Iptables 8

中文man手册

NAME iptables - IP包过滤器管理 .SH 总览 iptables -ADC 指定链的规则 [-A 添加 -D 删除 -C 修改] .br iptables - RI .br iptables -D chain rule num[option] .br iptables -LFZ 链名 [选项] .br iptables -[NX] 指定链 .br iptables -P chain target[options] .br iptables -E old-chain-name new-chain-name .SH 说明 Iptalbes 是用来设置、维护和检查Linux内核的IP包过滤规则的。可以定义不同的表，每个表都包含几个内部的链，也能包含用户定义的链。每个链都是一个规则列表，对对应的包进行匹配：每条规则指定应当如何处理与之相匹配的包。这被称作'target'（目标），也可以跳向同一个表内的用户定义的链。 .SH TARGETS 防火墙的规则指定所检查包的特征，和目标。如果包不匹配，将送往该链中下一条规则检查；如果匹配,那么下一条规则由目标值确定.该目标值可以是用户定义的链名,或是某个专用值,如ACCEPT[通过], DROP[删除], QUEUE[排队],或者 RETURN[返回]。 .PP .I ACCEPT 表示让这个包通过。 .br .I DROP 表示将这个包丢弃。 .br .I QUEUE 表示把这个包传递到用户空间。 .br .I RETURN 表示停止这条链的匹配，到前一个链的规则重新开始。如果到达了一个内建的链(的末端)，或者遇到内建链的规则是 RETURN，包的命运将由链准则指定的目标决定。 .SH TABLES 当前有三个表（哪个表是当前表取决于内核配置选项和当前模块)。 .TP .B
OPTIONS 这些可被iptables识别的选项可以区分不同的种类。 .SS COMMANDS 这些选项指定执行明确的动作：若指令行下没有其他规定,该行只能指定一个选项. 对于长格式的命令和选项名,所用字母长度只要保证iptables能从其他选项中区分出该指令就行了。 .TP .BR
对应的扩展 iptables能够使用一些与模块匹配的扩展包。以下就是含于基本包内的扩展包，而且他们大多数都可以通过在前面加上!来表示相反的意思。 .SS tcp 当 --protocol tcp 被指定,且其他匹配的扩展未被指定时,这些扩展被装载。它提供以下选项： .TP .BR
TARGET EXTENSIONS iptables可以使用扩展目标模块：以下都包含在标准版中。 .SS LOG 为匹配的包开启内核记录。当在规则中设置了这一选项后，linux内核会通过printk()打印一些关于全部匹配包的信息（诸如IP包头字段等）。 .TP .BR
诊断不同的错误信息会打印成标准错误：退出代码0表示正确。类似于不对的或者滥用的命令行参数错误会返回错误代码2，其他错误返回代码为1。 .SH 臭虫检查还未完成。 .SH COMPATIBILITY WITH IPCHAINS 与ipchains的兼容性 This iptables is very similar to ipchains by Rusty Russell. The main difference is that the chains INPUT and OUTPUT are only traversed for packets coming into the local host and originating from the local host respectively. Hence every pack only passes through one of the three chains; previously a forwarded packet would pass through all three. The other main difference is that -I refers to input interface; -o refers to the output interface, and both are available for packets entering the FORWARD chain. iptables is a pure packet filter when using the default filter' table, with optional extension modules. This should simplify much of the previous confusion over the combination of IP masquerading and packet filtering seen previously. So the following options are handled differently: -j MASQ -M -S -M -L There are several other chaines in iptables iptables和Rusty Russell的ipchains非常相似。主要区别是INPUT 链只用于进入本地主机的包,而OUTPUT只用于自本地主机生成的包。因此每个包只经过三个链的一个；以前转发的包会经过所有三个链。其他主要区别是 -i 引用进入接口；-o引用输出接口，两者都适用于进入FORWARD链的包。当和可选扩展模块一起使用默认过滤器表时，iptables是一个纯粹的包过滤器。这能大大减少以前对IP伪装和包过滤结合使用的混淆，所以以下选项作了不同的处理： -j MASQ -M -S -M -L 在iptables中有几个不同的链。 .SH 参见 iptables-HOWTO有详细的iptables用法,对netfilter-hacking-HOWTO也有详细的本质说明。 .SH 作者 Rusty Russell wrote iptables, in early consultation with Michael Neuling. Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic packet selection framework in iptables, then wrote the mangle table, the owner match, the mark stuff, and ranaround doing cool stuff everywhere. James Morris wrote the TOS target, and tos match. Jozsef Kadlecsik wrote the REJECT target. The Netfilter Core Team is: Marc Boucher, Rusty Russell. .TP Mar 20, 2000 .br .SH
[中文版最新更新]
《中国linux论坛man手册页翻译计划》:
跋

