iptables--命令行解析

 一、iptabls命令行初探：
        在linux下执行iptables --help 

iptables --help

iptables v1.4.21

Usage: iptables -[ACD] chain rule-specification [options]

       iptables -I chain [rulenum] rule-specification [options]

       iptables -R chain rulenum rule-specification [options]

       iptables -D chain rulenum [options]

       iptables -[LS] [chain [rulenum]] [options]

       iptables -[FZ] [chain] [options]

       iptables -[NX] chain

       iptables -E old-chain-name new-chain-name

       iptables -P chain target [options]

       iptables -h (print this help information)

Commands:

Either long or short options are allowed.

  --append  -A chain Append to chain

  --check   -C chain Check for the existence of a rule

  --delete  -D chain Delete matching rule from chain

  --delete  -D chain rulenum

Delete rule rulenum (1 = first) from chain

  --insert  -I chain [rulenum]

Insert in chain as rulenum (default 1=first)

  --replace -R chain rulenum

Replace rule rulenum (1 = first) in chain

  --list    -L [chain [rulenum]]

List the rules in a chain or all chains

  --list-rules -S [chain [rulenum]]

Print the rules in a chain or all chains

  --flush   -F [chain] Delete all rules in  chain or all chains

  --zero    -Z [chain [rulenum]]

Zero counters in chain or all chains

  --new     -N chain Create a new user-defined chain

  --delete-chain

            -X [chain] Delete a user-defined chain

  --policy  -P chain target

Change policy on chain to target

  --rename-chain

            -E old-chain new-chain

Change chain name, (moving any references)

Options:

    --ipv4 -4 Nothing (line is ignored by ip6tables-restore)

    --ipv6 -6 Error (line is ignored by iptables-restore)

[!] --protocol -p proto protocol: by number or name, eg. `tcp'

[!] --source -s address[/mask][...]

source specification

[!] --destination -d address[/mask][...]

destination specification

[!] --in-interface -i input name[+]

network interface name ([+] for wildcard)

 --jump -j target

target for rule (may load target extension)

  --goto      -g chain

                              jump to chain with no return

  --match -m match

extended match (may load extension)

  --numeric -n numeric output of addresses and ports

[!] --out-interface -o output name[+]

network interface name ([+] for wildcard)

  --table -t table table to manipulate (default: `filter')

  --verbose -v verbose mode

  --wait -w wait for the xtables lock

  --line-numbers print line numbers when listing

  --exact -x expand numbers (display exact values)

[!] --fragment -f match second or further fragments only

  --modprobe=<command> try to insert modules using this command

  --set-counters PKTS BYTES set the counter during insert/append

[!] --version -V print package version.

可以看到iptables命令行的格式为：
iptables 操作类型（增删替捡等） 链（chains） 规则参数  动作
这种情况下操作的表是filter，链和规则都是对filter表的操作。完整的iptables命令行为
iptables [-t table] COMMAND chain CRETIRIA -j ACTION 
iptables [-t 表]    操作类型      链    匹配规则    -j  动作

二、iptables的表（tables）

iptables可以作用的表为：
filter：默认表，提供数据包过滤功能。
nat：网络地址转换，主要提供源地址转换（SNAT）和目的地址转换（DNAT）。NAT转换的对象包括ip和port（四层端口）。
mangle：提供数据包修改功能。用于修改数据包的TOS（Type Of Service，服务类型）、TTL（Time To Live，生存周期）指以及为数据包设置Mark标记，以实现Qos(Quality Of Service，服务质量)调整以及策略路由等应用，由于需要相应的路由设备支持，因此应用并不广泛。
raw：可以提供日志跟踪功能。
filter、nat、mangle提供基本功能，raw提供辅助功能。nat修改的是数据包的源ip/源port/目的ip/目的port，mangle修改的是数据包的ip层属性。

三、iptables的链（chains）
iptables的链分为五个：
PREROUTING (路由前)        内核空间中：从一个网络接口进来，在路由判决前的位置。
INPUT (数据包流入口)          路由判决后，上报本地的数据包，从内核流入用户空间的位置。
FORWARD (转发管卡)         路由判决后，从本地转发的数据包，从用户空间流出的位置。
OUTPUT(数据包出口)          从本机发出的数据包，从用户空间进入内核的位置。
POSTROUTING（路由后）  从本机网卡发出的数据包，进入网卡前的位置。
这五个链对应的是内核netfilter架构的5个hook点。
mangle可以作用于五个链。
filter作用于INPUT、FORWARD、OUTPUT。
nat作用于PREROUTING 、OUTPUT、POSTROUTING。
raw则作用于 PREROUTING 、OUTPUT。
 
