[root@linux ~]# iptables [-t tables] [-L] [-nv]
ѼơG
-t G᭱ table AҦp nat  filter AYٲءAhϥιw] filter
-L GCXثe table Wh
-n Gi IP P HOSTNAME ϬdAܰTt׷|֫ܦhI
-v GCXhTA]AqLӳWhʥ]`줸ơB

dҡGCX filter table T쪺Wh
[root@linux ~]# iptables -L -n
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

dҡGCXhT
[root@linux ~]# iptables -L -nv
Chain INPUT (policy ACCEPT 5748 packets, 746K bytes)
 pkts bytes target     prot opt in     out     source               destination
....Uٲ....

[root@linux ~]# iptables -t nat -L -n
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

[root@linux ~]# iptables [-t tables] [-FXZ]
ѼơG
-F GMҦwqwWhF
-X GҦϥΪ "ۭq"  chain (ӻO tables ^oF
-Z GNҦ chain pƻPyqέpks

dҡGM (filter) ҦWh
[root@linux ~]# iptables -F
[root@linux ~]# iptables -X
[root@linux ~]# iptables -Z

[root@linux ~]# iptables [-t nat] -P [INPUT,OUTPUT,FORWARD] [ACCEPT,DROP]
ѼơG
-P GwqF( Policy )C`NAo P jgڡI
ACCEPT Gӫʥ]i
DROP   Gӫʥ]A| client ݪDQC

dҡGN INPUT ]w DROP AL]w ACCEPT
[root@linux ~]# iptables -P   INPUT DROP
[root@linux ~]# iptables -P  OUTPUT ACCEPT
[root@linux ~]# iptables -P FORWARD ACCEPT
[root@linux ~]# iptables -L -n
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain INPUT (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
# ѩ INPUT ]w DROP ӤS|WhAҥHWXGܡG
# Ҧʥ]LkiJADIOq]wI(suOV)

[root@linux ~]# iptables [-AI ] [-io ] [-p w] \
> [-s ӷIP/] [-d ؼIP/] -j [ACCEPT|DROP]
ѼơG
-AI GwYiWh "J"  "֥["
    -A GsW[@WhAӳWhW[b쥻Wh̫᭱CҦp쥻wg|WhA
         ϥ -A NiH[WĤWhI
    -I GJ@WhCpGSwWhǡAw]OJܦĤ@WhC
         Ҧp쥻|WhAϥ -I hӳWhܦĤ@Aӭ쥻|ܦ 2~5 
     G INPUT, OUTPUT, FORWARD AW٤SP -io AЬݩUC

-io G]wʥ]iXWd
    -i Gʥ]ҶiJӺAҦp eth0, lo CݻP INPUT tXF
    -o Gʥ]ҶǥXӺAݻP OUTPUT tXF

-p wG]wWhAΩثʥ]榡
   Dnʥ]榡G tcp, udp, icmp  all C

-s ӷ IP/G]wWhʥ]ӷءAiwª IP Υ]AAҦpG
   IP  G192.168.0.100
   G192.168.0.0/24, 192.168.0.0/255.255.255.0 iC
   YWdy\zɡAh[W ! YiAҦpG
   -s ! 192.168.100.0/24 ܤ\ 192.168.100.0/24 ʥ]ӷF

-d ؼ IP/GP -s AuLo̫OؼЪ IP κC

-j G᭱ʧ@ADnʧ@ (ACCEPT)B (DROP) ΰO (LOG)

dҤ@GҦӦ lo oӤʥ]AH
[root@linux ~]# iptables -A INPUT -i lo -j ACCEPT
# JӬݤWèSCX -s, -d WhAoܡG׫ʥ]ӦۦBΥh̡A
# unOӦ lo oӤANHIo[nANO
#yS]wWwAhܸӳWwzNIҦpoӮרҷA
#  -s, -d...ѼƨSWw

dҤGGؼШӦ 192.168.0.1 o IP ʥ]H
[root@linux ~]# iptables -A INPUT -i eth0 -s 192.168.0.1 -j ACCEPT
# ޤʥ]榡AunӦ 192.168.0.1 NHC

dҤTGؼШӦ 192.168.1.0/24 iA 192.168.1.10 
[root@linux ~]# iptables -A INPUT -i eth0 -s 192.168.1.10 -j DROP
[root@linux ~]# iptables -A INPUT -i eth0 -s 192.168.1.0/24 -j ACCEPT
# WzoӽdҫܭnڡI]IYIn 192.168.1.10 ~౵ӺC

