iptables 顺序

-A INPUT -s 115.236.6.6/32 -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -s 10.175.197.98/32 -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -s 10.171.254.221/32 -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -p udp -m udp --dport 111 -j DROP

-A INPUT -s 10.175.197.98/32 -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -s 115.236.6.6/32 -p tcp -m tcp --dport 111 -j ACCEPT
-A INPUT -s 10.171.254.221/32 -p tcp -m tcp --dport 111 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 111 -j DROP

-A INPUT -s 115.236.6.6/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j DROP
-A INPUT -s 121.42.0.15/32 -j DROP

   Insert one or more rules in the selected chain as the given rule number.  So, if the rule number is 1, 

   the rule or rules are inserted at the head of the chain.  This is also the default if
   no rule number is specified.

插入chain 规则说明；

插入一个或者多个规则在选择的chain 作为给定的规则number

因此 如果规则number 是1, rule和rules 是被插入到chain的头部,这也是默认的如果没有规则number 被指定
[root@nfs01 ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Tue Sep 20 11:03:42 2016
*filter
:INPUT ACCEPT [1032:58291]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [1452:2612203]
COMMIT
# Completed on Tue Sep 20 11:03:42 2016

	切换到root用户
1、在tcp协议中，禁止所有的ip访问本机的22端口。
iptables -I INPUT -p tcp --dport 22 -j DROP  

iptables -I INPUT -s 115.236.6.6 -p tcp --dport 22 -j ACCEPT 

iptables -I INPUT -p tcp --dport 111 -j DROP
iptables -I INPUT -s 115.236.6.6 -p tcp --dport 111 -j ACCEPT
iptables -I INPUT -s 10.175.197.98 -p tcp --dport 111 -j ACCEPT
iptables -I INPUT -s 10.171.254.221 -p tcp --dport 111 -j ACCEPT	

iptables -I INPUT -p udp --dport 111 -j DROP
iptables -I INPUT -s 115.236.6.6 -p udp --dport 111 -j ACCEPT
iptables -I INPUT -s 10.175.197.98 -p udp --dport 111 -j ACCEPT
iptables -I INPUT -s 10.171.254.221 -p udp --dport 111 -j ACCEPT

# service iptables save
3.重启防火墙
#service iptables restart 		

api01:/nfs01/zjprd/contract> telnet 10.171.250.68 111
Trying 10.171.250.68...
Connected to 10.171.250.68.
Escape character is '^]'.

[root@nfs01 ~]# cat a1.sh
iptables -I INPUT -p tcp --dport 22 -j DROP
iptables -I INPUT -s 115.236.160.82 -p tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp --dport 111 -j DROP
iptables -I INPUT -s 115.236.160.82 -p tcp --dport 111 -j ACCEPT
iptables -I INPUT -s 10.175.197.98 -p tcp --dport 111 -j ACCEPT
iptables -I INPUT -s 10.171.254.221 -p tcp --dport 111 -j ACCEPT
iptables -I INPUT -p udp --dport 111 -j DROP
iptables -I INPUT -s 115.236.160.82 -p udp --dport 111 -j ACCEPT
iptables -I INPUT -s 10.175.197.98 -p udp --dport 111 -j ACCEPT
iptables -I INPUT -s 10.171.254.221 -p udp --dport 111 -j ACCEPT

[root@nfs01 ~]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Tue Sep 20 11:18:45 2016
*filter
:INPUT ACCEPT [100:5792]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [104:8990]
-A INPUT -s 10.171.254.221/32 -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -s 10.175.197.98/32 -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -s 115.236.6.6/32 -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -p udp -m udp --dport 111 -j DROP
-A INPUT -s 10.171.254.221/32 -p tcp -m tcp --dport 111 -j ACCEPT
-A INPUT -s 10.175.197.98/32 -p tcp -m tcp --dport 111 -j ACCEPT
-A INPUT -s 115.236.6.6/32 -p tcp -m tcp --dport 111 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 111 -j DROP
-A INPUT -s 115.236.6.6/32 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 22 -j DROP
COMMIT
# Completed on Tue Sep 20 11:18:45 2016

正常顺序是先允许 ,后拒绝所有