iptables [-t table] command [match] [target/jump]
1. 指定操作的表格(table)
-t 表格可以是filter,mangle,nat或者raw
2. 对链的操作(command):
链可以是PREROUTING、INPUT、FORWARD、POSTROUTING或者OUTPUT.
-A 加入(append) 一个新规则到一个链 (-A)的最后。
-I 在链内某个位置插入(insert) 一个新规则(-I)，通常是插在最前面。
-R 在链内某个位置替换(replace) 一条规则 (-R)。
-D 在链内某个位置删除(delete) 一条规则 (-D)。
-L List
-F Flush, equivalent to deleting each rule one by one
-Z Zero, to zero all counters in a specific chain, or in all chains
-N New, create new chain
-X --delete-chain
-P --policy, set a specified default target, or policy, on a chain. All packets that don't match any rule will then be forced to use the policy of the chain
-E --rename-chain
操作Options
-v, --verbose gives verbose output and is mainly used together with the --list command
-x, --exact expands the numerics
-n, --numeric output numerical values
--line-numbers output line numbers.
-c, --set-counters initialize the packet and byte counters for the rule
--modprobe tell iptables which module to use when probing for modules or adding them to the kernel
3. match
1). 指定源地址和目的地址
-s/--src/--source 指定源地址
-d/--dst/--destination 指定目的地址
可以使用以下四中方法来指定ip地址:
a. 使用完整的域名，如“www.linuxaid.com.cn”;
b. 使用ip地址，如“192.168.1.1”;
c. 用x.x.x.x/x.x.x.x指定一个网络地址，如“192.168.1.0/255.255.255.0”;
d. 用x.x.x.x/x指定一个网络地址，如“192.168.1.0/24”这里的24表明了子网掩码的有效位数，这是 UNIX环境中通常使用的表示方法。
缺省的子网掩码数是32，也就是说指定192.168.1.1等效于192.168.1.1/32。
2). 指定网络接口
-i/--in-interface 指定进来的网络接口
-o/--out-interface 指定出去的网络接口
3). 指定协议及端口
-p/--protocol选项来指定协议
--sport/--source-port 指明源端口
--dport/--destination-port 指明目的端口
-f, --fragment match the second and third part of a fragmented packet
--tcp-flags match on the TCP flags in a packet, eg SYN,FIN,ACK SYN
-m addrtype addrtype match
--src-type match the source address type of the packet
--dst-type
4. target/jump
-j jump
范例
iptables -t nat -a PREROUTING -i ethl -p tcp - -dport 80 -j DNAT -- to -destination 192.168.1.3:8080
-t nat 操作nat 表格
-A PREROUTING 添加规则到指定表的PREROUTING链结
-i eth1 过滤条件: 从eth1界面进来的包
-p tcp 过滤条件:包格式符合tcp协议
--dport 80 过滤条件:目的端口为80
-j DNAT 处置目标: 跳到DNAT目标
-- to-destination 处置目标:将包的目的和端口 改成192.168.1.3:8080
How data travel to our own machine
| Step | Table | Chain | Comment |
|---|---|---|---|
| 1 | On the wire (e.g., Internet) | ||
| 2 | Comes in on the interface (e.g., eth0) | ||
| 3 | raw | PREROUTING | This chain is used to handle packets before the connection tracking takes place. It can be used to set a specific connection not to be handled by the connection tracking code for example. |
| 4 | This is when the connection tracking code takes place as discussed in the The state machine chapter. | ||
| 5 | mangle | PREROUTING | This chain is normally used for mangling packets, i.e., changing TOS and so on. |
| 6 | nat | PREROUTING | This chain is used for DNAT mainly. Avoid filtering in this chain since it will be bypassed in certain cases. |
| 7 | Routing decision, i.e., is the packet destined for our local host or to be forwarded and where. | ||
| 8 | mangle | INPUT | At this point, the mangle INPUT chain is hit. We use this chain to mangle packets, after they have been routed, but before they are actually sent to the process on the machine. |
| 9 | filter | INPUT | This is where we do filtering for all incoming traffic destined for our local host. Note that all incoming packets destined for this host pass through this chain, no matter what interface or in which direction they came from. |
| 10 | Local process or application (i.e., server or client program). |
How outgoing packets going from our own local host
| Step | Table | Chain | Comment |
|---|---|---|---|
| 1 | Local process/application (i.e., server/client program) | ||
| 2 | Routing decision. What source address to use, what outgoing interface to use, and other necessary information that needs to be gathered. | ||
| 3 | raw | OUTPUT | This is where you do work before the connection tracking has taken place for locally generated packets. You can mark connections so that they will not be tracked for example. |
| 4 | This is where the connection tracking takes place for locally generated packets, for example state changes et cetera. This is discussed in more detail in the The state machine chapter. | ||
| 5 | mangle | OUTPUT | This is where we mangle packets, it is suggested that you do not filter in this chain since it can have side effects. |
| 6 | nat | OUTPUT | This chain can be used to NAT outgoing packets from the firewall itself. |
| 7 | Routing decision, since the previous mangle and nat changes may have changed how the packet should be routed. | ||
| 8 | filter | OUTPUT | This is where we filter packets going out from the local host. |