[root@linux ~]# iptables -L -n
Chain INPUT (policy DROP)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  192.168.0.1          0.0.0.0/0
DROP       all  --  192.168.1.10         0.0.0.0/0
ACCEPT     all  --  192.168.1.0/24       0.0.0.0/0
# @I𫍧]wbo̤wgͮoI

[root@linux ~]# iptables -A INPUT -s 192.168.2.200 -j LOG
[root@linux ~]# iptables -L -n
target prot opt source         destination
LOG    all  --  192.168.2.200  0.0.0.0/0   LOG flags 0 level 4

[root@linux ~]# iptables [-AI ] [-io ] [-p tcp,udp] \
> [-s ӷIP/] [--sport fd] \
> [-d ؼIP/] [--dport fd] -j [ACCEPT|DROP]
ѼơG
--sport fdGӷfXAfXiHOs򪺡AҦp 1024:65535
--dport fdGؼЪfXC

dҤ@GQnsuiJ port 21 ʥ]ױG
[root@linux ~]# iptables -A INPUT -i eth0 -p tcp --dport 21 -j DROP

dҤGGQsڳoD (upd port 137,138 tcp port 139,445) N
[root@linux ~]# iptables -A INPUT -i eth0 -p udp --dport 137:138 -j ACCEPT
[root@linux ~]# iptables -A INPUT -i eth0 -p tcp --dport 139 -j ACCEPT
[root@linux ~]# iptables -A INPUT -i eth0 -p tcp --dport 445 -j ACCEPT

[root@linux ~]# iptables -A INPUT -i eth0 -p tcp -s 192.168.1.0/24 \
> --sport 1024:65534 --dport ssh -j DROP

[root@linux ~]# iptables -A INPUT -i eth0 --dport 21 -j DROP
iptables v1.2.11: Unknown arg `--dport'
Try `iptables -h' or 'iptables --help' for more information.

dҡGNӦۥaӷ port 1:1023 Dʳsu쥻ݪ 1:1023 su
[root@linux ~]# iptables -A INPUT -i eth0 -p tcp --sport 1:1023 \
> --dport 1:1023 --syn -j DROP

[root@linux ~]# iptables -A INPUT -m state --state A
ѼơG
-m G@ iptables ҲաADn`G
     state GAҲ
     mac   Gdw} (hardware address)
--state G@ǫʥ]AADnG
     INVALID    GLĪʥ]AҦpƯ}lʥ]A
     ESTABLISHEDGwgsu\suAF
     NEW        GQnsإ߳suʥ]AF
     RELATED    Goӳ̱`ΡIܳoӫʥ]OPڭ̥DoeXhʥ]

dҡGunwإߩάʥ]NHqLAunOXkʥ]N
[root@linux ~]# iptables -A INPUT -m state \
> --state RELATED,ESTABLISHED -j ACCEPT
[root@linux ~]# iptables -A INPUT -m state --state INVALID -j DROP

#!/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin; export PATH
iptables -F
iptables -X
iptables -Z
iptables -P   INPUT DROP
iptables -P  OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A INPUT -i eth0 -s 192.168.1.0/24 -j ACCEPT

dҤ@Gwϰ aa:bb:cc:dd:ee:ff D}su
[root@linux ~]# iptables -A INPUT -m mac --mac-source aa:bb:cc:dd:ee:ff \
>  -j ACCEPT
ѼơG
--mac-source GNOӷD MAC աI

[root@linux ~]# iptables -A INPUT -p icmp --icmp-type  -j ACCEPT
ѼơG
--icmp-type G᭱n ICMP ʥ]A]iHϥΥNA
              Ҧp 8  N echo request NC

dҡG 0,3,4,11,12,14,16,18  ICMP type iHiJG
[root@linux ~]# vi somefile
#!/bin/bash
icmp_type="0 3 4 11 12 14 16 18"
for typeicmp in $icmp_type
do
   iptables -A INPUT -i eth0 -p icmp --icmp-type $typeicmp -j ACCEPT
done

[root@linux ~]# sh  somefile

[root@linux ~]# echo "1" > /proc/sys/net/ipv4/tcp_syncookies

[root@linux ~]# echo "1" >  \
> /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts

[root@linux ~]# vi somefile
for i in /proc/sys/net/ipv4/conf/*/rp_filter; do
    echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/log_martians; do
    echo "1" > $i
done
for i in /proc/sys/net/ipv4/conf/*/accept_source_route; do
    echo "0" > $i
done
for i in /proc/sys/net/ipv4/conf/*/accept_redirects; do
    echo "0" > $i
done
for i in /proc/sys/net/ipv4/conf/*/send_redirects; do
    echo "0" > $i
done

[root@linux ~]# sh somefile