Iptables

NAME
æ»è§
è¯´æ
TARGETS
TABLES
OPTIONS
COMMANDS
åæ°
å¶ä»éé¡¹
å¯¹åºçæ©å±
tcp
udp
icmp
mac
limit
mark
owner
state
unclean
tos
TARGET EXTENSIONS
LOG
MARK
REJECT
TOS
MIRROR
SNAT
MASQUERADE
REDIRECT
è¯æ
èè«
COMPATIBILITY WITH IPCHAINS
åè§
ä½è
[ä¸æçç»´æ¤äºº]
[ä¸æçææ°æ´æ°]
ãä¸å½linuxè®ºåmanæåé¡µç¿»è¯è®¡åã:
è·

NAME

iptables - IPåè¿æ»¤å¨ç®¡ç

æ»è§

iptables -ADC æå®é¾çè§å [-A æ·»å -D å é¤ -C ä¿®æ¹]
iptables - RI
iptables -D chain rule num[option]
iptables -LFZ é¾å [éé¡¹]
iptables -[NX] æå®é¾
iptables -P chain target[options]
iptables -E old-chain-name new-chain-name

è¯´æ

Iptalbes æ¯ç¨æ¥è®¾ç½®ãç»´æ¤åæ£æ¥Linuxåæ ¸çIPåè¿æ»¤è§åçã

TARGETS

TABLES

å½åæä¸ä¸ªè¡¨ï¼åªä¸ªè¡¨æ¯å½åè¡¨åå³äºåæ ¸éç½®éé¡¹åå½åæ¨¡å)ã
-t table

è¿äºè¡¨å¦ä¸ï¼

	filter		,è¿æ¯é»è®¤çè¡¨ï¼åå«äºåå»ºçé¾INPUTï¼å¤çè¿å¥çåï¼ãFORWORDï¼å¤çé è¿çåï¼åOUTPUTï¼å¤çæ¬å°çæçåï¼ã
	nat		è¿ä¸ªè¡¨è¢«æ¥è¯¢æ¶è¡¨ç¤ºéå°äºäº§çæ°çè¿æ¥çå,ç±ä¸ä¸ªåå»ºçé¾ææï¼PREROUTING

mangle

OPTIONS

è¿äºå¯è¢«iptablesè¯å«çéé¡¹å¯ä»¥åºåä¸åçç§ç±»ã

COMMANDS

-D -delete

-R -replace

-I -insert

-L -list

-F -flush

æ¸ç©ºæéé¾ãè¿çäºæææè§åä¸ä¸ªä¸ªçå é¤ã

--Z -zero

-N -new-chain

-X -delete-chain

-P -policy

è®¾ç½®é¾çç®æ è§åã

-E -rename-chain

-h Help.

å¸®å©ãç»åºå½åå½ä»¤è¯æ³éå¸¸ç®ççè¯´æã

åæ°

ä»¥ä¸åæ°ææè§åè¯¦è¿°ï¼å¦ç¨äºaddãdeleteãreplaceãappend å checkå½ä»¤ã
-p -protocal [!]protocol

-s -source [!] address[/mask]

-d --destination [!] address[/mask]

-j --jump target

-i -in-interface [!] [name]

-o --out-interface [!][name]

