iptables详解（8）iptables自定义链

自定义链存在的意义：对链进行分类

target可能是一个“动作“也可能是一个”自定义链”

1.新增自定义链。

root@ubuntu:~# iptables -t filter -N IN_WEB
#结果
root@ubuntu:~# iptables -nvL
Chain INPUT (policy ACCEPT 23 packets, 1448 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 16 packets, 1212 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain IN_WEB (0 references)
 pkts bytes target     prot opt in     out     source               destination

　

2.引用自定义链。

root@ubuntu:~# iptables -t filter -I INPUT -p tcp --dport 80 -j IN_WEB
#结果
root@ubuntu:~# iptables -nvL
Chain INPUT (policy ACCEPT 11 packets, 770 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 IN_WEB     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4 packets, 480 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain IN_WEB (1 references)
 pkts bytes target     prot opt in     out     source               destination

　　

3.重命名自定义链。

root@ubuntu:~# iptables -E IN_WEB WEB

root@ubuntu:~# iptables -nvL
Chain INPUT (policy ACCEPT 53 packets, 3639 bytes)
 pkts bytes target     prot opt in     out     source               destination
    0     0 WEB        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 36 packets, 2840 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain WEB (1 references)
 pkts bytes target     prot opt in     out     source               destination

　　

4.删除自定义链。

root@ubuntu:~# iptables -X WEB
iptables: Too many links.
#被引用了无法删除
root@ubuntu:~# iptables --line -nvL
Chain INPUT (policy ACCEPT 366 packets, 32141 bytes)
num   pkts bytes target     prot opt in     out     source               destination
1        0     0 WEB        tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 137 packets, 11248 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain WEB (1 references)
num   pkts bytes target     prot opt in     out     source               destination
#删除引用自定义链的条目
root@ubuntu:~# iptables -D INPUT 1
root@ubuntu:~#
root@ubuntu:~# iptables -nvL
Chain INPUT (policy ACCEPT 70 packets, 4797 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 35 packets, 2848 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain WEB (0 references)
 pkts bytes target     prot opt in     out     source               destination         

#可正常删除
root@ubuntu:~# iptables -X WEB
root@ubuntu:~#
root@ubuntu:~# iptables -nvL
Chain INPUT (policy ACCEPT 33 packets, 2104 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 23 packets, 1860 bytes)
 pkts bytes target     prot opt in     out     source               destination

　删除的条件：

1.自定义链中无规则

2.自定义链没有被其他的链所引用