| 9 | mangle | POSTROUTING | The POSTROUTING chain in the mangle table is mainly used when we want to do mangling on packets before they leave our host, but after the actual routing decisions. This chain will be hit by both packets just traversing the firewall, as well as packets created by the firewall itself. |
| 10 | nat | POSTROUTING | This is where we do SNAT as described earlier. It is suggested that you don't do filtering here since it can have side effects, and certain packets might slip through even though you set a default policy of DROP. |
| 11 | Goes out on some interface (e.g., eth0) | ||
| 12 | On the wire (e.g., Internet) |
How's the packet is destined for another host on another network
| Step | Table | Chain | Comment |
|---|---|---|---|
| 1 | On the wire (i.e., Internet) | ||
| 2 | Comes in on the interface (i.e., eth0) | ||
| 3 | raw | PREROUTING | Here you can set a connection to not be handled by the connection tracking system. |
| 4 | This is where the non-locally generated connection tracking takes place, and is also discussed more in detail in the The state machine chapter. | ||
| 5 | mangle | PREROUTING | This chain is normally used for mangling packets, i.e., changing TOS and so on. |
| 6 | nat | PREROUTING | This chain is used for DNAT mainly. SNAT is done further on. Avoid filtering in this chain since it will be bypassed in certain cases. |
| 7 | Routing decision, i.e., is the packet destined for our local host or to be forwarded and where. | ||
| 8 | mangle | FORWARD | The packet is then sent on to the FORWARD chain of the mangle table. This can be used for very specific needs, where we want to mangle the packets after the initial routing decision, but before the last routing decision made just before the packet is sent out. |
| 9 | filter | FORWARD | The packet gets routed onto the FORWARD chain. Only forwarded packets go through here, and here we do all the filtering. Note that all traffic that's forwarded goes through here (not only in one direction), so you need to think about it when writing your rule-set. |
| 10 | mangle | POSTROUTING | This chain is used for specific types of packet mangling that we wish to take place after all kinds of routing decisions have been done, but still on this machine. |
| 11 | nat | POSTROUTING | This chain should first and foremost be used for SNAT. Avoid doing filtering here, since certain packets might pass this chain without ever hitting it. This is also where Masquerading is done. |
| 12 | Goes out on the outgoing interface (i.e., eth1). | ||
| 13 | Out on the wire again (i.e., LAN). |
We have now seen how the different chains are traversed in three separate scenarios. If we were to figure out a good map of all this, it would look something like this:
链结
Linux核 心的包处理流程中，共设置了五个(鱼钩)拦截点(hook points)，分别是PREROUTING、INPUT、FORWARD、POSTROUTING以及OUTPUT。內建链结只能作用在这些拦截点；你 可以针对个別拦截点设置一系列处理规则，每条规则各代表一次影响(或监测)包处理流程的机会。
表格(Tables)
iptables內建三个表格：filter、mangle以及nat每个表格都被预先设置了一或多个代表各拦截点的链结
包（package）的流程
当包流经链结时，必须依序通过该链结裡每一条规则的检验。若包符合某条规则的「筛选条件」(match)，则将包交给该规则的「目标」(target)来 处理，否则，就继续由同链结裡的下一条规则予以检验。倘若包顺利通过链结裡的所有规则(不符合任何规则的筛选条件)，则以链结的「政策」(policy， 参閱《链结(Chains)》来決定其去向。
包实际会经过哪些链结，取決於包本身的性质(转交、输入、输出、绕回)，《表4》到《表7》分別列出各种性质的包的旅程顺序。《图1》《图2》和《图3》是单看特定筛表时，包如何通过该筛表各链结的详细流程。
规则（Rules）
iptables的每一条规则(rule)，都是由两部分组成的，第一部分包含一或多个「过滤条件」其作用是检查包是否符合处理条件(所有条件都必须成立才算数) ；第而部分称为「目标」，用於決定如何处置符合条件的包。
过滤条件(Matches)
iptables可让你设置多种过滤条件，但是某些条件需要核心有提供相关功能才行。Iptables本身內建一般性的Internet Protocol (IP) 过滤条件，也就是說，即时沒载入任何扩充模组，你也可以用IP包标头的「传输协定类型」、「来源位址」、「目的地位址」等栏位为过滤条件。
目标(Target)
目标「(targets)决定如何处理符合过滤条件的包，或是当成链结的政策。iptables共内建四种目标ACCEP, DROP, QUEUE, RETURN
网址转译 (Network address translation，NAT)
NAT是一种涉及修改来源位址，目的地位址、来源端口、目的地端口之特殊「包修改」。对於只修改来源位址/通讯端口的操作，称为「Source NAT」(或简称为S-NAT或SN AT)；若只修改目的地位址/通讯端口，则称为「Destination NAT」(或简称为D-NAT或DNAT)。某些形式的NAT需要运用「连線追蹤」来決定如何修改包。
偽装(Masquerading)
「偽装」是一种特殊的SNAT操作：将来自其它电脑的包的来源位址改成自己的位址：请注意，由於入替的来源位址是自动決定的(执行SNAT的主机的IP位 址)。所以，如果它改变了，仍在持续中的旧连線将会失效。「偽装」的主要用途是让多部使用private Ip的电脑(通常是透过DHCP动态取得)可以共用同一个public IP(固定或ISP动态分配)上网。
通讯埠转接(Port Forwarding)
「通讯埠转接」是一种特殊的DNAT操作，其作用是让一部电脑(通常是防火牆)担任其它电脑的代理伺服器(proxy)。防火牆接收外界网络接传给它自己 的包，然后改写包的目的地位址或目的端口，使其像是要送到內部网路其它电脑的樣子，然后才修改好的包送往新目的地。此外，来自內部网路的相关回复包，也会 被防火牆改写成像是从防火牆自己发出的樣子，然后才送到外界电脑。
其他iptables选项
-j option invokes a jump to one of the custom chains-L outputs the statistics for a chain-v option provides verbose output, including the packet and byte counters that we are interested in-n option as well to prevent DNS lookups, meaning iptables will show the IP addresses without attempting to resolve the hostnames for the IP addresses-save back up-restore restore
-c use the packet and byte counters