四、操作类型

  --append          -A chain                            Append to chain                           

  --check             -C chain                           Check for the existence of a rule         

  --delete            -D chain                            Delete matching rule from chain           

  --delete            -D chain rulenum              Delete rule rulenum (1 = first) from chain

  --insert             -I chain [rulenum]              Insert in chain as rulenum (default 1=firs

  --replace          -R chain rulenum              Replace rule rulenum (1 = first) in chain 

  --list                  -L [chain [rulenum]]          List the rules in a chain or all chains   

  --list-rules         -S [chain [rulenum]]          Print the rules in a chain or all chains  

  --flush               -F [chain]                          Delete all rules in  chain or all chains  

  --zero                -Z [chain [rulenum]]          Zero counters in chain or all chains      

  --new                -N chain                            Create a new user-defined chain           

  --delete-chain   -X [chain]                          Delete a user-defined chain               

  --policy              -P chain target                 Change policy on chain to target          

  --rename-chain -E old-chain new-chain     Change chain name, (moving any references)

五、动作（target）
标准的target：
<user-defined-chain> — A user-defined chain within the table. User-defined chain names must be unique. This target passes the packet to the specified chain.
ACCEPT — Allows the packet through to its destination or to another chain.
DROP — Drops the packet without responding to the requester. The system that sent the packet is not notified of the failure.
QUEUE — The packet is queued for handling by a user-space application.
RETURN — Stops checking the packet against rules in the current chain. If the packet with a RETURN target matches a rule in a chain called from another chain, the packet is returned to the first chain to resume rule checking where it left off. If the RETURN rule is used on a built-in chain and the packet cannot move up to its previous chain, the default target for the current chain is used.
扩展的target： 

• LOG — Logs all packets that match this rule. Because the packets are logged by the kernel, the /etc/syslog.conf file determines where these log entries are written. By default, they are placed in the /var/log/messages file.

  Additional options can be used after the LOG target to specify the way in which logging occurs:

  • --log-level — Sets the priority level of a logging event. Refer to the syslog.conf man page for a list of priority levels.

  • --log-ip-options — Logs any options set in the header of an IP packet.

  • --log-prefix — Places a string of up to 29 characters before the log line when it is written. This is useful for writing syslog filters for use in conjunction with packet logging.

  • --log-tcp-options — Logs any options set in the header of a TCP packet.

  • --log-tcp-sequence — Writes the TCP sequence number for the packet in the log.

• REJECT — Sends an error packet back to the remote system and drops the packet.

  The REJECT target accepts --reject-with <type> (where <type> is the rejection type) allowing more detailed information to be returned with the error packet. The message port-unreachable is the default error type given if no other option is used. Refer to the iptables man page for a full list of <type> options.

 此外，扩展的target还包括SNAT、DNAT、MASQUERADE 。用户也可以自己编写扩展target。

 六、举例
对于源ip在172.16.0.0/16、目的端口53的udp包丢弃
 iptables -t filter -A INPUT -s 172.16.0.0/16 -p udp --dport 53-j DROP   

 DNAT 202.103.96.112的访问到192.168.0.112上 
 iptables -t nat -A PREROUTING -d 202.103.96.112 -j DNAT --to-destination 192.168.0.112 
 
192.168.0.0/24网段发出的数据包SNAT为58.20.51.66
 iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to-source 58.20.51.66
   

打标记 
 iptables -t mangle -A PREROUTING -i eth0 -p tcp --dport 80 -j MARK --set-mark 1   
 
指定目的80端口的包不进入链接跟踪/NAT子系统
 iptables -t raw -A PREROUTING -d 1.2.3.4 -p tcp --dport 80 -j NOTRACK    
 
参考：

1、http://blog.csdn.net/lic95/article/details/50670617
2、http://blog.jobbole.com/90008/ 

3、https://www.centos.org/docs/5/html/5.2/Deployment_Guide/s2-iptables-options-target.html