iptables -S일련의 규칙을 인쇄하지만 iptables-save여러 추가 규칙이 포함된 상위 집합을 인쇄합니다. 차이점은 무엇입니까? iptables -S추가 규칙이 인쇄 되지 않는 이유는 무엇입니까 ?
예를 들어 Wireguard 인터페이스(wg0)( ) iptables -S에서 SMTP(포트 25) 패킷의 소스 주소를 변경하는 규칙을 인쇄하지 않고 규칙을 인쇄합니까? 체인을 인쇄하는 것이 가능할 것 같지만 다음과 같이 말합니다.-A POSTROUTING -o wg0 -j SNAT --to-source 10.0.0.2iptables-saveiptables -Siptables -h
--list-rules -S [chain [rulenum]]
Print the rules in a chain or all chains
...체인 인수가 제공되지 않으면 모든 체인을 인쇄한다는 의미인 것 같습니다.
# Generated by iptables-save v1.8.4 on Sat Jan 30 06:47:36 2021
*mangle
:PREROUTING ACCEPT [175762948:152635787911]
:INPUT ACCEPT [85129338:67722036020]
:FORWARD ACCEPT [90631707:84913651708]
:OUTPUT ACCEPT [43631301:2479371699]
:POSTROUTING ACCEPT [134263118:87393032790]
-A OUTPUT -p tcp -m tcp --dport 465 -j MARK --set-xmark 0x2/0xffffffff
-A OUTPUT -p tcp -m tcp --dport 25 -j MARK --set-xmark 0x2/0xffffffff
COMMIT
# Completed on Sat Jan 30 06:47:36 2021
# Generated by iptables-save v1.8.4 on Sat Jan 30 06:47:36 2021
*filter
:INPUT ACCEPT [367:62684]
:FORWARD ACCEPT [10426:4247532]
:OUTPUT ACCEPT [50809:2739507]
:f2b-sshd - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -i lo -j ACCEPT
-A INPUT -i enp2s0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i enp2s0 -j DROP
-A FORWARD -i enxa0cec802c711 -o enp2s0 -j DROP
-A f2b-sshd -s 200.140.81.94/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 177.92.35.201/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 94.43.219.173/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 14.228.195.50/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 66.96.232.50/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 71.217.140.138/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 14.249.54.134/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 201.209.161.174/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 174.30.109.183/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 71.217.167.42/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 116.193.139.76/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 41.89.234.2/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 182.71.223.194/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 173.202.19.15/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 180.112.138.132/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN
COMMIT
# Completed on Sat Jan 30 06:47:36 2021
# Generated by iptables-save v1.8.4 on Sat Jan 30 06:47:36 2021
*nat
:PREROUTING ACCEPT [444244:60896263]
:INPUT ACCEPT [168098:15673985]
:OUTPUT ACCEPT [120570:8875499]
:POSTROUTING ACCEPT [113904:8359713]
-A POSTROUTING -o enp2s0 -j MASQUERADE
-A POSTROUTING -o wg0 -j SNAT --to-source 10.0.0.2
COMMIT
# Completed on Sat Jan 30 06:47:36 2021
그리고
iptables v1.8.4 (legacy): option "-s" requires an argument
Try `iptables -h' or 'iptables --help' for more information.
root@sputnik:/home/nathan# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -i lo -j ACCEPT
-A INPUT -i enp2s0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i enp2s0 -j DROP
-A FORWARD -i enxa0cec802c711 -o enp2s0 -j DROP
-A f2b-sshd -s 200.140.81.94/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 177.92.35.201/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 94.43.219.173/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 14.228.195.50/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 66.96.232.50/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 71.217.140.138/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 14.249.54.134/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 201.209.161.174/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 174.30.109.183/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 71.217.167.42/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 116.193.139.76/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 41.89.234.2/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 182.71.223.194/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 173.202.19.15/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 180.112.138.132/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN
답변1
RTFM(세밀한 매뉴얼 읽기):
man iptables:
-S, --list-rules [chain] 선택한 체인의 모든 규칙을 인쇄합니다. 체인을 선택하지 않으면 모든 체인이 iptables-save처럼 인쇄됩니다. 다른 모든 iptables 명령과 마찬가지로 지정된 테이블에 적용됩니다(기본값은 필터입니다). :
그래서 요점은 출력이 다음으로 제한된다는 것 같습니다.필터테이블.
하지만iptable-저장클래식 구성 파일에 적합한 형식으로 전체 규칙 세트를 덤프합니다.
man iptable-save
-t, --table tablename
restrict output to only one table. If the kernel is configured
with automatic module loading, an attempt will be made to load
the appropriate module for that table if it is not already
there.
If not specified, output includes all available tables.
참고하세요사용 가능한 모든 테이블여기에서는 기본 설정으로 사용됩니다.
CentOS 7에서 이것을 확인했습니다.