[!] -f, --fragment

( [!] -f --åç)è¿æå³çå¨åççåä¸- ï¼è§ååªè¯¢é®ç¬¬äºåä»¥åççãèªé£ä»¥åç±äºæ æ³å¤æ- è¿ç§æåçæºç«¯å£æç®æ ç«¯å£ï¼æèæ¯ICMPç±»åçï¼ï¼è¿ç±»åå°ä¸è½å¹éä»» ä½æå®å¯¹ä»ä»¬è¿è¡å¹éçè§åãå¦æ"!"è¯´æç¨å¨äº"-f"æå¿ä¹åï¼è¡¨ç¤ºç¸åçææã TP -c, --set-counters PKTS BYTES This enables the administrater to initialize the packet and byte counters of a rule (during INSERT, APPEND, REPLACE operations)

å¶ä»éé¡¹

è¿å¯ä»¥æå®ä¸åéå éé¡¹ï¼
-v --verbose

-n --numeric

-x -exact

--line-numbers

å¯¹åºçæ©å±

tcp

å½ --protocol tcp è¢«æå®,ä¸å¶ä»å¹éçæ©å±æªè¢«æå®æ¶,è¿äºæ©å±è¢«è£è½½ãå®æä¾ä»¥ä¸éé¡¹ï¼
--source-port [!] [port[:port]]

--destionation-port [!] [port:[port]]

--tcp-flags [!] mask comp

å¹éæå®çTCPæè®°ãç¬¬ä¸ä¸ªåæ°æ¯æä»¬è¦æ£æ¥çæè®°ï¼ä¸ä¸ªç¨éå·åå¼çåè¡¨ï¼ ç¬¬äºä¸ªåæ°æ¯ç¨éå·åå¼çæ è®°è¡¨,æ¯å¿é¡»è¢«è®¾ç½®çãæ è®°å¦ä¸ï¼SYN ACK FIN
RST URG PSH ALL NONEãå æ¤è¿æ¡å½ä»¤ï¼iptables -A FORWARD -p tcp --tcp-flags SYN, ACK,
FIN, RST SYNåªå¹éé£äºSYNæ è®°è¢«è®¾ç½®èACKãFINåRSTæ è®°æ²¡æè®¾ç½®çåã

[!] --syn

--tcp-option [!] number

å¹éè®¾ç½®äºTCPéé¡¹çã

udp

å½protocol udp è¢«æå®,ä¸å¶ä»å¹éçæ©å±æªè¢«æå®æ¶,è¿äºæ©å±è¢«è£è½½,å®æä¾ä»¥ä¸éé¡¹ï¼
--source-port [!] [port:[port]]

æºç«¯å£æç«¯å£èå´æå®ãè¯¦è§ TCPæ©å±ç--source-portéé¡¹è¯´æã

--destination-port [!] [port:[port]]

ç®æ ç«¯å£æç«¯å£èå´æå®ãè¯¦è§ TCPæ©å±ç--destination-portéé¡¹è¯´æã

icmp

å½protocol icmpè¢«æå®,ä¸å¶ä»å¹éçæ©å±æªè¢«æå®æ¶,è¯¥æ©å±è¢«è£è½½ãå®æä¾ä»¥ä¸éé¡¹ï¼
--icmp-type [!] typename

è¿ä¸ªéé¡¹åè®¸æå®ICMPç±»åï¼å¯ä»¥æ¯ä¸ä¸ªæ°å¼åçICMP?åå?èå¤ææ£é²æ??
iptables -p icmp -h
ææ¾ç¤ºçICMPç±»ååã

mac

--mac-source [!] address

å¹éç©çå°åãå¿é¡»æ¯XX:XX:XX:XX:XXè¿æ·çæ¼å¼ãæ³¨æå®åªå¯¹æ¥èªä»¥å¤ªè®¾å¤å¹¶ è¿å¥PREROUTINGãFORWORDåINPUTé¾çåææã

limit

æå¤§å¹³åå¹ééçï¼å¯èµçå¼æ’/second’, ’/minute’, ’/hour’, or ’/day’è¿æ ·çåä½ï¼é»è®¤æ¯3/hourã

--limit-burst number

multiport

--source-port [port[, port]]

å¦ææºç«¯å£æ¯å¶ä¸ä¸ä¸ªç»å®ç«¯å£åå¹é

--destination-port [port[, port]]

å¦æç®æ ç«¯å£æ¯å¶ä¸ä¸ä¸ªç»å®ç«¯å£åå¹é

--port [port[, port]]

