iptables的參數(shù)設定
iptables的設定
iptables-save用來把當前的規(guī)則存入一個文件里以備iptables-restore使用。它的使用很簡單，只有兩個參數(shù)：
- iptables-save [-c] [-t table]
參數(shù)-c的作用是保存包和字節(jié)計數(shù)器的值。這可以使我們在重啟防火墻后不丟失對包和字節(jié)的統(tǒng)計。帶-c參數(shù)的iptables-save命令使重啟防火墻而不中斷統(tǒng)計記數(shù)程序成為可能。這個參數(shù)默認是不使用的。
參數(shù)-t指定要保存的表，默認是保存所有的表。下面給出未裝載任何規(guī)則的情況下iptables-save的輸出。
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
- *filter
- :INPUT ACCEPT [404:19766]
- :FORWARD ACCEPT [0:0]
- :OUTPUT ACCEPT [530:43376]
- COMMIT
- # Completed on Wed Apr 24 10:19:17 2002
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
- *mangle
- :PREROUTING ACCEPT [451:22060]
- :INPUT ACCEPT [451:22060]
- :FORWARD ACCEPT [0:0]
- :OUTPUT ACCEPT [594:47151]
- :POSTROUTING ACCEPT [594:47151]
- COMMIT
- # Completed on Wed Apr 24 10:19:17 2002
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
- *nat
- :PREROUTING ACCEPT [0:0]
- :POSTROUTING ACCEPT [3:450]
- :OUTPUT ACCEPT [3:450]
- COMMIT
- # Completed on Wed Apr 24 10:19:17 2002
我們來解釋一下這個輸出格式。#后面的是注釋。表都以*
上面的例子是最基本的，我想用一個簡短的例子說明會更好，其中包含一個非常小的規(guī)則集Iptables-save ruleset。iptables-save的輸出如下：
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
- *filter
- :INPUT DROP [1:229]
- :FORWARD DROP [0:0]
- :OUTPUT DROP [0:0]
- -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
- -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
- -A FORWARD -i eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
- -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
- COMMIT
- # Completed on Wed Apr 24 10:19:55 2002
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
- *mangle
- :PREROUTING ACCEPT [658:32445]
- :INPUT ACCEPT [658:32445]
- :FORWARD ACCEPT [0:0]
- :OUTPUT ACCEPT [891:68234]
- :POSTROUTING ACCEPT [891:68234]
- COMMIT
- # Completed on Wed Apr 24 10:19:55 2002
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
- *nat
- :PREROUTING ACCEPT [1:229]
- :POSTROUTING ACCEPT [3:450]
- :OUTPUT ACCEPT [3:450]
- -A POSTROUTING -o eth0 -j SNAT --to-source 195.233.192.1
- COMMIT
- # Completed on Wed Apr 24 10:19:55 2002
每個命令前都有包和字節(jié)計數(shù)器，這說明使用了-c參數(shù)。除了有計數(shù)器，其他的都和普通的腳本一樣?，F(xiàn)在的問題是怎么把輸出保存到文件中。非常簡單，既然使用linux，你應該早就知道了，用重定向?。?/p>
iptables-save -c > /etc/iptables-save
這就會把規(guī)則集保存到/etc/iptables-save中，而且還有計數(shù)器。
【編輯推薦】
