理论篇-iptables

2017-11-14

网络包
  |
rule1  --Y-->  action1
  |
  N
  |
rule2  --Y-->  action2
  |
......
  |
ruleN  --Y--> actionN
  |
  N
  |
默认规则

iptables按照顺序依次匹配规则，若匹配则执行相应的动作且停止匹配，否则继续匹配。

iptables有很多table:

管理本机进出的filter
- INPUT 进系统的包
- OUTPUT 出系统的包
- FORWARD 转发的包
管理后端主机的nat
- PREROUTING 进行路由判断之前要进行的规则
- POSTROUTING 进行路由判断之后进行的规则
- OUTPUT 发出去的包
管理特殊flag的mangle
自动的table

# Generated by iptables-save v1.4.7 on Tue Nov 14 21:27:52 2017
*nat
:PREROUTING ACCEPT [167942:11284276]
:POSTROUTING ACCEPT [57:3797]
:OUTPUT ACCEPT [57:3797]
COMMIT
# Completed on Tue Nov 14 21:27:52 2017
# Generated by iptables-save v1.4.7 on Tue Nov 14 21:27:52 2017
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [190:18992]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT # 允许本机发出的流量进入本机
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
COMMIT
# Completed on Tue Nov 14 21:27:52 2017

route

flags的取值及意义

U (route is up): 该路由是启动的
H (target is a host): 目标是一个主机而非网域
G (use gateway): 需要使用外部的主机来传递封包
R (reinstate route for dynamic routing): 使用动态路由时恢复路由信息的旗标
D (dynamically installed by daemon or redirect): 设定为动态路由
M (modified from routing daemon or redirect): 路由已经被修改了
! (reject route): 该路由被拒绝