è¥æºç«¯å£åç®çç«¯å£ç¸çå¹¶ä¸æä¸ªç»å®ç«¯å£ç¸ç,åå¹éã

mark

è¿ä¸ªæ¨¡ååä¸netfilterè¿æ»¤å¨æ è®°å- æ®µå¹éï¼å°±å¯ä»¥å¨ä¸é¢è®¾ç½®ä¸ºä½¿ç¨MARKæ è®°ï¼ã
--mark value [/mask]

owner

å¦æç»åºææçuser idï¼é£ä¹å¹éå®çè¿ç¨äº§ççåã

--gid-owner groupid

å¦æç»åºææçgroup idï¼é£ä¹å¹éå®çè¿ç¨äº§ççåã

--sid-owner seessionid

æ ¹æ®ç»åºçä¼è¯ç»å¹éè¯¥è¿ç¨äº§ççåã

state

unclean

tos

TARGET EXTENSIONS

LOG

ä¸ºå¹éçåå¼å¯åæ ¸è®°å½ãå½å¨è§åä¸è®¾ç½®äºè¿ä¸éé¡¹åï¼linuxåæ ¸ä¼é è¿printk()æå°ä¸äºå³äºå¨é¨å¹éåçä¿¡æ¯ï¼è¯¸å¦IPåå¤´åæ®µçï¼ã
--log-level level

è®°å½çº§å«ï¼æ°åæåç syslog.conf(5)ï¼ã

--log-prefix prefix

--log-tcp-sequence

--log-tcp-options

è®°å½æ¥èªTCPåå¤´é¨çéé¡¹ã

--log-ip-options

è®°å½æ¥èªIPåå¤´é¨çéé¡¹ã

MARK

ç¨æ¥è®¾ç½®åçnetfilteræ è®°å¼ãåªéç¨äºmangleè¡¨ã
--set-mark mark

REJECT

ä½ä¸ºå¯¹å¹éçåçååºï¼è¿åä¸ä¸ªéè¯¯çåï¼å¶ä»æåµä¸åDROPç¸åã æ- ¤ç®æ åªéç¨äºINPUTãFORWARDåOUTPUTé¾ï¼åè°ç¨è¿äºé¾çç¨ æ·èªå®ä¹é¾ãè¿å ä¸ªéé¡¹æ§å¶è¿åçéè¯¯åçç¹æ§ï¼
--reject-with type

Typeå¯ä»¥æ¯icmp-net-unreachableãicmp-host-unreachableãicmp-port-nreachableãicmp-prot o-unreachableã icmp-net-prohibited æè
icmp-host-prohibitedï¼è¯¥ç±»åä¼è¿åç¸åºçICMPéè¯¯ä¿¡æ¯ï¼é»è®¤æ¯port-unreachableï¼ãéé¡¹
echo-replyä¹æ¯åè®¸çï¼å®åªè½ç¨äºæå®ICMP
pingåçè§åä¸ï¼çæpingçååºãæåï¼éé¡¹tcp-resetå¯ä»¥ç¨äºå¨INPUTé¾ä¸,æ
èªINPUTé¾è°ç¨çè§åï¼åªå¹éTCPåè®®ï¼å°ååºä¸ä¸ªTCP
RSTåã

TOS

ç¨æ¥è®¾ç½®IPåçé¦é¨å«ä½tosãåªè½ç¨äºmangleè¡¨ã
--set-tos tos

ä½ å¯ä»¥ä½¿ç¨ä¸ä¸ªæ°å¼åçTOS å¼ï¼æèç¨iptables -j TOS -h æ¥æ¥çææTOSååè¡¨ã

MIRROR

SNAT

è¿ä¸ªç®æ åªéç¨äºnatè¡¨çPOSTROUTINGé¾ãå®è§å®ä¿®æ¹åçæºå° åï¼æ- ¤è¿æ¥ä»¥åææçåé½ä¼è¢«å½±åï¼ï¼åæ¢å¯¹è§åçæ£æ¥ï¼å®åå«éé¡¹ï¼
--to-source <ipaddr>[-<ipaddr>][:port-port]

