iptables

iptables-save > conf                    # 持久化配置
iptables-restore < conf                 # 恢复配置

iptables -L -n --line-number       # 查看规则
iptables -L -n                     # 查看规则
iptables -t nat -nL                # 查看转发表规则

iptables -D INPUT 6                     # 删除规则

iptables -I INPUT -p tcp --dport 17105 -j DROP      # 拒绝
iptables -I INPUT -p tcp --dport 8080 -j ACCEPT     # 允许

# 多端口
iptables -I INPUT -p tcp -m multiport --destination-ports 2022,20022 -s 10.1.136.43 -j ACCEPT -m comment --comment 'local network'


# 允许单个IP
iptables -I INPUT -p tcp --dport 9092 -s 10.24.10.100 -j ACCEPT -m comment --comment 'log app'

# IP范围
iptables -A INPUT -p tcp --dport 22 -m iprange --src-range 10.255.246.53-10.255.246.57 -j ACCEPT -m comment --comment 'ssh manager'

# 允许网段
iptables -I INPUT -p tcp --dport 9092 -s 10.24.10.0/24 -j ACCEPT -m comment --comment 'log app'

# 记录日志
iptables  -I cali-tw-cali03efd0d9a4d -s 10.20.4.241 -j LOG --log-prefix "test-2"
iptables  -D cali-tw-cali03efd0d9a4d -s 10.20.4.241 -j LOG --log-prefix "test-2"

# 拒绝某IP
iptables -t mangle -I PREROUTING -s 114.254.171.148 -j DROP
iptables -t raw -I PREROUTING -p tcp -m tcp --dport 80 -j DROP

iptables -t mangle -I PREROUTING -D 1

cat /etc/sysconfig/iptables

sysctl -a | grep ip_conntrack_max
cat /proc/sys/net/ipv4/netfilter/ip_conntrack_count

wc -l /proc/net/ip_conntrack

awk '{print $3}' /proc/net/ip_conntrack | sort -n | head

echo 'net.ipv4.ip_conntrack_max = 1024000' >> /etc/sysctl.conf
echo 'net.ipv4.netfilter.ip_conntrack_max = 1024000' >> /etc/sysctl.conf

sysctl -p

cat /etc/sysconfig/iptables

sysctl -a | grep net.nf_conntrack_max
wc -l /proc/net/nf_conntrack
cat /proc/sys/net/netfilter/nf_conntrack_count

echo 'net.nf_conntrack_max = 1024000' >>  /etc/sysctl.conf
echo 'net.netfilter.nf_conntrack_max = 1024000' >> /etc/sysctl.conf

sysctl -p

# 80 端口转 8080
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to:8088

sysctl -w net.ipv4.ip_forward=1

# 清空nat表
iptables -F -t nat