Книга: Linux Network Administrator Guide, Second Edition
Commands
Commands
There are a number of ways we can manipulate rules and rulesets with the iptables command. Those relevant to IP firewalling are:
- A chain
Append one or more rules to the end of the nominated chain. If a hostname is supplied as either a source or destination and it resolves to more than one IP address, a rule will be added for each address.
- I chain rulenum
Insert one or more rules to the start of the nominated chain. Again, if a hostname is supplied in the rule specification, a rule will be added for each of the addresses to which it resolves.
- D chain
Delete one or more rules from the specified chain matching the rule specification.
- D chain rulenum
Delete the rule residing at position rulenum in the specified chain. Rule positions start at 1 for the first rule in the chain.
- R chain rulenum
Replace the rule residing at position rulenum in the specific chain with the supplied rule specification.
- C chain
Check the datagram described by the rule specification against the specific chain. This command will return a message describing how the chain processed the datagram. This is very useful for testing your firewall configuration and we will look at it in detail later.
- L [chain]
List the rules of the specified chain, or for all chains if no chain is specified.
- F [chain]
Flush the rules of the specified chain, or for all chains if no chain is specified.
- Z [chain]
Zero the datagram and byte counters for all rules of the specified chain, or for all chains if no chain is specified.
- N chain
Create a new chain with the specified name. A chain of the same name must not already exist. This is how user-defined chains are created.
- X [chain]
Delete the specified user-defined chain, or all user-defined chains if no chain is specified. For this command to be successful, there must be no references to the specified chain from any other rules chain.
- P chain policy
Set the default policy of the specified chain to the specified policy. Valid firewalling policies are ACCEPT, DROP, QUEUE, and RETURN. ACCEPT allows the datagram to pass. DROP causes the datagram to be discarded. QUEUE causes the datagram to be passed to userspace for further processing. The RETURN target causes the IP firewall code to return to the Firewall Chain that called the one containing this rule, and continue starting at the rule after the calling rule.
- Appendix A. Detailed explanations of special commands
- Use Essential Commands from the
- Using Basic Print Commands
- Using Commands in the ftpaccess File to Configure wu-ftpd
- Configure Commands Directed Toward the cdpath
- Using Commands for Server Administration
- Basic Commands
- Combining Commands
- Appendix B. U-Boot Configurable Commands
- Appendix C. BusyBox Commands
- 11.3.4. BusyBox Commands
- 14.3.3. gdb User-Defined Commands