iptables基础（3）

原文地址 http://alsww.blog.51cto.com/2001924/826926

-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited   这条命令的的解释：

从结果上来看，这条规则的作用是拒绝所有
-j REJECT 在iptables帮助文档里面有一下说明This is used to send back an error packet in response to the matched packet: otherwise it is equivalent to 

DROP so it is a terminating TARGET, ending rule traversal. This target is only valid in the INPUT, FORWARD and OUTPUT chains, and user-defined chains which 

are only called from those chains. The following option controls the nature of the error packet returned:
--reject-with type
              The type given can be
               icmp-net-unreachable
               icmp-host-unreachable
               icmp-port-unreachable
               icmp-proto-unreachable
               icmp-net-prohibited
               icmp-host-prohibited or
               icmp-admin-prohibited (*)
我们简单的翻译一下，REJECT 是用来返回一个错误的包来回应匹配包，其他的等价于DROP，所以它是一个拒绝TARGET，在规则的结束。这个TARGET仅仅用在INPUT,FORWARD和

OUTPUT链和用户自定义的链，下列选项是用来定义返回错误的结果的：
The type given can be
               icmp-net-unreachable
               icmp-host-unreachable
               icmp-port-unreachable
               icmp-proto-unreachable
               icmp-net-prohibited
               icmp-host-prohibited or
               icmp-admin-prohibited (*)
从以上，我们可以看出，定义了icmp主机拒绝，返回一个Destination host unreachable错误，但是由于有之前一句的存在，所以能够PING通-A RH-Firewall-1-INPUT -p icmp -

-icmp-type any -j ACCEPT。
这样子，我们就能理解
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited

REJECT     all -- anywhere             anywhere            reject-with icmp-host-prohibited 
拒绝所有的anywhere所有端口 icmp-host-prohibited 
下面我们做一个实验：
把其中一条给注释掉
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT 
这样子的话，我们就ping 不通了，而然后把
最下面一条
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited 
把其中 --reject-with 替换成其他的
icmp-net-unreachable
               icmp-host-unreachable
               icmp-port-unreachable
               icmp-proto-unreachable
               icmp-net-prohibited
               icmp-host-prohibited or
               icmp-admin-prohibited (*)
这样子的话，就知道不通的 条件，就会返回不通的包
第一种情况：
注释掉 在/etc/sysconfig/iptables
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT 
然后打开下面的
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
这样子，我们ping包返回的错误结果就是
C:\Documents and Settings\Administrator>ping 172.16.3.101

Pinging 172.16.3.101 with 32 bytes of data:

Reply from 172.16.3.101: Destination host unreachable.
Reply from 172.16.3.101: Destination host unreachable.
Reply from 172.16.3.101: Destination host unreachable.
Reply from 172.16.3.101: Destination host unreachable.
第二种情况
注释掉
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT 
然后打开下面
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-net-unreachable 
在这种情况下返回的错误包是：
C:\Documents and Settings\Administrator>ping 172.16.3.101

Pinging 172.16.3.101 with 32 bytes of data:

Reply from 172.16.3.101: Destination net unreachable.
Reply from 172.16.3.101: Destination net unreachable.
Reply from 172.16.3.101: Destination net unreachable.
Reply from 172.16.3.101: Destination net unreachable.
第三种情况：
注释掉
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
然后打开下面
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-proto-unreachable
这种情况下返回的错误结果为：
C:\Documents and Settings\Administrator>ping 172.16.3.101

Pinging 172.16.3.101 with 32 bytes of data:

Reply from 172.16.3.101: Destination protocol unreachable.
Reply from 172.16.3.101: Destination protocol unreachable.
Reply from 172.16.3.101: Destination protocol unreachable.
Reply from 172.16.3.101: Destination protocol unreachable.
=======================================================
有以上三个实验结果，可以看出
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
这句的意思是拒绝所有的主机切ping包返回的错误结果是有 --reject-with 后面的
icmp-net-unreachable        ICMP network unreachable
    net-unreach                 alias
    icmp-host-unreachable       ICMP host unreachable
    host-unreach                alias
    icmp-proto-unreachable      ICMP protocol unreachable
    proto-unreach               alias
    icmp-port-unreachable       ICMP port unreachable (default)
    port-unreach                alias
    icmp-net-prohibited         ICMP network prohibited
    net-prohib                  alias
    icmp-host-prohibited        ICMP host prohibited
    host-prohib                 alias
    tcp-reset                   TCP RST packet
    tcp-rst                     alias
    icmp-admin-prohibited       ICMP administratively prohibited (*)
    admin-prohib                alias
这些选项控制的，也就是说，--reject-with 的作用是定义 返回错误包的