT chain默认策略为ACCEPT
[root@iptables_host02 ~]# iptables -nvL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
#将filter表在INPUT chain默认策略修改为DROP
[root@iptables_host02 ~]# iptables -t filter -P INPUT DROP
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT
Chain INPUT (policy DROP 0 packets, 0 bytes)

chain的常用操作

清空规则

#清空指定table和chain下面的规则，什么都不指定会清空及其上所有的规则
#请空前表filter chain INPUT规则
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT
Chain INPUT (policy DROP 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
1052 82558 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED
14 820 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
78 6024 INPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0
78 6024 INPUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0
78 6024 INPUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0
0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID
72 5616 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
[root@iptables_host02 ~]# iptables -t filter -F INPUT
#清空后表filter chain INPUT规则后及其就连不上了，截图如下

创建自定义chain

[root@iptables_host02 ~]# iptables -N test_chain
[root@iptables_host02 ~]# iptables -nvL test_chain
Chain test_chain (0 references)
pkts bytes target prot opt in out source destination

删除自定义的空chain

#删除用户自动的空chain
[root@iptables_host02 ~]# iptables -X test_chain
[root@iptables_host02 ~]# iptables -nvL test_chain
iptables: No chain/target/match by that name.
#当chain有规则时使用-X删除chain会返回chain非空
[root@iptables_host02 ~]# iptables -N test_X_chain
[root@iptables_host02 ~]# iptables -t filter -I test_X_chain -p TCP -s 10.1.1.1 --sport 80
[root@iptables_host02 ~]# iptables -nvL test_X_chain
Chain test_X_chain (0 references)
pkts bytes target prot opt in out source destination
0 0 tcp -- * * 10.1.1.1 0.0.0.0/0 tcp spt:80
[root@iptables_host02 ~]# iptables -X test_X_chain
iptables: Directory not empty.

重命名chain name

[root@iptables_host02 ~]# iptables -nvL test_X_chain
Chain test_X_chain (0 references)
pkts bytes target prot opt in out source destination
0 0 tcp -- * * 10.1.1.1 0.0.0.0/0 tcp spt:80
[root@iptables_host02 ~]# iptables -E test_X_chain test_Y_chain
[root@iptables_host02 ~]# iptables -nvL test_Y_chain
Chain test_Y_chain (0 references)
pkts bytes target prot opt in out source destination
0 0 tcp -- * * 10.1.1.1 0.0.0.0/0 tcp spt:80

清空指定chain talbe的规则计数

#对最后一条规则前两列的数字变化
[root@iptables_host02 ~]# iptables -t filter -nvL OUTPUT
Chain OUTPUT (policy ACCEPT 154 packets, 14444 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:68
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
915 84969 OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0
[root@iptables_host02 ~]# iptables -t filter -Z OUTPUT
[root@iptables_host02 ~]# iptables -t filter -Z OUTPUT
Chain OUTPUT (policy ACCEPT 5 packets, 516 bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:68
0 0 ACCEPT all -- * lo 0.0.0.0/0 0.0.0.0/0
5 516 OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0

查看指定chain table的规则

#iptables [-t表名] <-L> [链名]
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
403 29108 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 686 51000 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0

安全组规则的增加 删除 插入 替换

常用安全组规则的创建

#规则的增加和插入规则上只有-A（chain末尾追加）和-I（插入到chain第一条规则）参数不同，规则写法本身并无差异，下面统一以-I为例。
#规则详细语法参照iptales(一)的博客这里不在重复描述
#在VM2的INPUT chain filter表添加进入ens33网卡 源ip192.168.188.147 源端口8000 目的ip192.168.188.148 目的端口9000 协议tcp的报文DROP
[root@iptables_host02 ~]# iptables -t filter -I INPUT -i ens33 -s 192.168.188.147 -d 192.168.188.148 -p tcp --sport 8000 --dport 9000 -j DROP
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 DROP tcp -- ens33 * 192.168.188.147 192.168.188.148 tcp spt:8000 dpt:9000
2 2729 211K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0
#tcp指定多端口 udp类似
[root@iptables_host02 ~]# iptables -t filter -I INPUT -i ens33 -s 192.168.188.147 -d 192.168.188.148 -p tcp --sport 8000:9000 --dport 9000:9001 -j DROP
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 DROP tcp -- ens33 * 192.168.188.147 192.168.188.148 tcp spts:8000:9000 dpts:9000:9001

#控制icmp报文是否放通，可以添加icmp-type进行更细粒度的过滤
[root@iptables_host02 ~]# iptables -t filter -I INPUT -i ens33 -s 192.168.188.147 -d 192.168.188.148 -p icmp --icmp-type 0 -j DROP
[root@iptables_host02 ~]# iptables -t filter -I INPUT -i ens33 -s 192.168.188.147 -d 192.168.188.148 -p icmp --icmp-type 8 -j DROP
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 11 924 DROP icmp -- ens33 * 192.168.188.147 192.168.188.148 icmptype 8
2 0 0 DROP icmp -- ens33 * 192.168.188.147 192.168.188.148 icmptype 0

