iptables

规则格式：iptables   [-t table]   COMMAND   chain   [-m matchname [per-match-options]]   -j targetname [per-target-options]

    -t table：
            raw, mangle, nat, [filter]
    COMMAND：
            链管理：
                    -N：new, 自定义一条新的规则链；
                    -X： delete，删除自定义的规则链；
                   注意：仅能删除 用户自定义的 引用计数为0的 空的 链；
                    – P：Policy，设置默认策略；对filter表中的链而言，其默认策略有：
                                ACCEPT：接受
                                DROP：丢弃
                                REJECT：拒绝
                    -E：重命名自定义链；引用计数不为0的自定义链不能够被重命名，也不能被删除；
            规则管理：
                    -A：append，追加；
                    -I：insert, 插入，要指明位置，省略时表示第一条；
                    -D：delete，删除；
                        (1) 指明规则序号；
                        (2) 指明规则本身；
                    -R：replace，替换指定链上的指定规则；

                    -F：flush，清空指定的规则链；
                    -Z：zero，置零；
                            iptables的每条规则都有两个计数器：
                                    (1) 匹配到的报文的个数；
                                    (2) 匹配到的所有报文的大小之和；
            查看：
                    -L：list, 列出指定鏈上的所有规则；
                    -n：numberic，以数字格式显示地址和端口号；
                    -v：verbose，详细信息；
                    -vv, -vvv
                    -x：exactly，显示计数器结果的精确值； 
                    –line-numbers：显示规则的序号；

    chain：
                    PREROUTING，INPUT，FORWARD，OUTPUT，POSTROUTING

    匹配条件：
           基本匹配条件：无需加载任何模块，由iptables/netfilter自行提供；
                    [!] -s, –source  address[/mask][,…]：检查报文中的源IP地址是否符合此处指定的地址或范围；
                    [!] -d, –destination address[/mask][,…]：检查报文中的目标IP地址是否符合此处指定的地址或范围；
                                                        所有地址：0.0.0.0/0
                    [!] -p, –protocol protocolprotocol: tcp, udp, udplite, icmp;
                    [!] -i, –in-interface name：数据报文流入的接口；
                    [!] -o, –out-interface name：数据报文流出的接口； 

           扩展匹配条件：

                    隐式扩展：在使用-p选项指明了特定的协议时，无需再同时使用-m选项指明扩展模块的扩展机制；
                    显式扩展：必须使用-m选项指明要调用的扩展模块的扩展机制；
                    隐式扩展：不需要手动加载扩展模块；
                            tcp：
                                        [!] –source-port, –sport port[:port]：匹配报文的源端口；可以是端口范围；
                                        [!] –destination-port,–dport port[:port]：匹配报文的目标端口；可以是端口范围；
                                        [!] –tcp-flags  mask 
                                        [!] –syn：用于匹配第一次握手，相当于”–tcp-flags  SYN,ACK,FIN,RST  SYN“；
                            udp 
                                        [!] –source-port, –sport port[:port]：匹配报文的源端口；可以是端口范围；
                                        [!] –destination-port,–dport port[:port]：匹配报文的目标端口；可以是端口范围；

                            icmp 
                                        [!] –icmp-type {type[/code]|typename}
                                                        echo-request：8
                                                        echo-reply：0

                    显式扩展：必须要手动加载扩展模块， [-m matchname [per-match-options]]；
                            显式扩展：必须使用-m选项指明要调用的扩展模块的扩展机制；
                            1、multiport
                                    以离散或连续的 方式定义多端口匹配条件，最多15个；
                                        [!] –source-ports,–sports port[,port|,port:port]…：指定多个源端口；
                                        [!] –destination-ports,–dports port[,port|,port:port]…：指定多个目标端口；
                                       # iptables -I INPUT  -d 172.16.0.7 -p tcp -m multiport –dports 22,80,139,445,3306 -j ACCEPT

                            2、iprange
                                    以连续地址块的方式来指明多IP地址匹配条件；
                                        [!] –src-range from[-to]
                                        [!] –dst-range from[-to]
                                        # iptables -I INPUT -d 172.16.0.7 -p tcp -m multiport –dports 22,80,139,445,3306 -m

                                         iprange –src-range 172.16.0.61-172.16.0.70 -j REJECT

                            3、time
                                    –timestart hh:mm[:ss]
                                    –timestop hh:mm[:ss] 
                                     [!] –weekdays day[,day…] 
                                     [!] –monthdays day[,day…] 
                                     –datestop YYYY[-MM[-DD[Thh[:mm[:ss]]]]]
                                    –kerneltz：使用内核配置的时区而非默认的UTC；

                            4、string
                                    –algo {bm|kmp}
                                    [!] –string pattern
                                    [!] –hex-string pattern    
                                    –from offset
                                    –to offset    
                                   ~]# iptables -I OUTPUT -m string –algo bm –string “gay” -j REJECT

                            5、connlimit 
                                    –connlimit-upto n
                                    –connlimit-above n
                            ~]# iptables -I INPUT -d 172.16.0.7 -p tcp –syn –dport 22 -m connlimit –connlimit-above 2 -j REJECT

                            6、limit 
                                    –limit rate[/second|/minute|/hour|/day]
                                    –limit-burst number
                                    ~]# iptables -I OUTPUT -s 172.16.0.7 -p icmp –icmp-type 0 -j ACCEPT
                                    限制本机某tcp服务接收新请求的速率：–syn, -m limit

                            7、state
                                    [!] –state state
                                            INVALID, ESTABLISHED, NEW, RELATED or UNTRACKED.
                                    NEW: 新连接请求；
                                    ESTABLISHED：已建立的连接；
                                    INVALID：无法识别的连接；
                                    RELATED：相关联的连接，当前连接是一个新请求，但附属于某个已存在的连接；
                                    UNTRACKED：未追踪的连接；