linux netfilter

yum -y install iptables
//三张表 filter  nat mangle

[root@wang /]# iptables -t filter -nvL

[root@wang /]# iptables -t nat -nvL

Chain PREROUTING (policy ACCEPT  packets,  bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT  packets,  bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT  packets,  bytes)
 pkts bytes target     prot opt in     out     source               destination
[root@wang /]# iptables -t mangle -nvL
Chain PREROUTING (policy ACCEPT  packets,  bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT  packets,  bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT  packets,  bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT  packets,  bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT  packets,  bytes)
 pkts bytes target     prot opt in     out     source               destination

[root@wang /]# filter INPUT OUTPUT 用的最多^C
[root@wang /]# iptables -t filter -I INPUT -p TCP --dport 80 -s 12.12.12.12 -j REJECT  //filter表 INPUT表 TCP包 端口80 来源IP 操作DROP扔掉 REJECT拒绝 
[root@wang /]# iptables -t filter -nvL  //查看

[root@wang /]# iptables -Z  //清空数字

[root@wang /]# iptables -F  //清楚全部规则

//最后记得保存规则 否则重启后会扔掉

[root@wang /]# service iptables save
iptables：将防火墙规则保存到 /etc/sysconfig/iptables： [确定]
[root@wang /]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Thu Dec 22 02:56:51 2016
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [32:4672]
-A INPUT -s 12.12.12.12/32 -p tcp -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Thu Dec 22 02:56:51 2016

//清空所有规则  恢复备份规则

[root@wang /]# iptables -F
[root@wang /]# iptables -nvL
Chain INPUT (policy ACCEPT 6 packets, 432 bytes)
pkts bytes target prot opt in out source destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 4 packets, 448 bytes)
pkts bytes target prot opt in out source destination

[root@wang /]# iptables-restore < /etc/sysconfig/iptables  //恢复  iptables-save > 1.ipt 备份
[root@wang /]# iptables -nvL