linux netfilter

yum -y install iptables
//三张表 filter  nat mangle

[root@wang /]# iptables -t filter -nvL

[root@wang /]# iptables -t nat -nvL

Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
[root@wang /]# iptables -t mangle -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

[root@wang /]# filter INPUT OUTPUT 用的最多^C
[root@wang /]# iptables -t filter -I INPUT -p TCP --dport 80 -s 12.12.12.12 -j REJECT  //filter表 INPUT表 TCP包 端口80 来源IP 操作DROP扔掉 REJECT拒绝 
[root@wang /]# iptables -t filter -nvL  //查看

[root@wang /]# iptables -Z  //清空数字

[root@wang /]# iptables -F  //清楚全部规则

//最后记得保存规则 否则重启后会扔掉

[root@wang /]# service iptables save
iptables：将防火墙规则保存到 /etc/sysconfig/iptables： [确定]
[root@wang /]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Thu Dec 22 02:56:51 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [32:4672]
-A INPUT -s 12.12.12.12/32 -p tcp -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Thu Dec 22 02:56:51 2016

//清空所有规则  恢复备份规则

[root@wang /]# iptables -F
[root@wang /]# iptables -nvL
Chain INPUT (policy ACCEPT 6 packets, 432 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 4 packets, 448 bytes)
pkts bytes target prot opt in out source destination

[root@wang /]# iptables-restore < /etc/sysconfig/iptables  //恢复  iptables-save > 1.ipt 备份
[root@wang /]# iptables -nvL