--to-destiontion <ipaddr>[-<ipaddr>][:port-port]

MASQUERADE

REDIRECT

åªéç¨äºnatè¡¨çPREROUTINGåOUTPUTé¾ï¼ååªè°ç¨å®ä»¬çç¨æ·èªå®ä¹é¾ãå®ä¿®æ¹åç ç®æ IPå°åæ¥åéåå°æºå¨èªèº«ï¼æ¬å°çæçåè¢«å®ç½®ä¸ºå°å127.0.0.1ï¼ãå®åå«ä¸ ä¸ªéé¡¹ï¼
--to-ports <port>[<port>]

è¯æ

èè«

æ£æ¥è¿æªå®æã

COMPATIBILITY WITH IPCHAINS

ä¸ipchainsçå¼å®¹æ§

This iptables is very similar to ipchains by Rusty Russell. The main difference
is that the chains INPUT and OUTPUT are only traversed for packets coming into
the local host and originating from the local host respectively. Hence every
pack only passes through one of the three chains; previously a forwarded packet
would pass through all three. The other main difference is that -I refers to
input interface; -o refers to the output interface, and both are available for
packets entering the FORWARD chain. iptables is a pure packet filter when using
the default filter’ table, with optional extension modules. This should
simplify much of the previous confusion over the combination of IP masquerading
and packet filtering seen previously. So the following options are handled
differently: -j MASQ -M -S -M -L There are several other chaines in iptables iptablesåRusty Russellçipchainséå¸¸ç¸ä¼¼ãä¸»è¦åºå«æ¯INPUT é¾åªç¨äºè¿å¥æ¬ å°ä¸»æºçå,èOUTPUTåªç¨äºèªæ¬å°ä¸»æºçæçåãå æ- ¤æ¯ä¸ªååªç»è¿ä¸ä¸ªé¾ç ä¸ä¸ªï¼ä»¥åè½¬åçåä¼ç»è¿ææä¸ä¸ªé¾ãå¶ä»ä¸»è¦åºå«æ¯ -i å¼ç¨è¿å¥æ¥å£ï¼-oå¼ ç¨è¾åºæ¥å£ï¼ä¸¤èé½éç¨äºè¿å¥FORWARDé¾çåãå½åå¯éæ©å±æ¨¡åä¸èµ·ä½¿ç¨ é»è®¤è¿æ»¤å¨è¡¨æ¶ï¼iptablesæ¯ä¸ä¸ªçº¯ç²¹çåè¿æ»¤å¨ãè¿è½å¤§å¤§åå°ä»¥åå¯¹IPä¼ªè£å åè¿æ»¤ç»åä½¿ç¨çæ··æ·ï¼æä»¥ä»¥ä¸éé¡¹ä½äºä¸åçå¤çï¼ -j MASQ -M -S -M -L å¨iptablesä¸æå ä¸ªä¸åçé¾ã

åè§

iptables-HOWTOæè¯¦ç»çiptablesç¨æ³,å¯¹netfilter-hacking-HOWTOä¹æè¯¦ç»çæ¬è´¨è¯´æã

ä½è

Rusty Russell wrote iptables, in early consultation with Michael Neuling. Marc Boucher made Rusty abandon ipnatctl by lobbying for a generic packet
selection framework in iptables, then wrote the mangle table, the owner match,
the mark stuff, and ranaround doing cool stuff everywhere. James Morris wrote the TOS target, and tos match. Jozsef Kadlecsik wrote the REJECT target. The Netfilter Core Team is: Marc Boucher, Rusty Russell.
Mar 20, 2000

[ä¸æçç»´æ¤äºº]

æ¨é¹Â·NetSnake <netsnake@963.net>

[ä¸æçææ°æ´æ°]

2003.11.20

ãä¸å½linuxè®ºåmanæåé¡µç¿»è¯è®¡åã:

http://cmpp.linuxforum.net

è·

æ¬é¡µé¢ä¸æçç±ä¸æ man æåé¡µè®¡åæä¾ã
ä¸æ man æåé¡µè®¡åï¼https://github.com/man-pages-zh/manpages-zh

手册导航

man1

man2

man3

man4

man5

man6

man7

man8