#匹配不连续端口，需要指定协议
[root@iptables_host02 ~]# iptables -t filter -I INPUT -i ens33 -s 192.168.188.147 -d 192.168.188.148 -p tcp -m multiport --dport 9800,9900:10000 -j DROP
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 DROP tcp -- ens33 * 192.168.188.147 192.168.188.148 multiport dports 9800,9900:10000

#指定范围ip,需要指定的范围不能准确用掩码匹配到一个段时候可以使用
[root@iptables_host02 ~]# iptables -t filter -I INPUT -i ens33 -p tcp -m iprange --src-range 10.1.1.3-10.1.1.9 --dst-range 10.2.1.2-10.2.1.5 -j DROP
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 DROP tcp -- ens33 * 0.0.0.0/0 0.0.0.0/0 source IP range 10.1.1.3-10.1.1.9 destination IP range 10.2.1.2-10.2.1.5

#匹配mac地址
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP udp -- ens33 * 0.0.0.0/0 0.0.0.0/0 MAC AA:BB:CC:DD:EE:FF

#状态检测
#禁止转发与正常TCP连接无关的非—syn请求数据包。“-m state”表示数据包的连接状态，“NEW”表示与任何连接无关的
[root@iptables_host02 ~]# iptables -I INPUT -m state --state NEW -p tcp ! --syn -j DROP
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp flags:!0x17/0x02
#拒绝访问防火墙的新数据包，但允许响应连接或与已有连接相关的数据包
#“ESTABLISHED”表示已经响应请求或者已经建立连接的数据包，“RELATED”表示与已建立的连接有相关性的，比如FTP数据连接等。
[root@iptables_host02 ~]# iptables -I INPUT -p tcp -m state --state NEW -j DROP
[root@iptables_host02 ~]# iptables -I INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
8 528 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW

#匹配的数据跳转到其它chain
[root@iptables_host02 ~]# iptables -I INPUT -p tcp -m state --state ESTABLISHED,RELATED -j test_chain
[root@iptables_host02 ~]# iptables -t filter -nvL INPUT
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
14 924 test_chain tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

#匹配到的数据返回上上一级调用chain的调用点，这里相当于返回INPUT chain上面定义那条规则的后面一条规则
[root@iptables_host02 ~]# iptables -I test_chain -p tcp -m state --state ESTABLISHED,RELATED -j RETURN
[root@iptables_host02 ~]# iptables -t filter -nvL test_chain
Chain test_chain (1 references)
pkts bytes target prot opt in out source destination
38 2508 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

#sant dnat地址转换
[root@iptables_host02 ~]# iptables -t nat -I PREROUTING -d 192.168.10.18 -p tcp --dport 80 -j DNAT --to 172.16.100.2
[root@iptables_host02 ~]# iptables -t nat -nvL PREROUTING
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- * * 0.0.0.0/0 192.168.10.18 tcp dpt:80 to:172.16.100.2
[root@iptables_host02 ~]# iptables -t nat -I POSTROUTING -s 192.168.10.0/24 -j SNAT --to-source 172.16.100.1
[root@iptables_host02 ~]# iptables -t nat -nvL POSTROUTING
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 SNAT all -- * * 192.168.10.0/24 0.0.0.0/0 to:172.16.100.1

规则删除 替换

#规则删除，指定具体表和链以及规则编号进行删除
[root@iptables_host02 ~]# iptables -t nat -nvL POSTROUTING --line-numbers
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 SNAT all -- * * 192.168.10.0/24 0.0.0.0/0 to:172.16.100.1
2 0 0 RETURN all -- * * 192.168.122.0/24 224.0.0.0/24
[root@iptables_host02 ~]# iptables -t nat -D POSTROUTING 1
[root@iptables_host02 ~]# iptables -t nat -nvL POSTROUTING --line-numbers
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 RETURN all -- * * 192.168.122.0/24 224.0.0.0/24
2 0 0 RETURN all -- * * 192.168.122.0/24 255.255.255.255

#替换规则，指定chain和规则编号，当编号不存在会替换失败
[root@iptables_host02 ~]# iptables -t filter -nvL test_chain --line-number
Chain test_chain (1 references)
num pkts bytes target prot opt in out source destination
1 1304 98508 RETURN tcp -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
[root@iptables_host02 ~]# iptables -t filter -R test_chain 1 -s 10.1.1.23/32 -p tcp -j ACCEPT
[root@iptables_host02 ~]# iptables -t filter -nvL test_chain --line-number
Chain test_chain (1 references)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT tcp -- * * 10.1.1.23 0.0.0.0/0