iptables的參數設定
作者：Oskar Andreasson
iptables在Red Hat上的安裝：為了運行iptables，需要在內核配置期間，選擇一些選項，無論用什么命令。本文講述的是iptables在Red Hat上的安裝
iptables的設定
iptables-save用來把當前的規則存入一個文件里以備iptables-restore使用。它的使用很簡單，只有兩個參數：
- iptables-save [-c] [-t table]
參數-c的作用是保存包和字節計數器的值。這可以使我們在重啟防火墻后不丟失對包和字節的統計。帶-c參數的iptables-save命令使重啟防火墻而不中斷統計記數程序成為可能。這個參數默認是不使用的。
參數-t指定要保存的表，默認是保存所有的表。下面給出未裝載任何規則的情況下iptables-save的輸出。
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
- *filter
- :INPUT ACCEPT [404:19766]
- :FORWARD ACCEPT [0:0]
- :OUTPUT ACCEPT [530:43376]
- COMMIT
- # Completed on Wed Apr 24 10:19:17 2002
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
- *mangle
- :PREROUTING ACCEPT [451:22060]
- :INPUT ACCEPT [451:22060]
- :FORWARD ACCEPT [0:0]
- :OUTPUT ACCEPT [594:47151]
- :POSTROUTING ACCEPT [594:47151]
- COMMIT
- # Completed on Wed Apr 24 10:19:17 2002
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
- *nat
- :PREROUTING ACCEPT [0:0]
- :POSTROUTING ACCEPT [3:450]
- :OUTPUT ACCEPT [3:450]
- COMMIT
- # Completed on Wed Apr 24 10:19:17 2002
我們來解釋一下這個輸出格式。#后面的是注釋。表都以*
上面的例子是最基本的，我想用一個簡短的例子說明會更好，其中包含一個非常小的規則集Iptables-save ruleset。iptables-save的輸出如下：
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
- *filter
- :INPUT DROP [1:229]
- :FORWARD DROP [0:0]
- :OUTPUT DROP [0:0]
- -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
- -A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
- -A FORWARD -i eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
- -A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
- COMMIT
- # Completed on Wed Apr 24 10:19:55 2002
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
- *mangle
- :PREROUTING ACCEPT [658:32445]
- :INPUT ACCEPT [658:32445]
- :FORWARD ACCEPT [0:0]
- :OUTPUT ACCEPT [891:68234]
- :POSTROUTING ACCEPT [891:68234]
- COMMIT
- # Completed on Wed Apr 24 10:19:55 2002
- # Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
- *nat
- :PREROUTING ACCEPT [1:229]
- :POSTROUTING ACCEPT [3:450]
- :OUTPUT ACCEPT [3:450]
- -A POSTROUTING -o eth0 -j SNAT --to-source 195.233.192.1
- COMMIT
- # Completed on Wed Apr 24 10:19:55 2002
每個命令前都有包和字節計數器，這說明使用了-c參數。除了有計數器，其他的都和普通的腳本一樣。現在的問題是怎么把輸出保存到文件中。非常簡單，既然使用linux，你應該早就知道了，用重定向啊：
iptables-save -c > /etc/iptables-save
這就會把規則集保存到/etc/iptables-save中，而且還有計數器。
【編輯推薦】
責任編輯：zhaolei
來源：
lupaworld
