IPTABLES(8) iptables 1.8.10 IPTABLES(8) iptables/ip6tables - NAT (Network Address Translation - ) IPv4/IPv6 iptables [-t table] {-A|-C|-D|-V} chain rule-specification ip6tables [-t table] {-A|-C|-D|-V} chain rule-specification iptables [-t table] -I chain [rulenum] rule-specification iptables [-t table] -R chain rulenum rule-specification iptables [-t table] -D chain rulenum iptables [-t table] -S [chain [rulenum]] iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [...] iptables [-t table] -N chain iptables [-t table] -X [chain] iptables [-t table] -P chain target iptables [-t table] -E old-chain-name new-chain-name rule-specification = [matches...] [target] match = -m matchname [per-match-options] target = -j targetname [per-target-options] Iptables ip6tables , IPv4 IPv6 Linux. . , , . , , . , , . "target" (""); , . () . , ; , , , , iptables-extensions(8) ACCEPT , DROP RETURN. ACCEPT - . DROP - . RETURN - () . RETURN, , , . ( , , ). -t, --table table , . , , . : filter: ( -t ). INPUT ( , ), FORWARD ( , ) OUTPUT ( , ). nat: . : PREROUTING ( ), INPUT ( , ), OUTPUT ( , ) POSTROUTING ( ). NAT IPv6 3.7. mangle: . 2.4.17 : PREROUTING ( ) OUTPUT ( ). 2.4.18, : INPUT ( , ), FORWARD ( , ) POSTROUTING ( , ). raw: , , ; NOTRACK. , , ip_conntrack IP. : PREROUTING ( , ) OUTPUT ( , ). security: (MAC), .. SECMARK CONNSECMARK. SELinux. security filter, (DAC) filter MAC. : INPUT ( , ), OUTPUT ( , , ) FORWARD ( , ). , iptables ip6tables . . , . , iptables . -A, --append chain rule-specification . / , . -C, --check chain rule-specification , . , -D, , iptables, . -D, --delete chain rule-specification -D, --delete chain rulenum . : ( 1 ) . -I, --insert chain [rulenum] rule-specification . , 1, . , . -R, --replace chain rulenum rule-specification . / , . , 1. -L, --list [chain] . , . iptables, ( filter), NAT nat iptables -t nat -n -L , , -n, DNS. -Z (), , . . , iptables -L -v iptables-save(8). -S, --list-rules [chain] . , , iptables-save, . iptables, ( filter). -F, --flush [chain] ( , ). . -Z, --zero [chain [rulenum]] , . -L, --list (), . (. .) -N, --new-chain chain . () . -X, --delete-chain [chain] . . , , . , .. . , . iptables-nft. -P, --policy chain target ( ) ( ) . ACCEPT, DROP. -E, --rename-chain old-chain new-chain . ; . -h ( ) . ( add, delete, insert, replace append). -4, --ipv4 iptables iptables-restore. , -4, ( ) ip6tables-restore, . . IPv4 IPv6 iptables-restore, ip6tables-restore. -6, --ipv6 , -6, ( ) iptables-restore, . . IPv4 IPv6 iptables-restore, ip6tables-restore. ip6tables ip6tables-restore. [!] -p, --protocol protocol . tcp, udp, udplite, icmp, icmpv6, esp, ah, sctp, mh "all" , . /etc/protocols. "!" . all. "all" .. , . , ip6tables IPv6, esp, . esp ipv6-nonext 2.6.11 . all, , 0. HBH, , -p 0; -m hbh. [!] -s, --source address[/mask][,...] . Address , , IP- ( /mask), IP-. () , . , , , DNS, - . mask ipv4 ( iptables), , 1 . , iptables, 24, 255.255.255.0. "!" . --src . , expand to multiple rules ( -A) ( -D). [!] -d, --destination address[/mask][,...] . -s (source) . --dst . -m, --match match , .. , . , . , " ", .. false, . -j, --jump target , .. , . ( , ), , , ( MATCH AND TARGET EXTENSIONS). ( -g ), , .. -g, --goto chain , . --jump, RETURN , , --jump. [!] -i, --in-interface name , ( , INPUT, FORWARD PREROUTING). "!" , . "+", , . , . [!] -o, --out-interface name , ( , FORWARD, OUTPUT POSTROUTING). "!", . "+", , . , . [!] -f, --fragment , IPv4. ( ICMP), , . "!" "-f", . IPv4, ip6tables. -c, --set-counters packets bytes ( INSERT, APPEND, REPLACE). : -v, --verbose . list , ( ) TOS. "K", "M" "G" 1000, 1 000 000 1 000 000 000 000, ( , -x). , , . -v , , , : , iptables-legacy libiptc, iptables-nft netlink ( ). , iptables-nft netlink, . -V, --version API . -w, --wait [seconds] xtables. , . , . ( seconds), . -n, --numeric . IP- . , ( ). -x, --exact , K ( 1000), Ms ( 1000K) G ( 1000M). -L. --line-numbers , . --modprobe=command command (, ..). iptables /run/xtables.lock . XTABLES_LOCKFILE . iptables . iptables-extensions(8). . 0. , , -, , , 2. , , , 3. , , , , 4. , , 1. ? ? ;-) , , https://bugzilla.netfilter.org / iptables 111, , setuid root. iptables , ( , ), , . IPCHAINS iptables ipchains, . , INPUT OUTPUT , , . , ( , INPUT, OUTPUT); . , -i ; -o , FORWARD. NAT; iptables "filter" . , , - , . , -: -j MASQ -M -S -M -L iptables . iptables-apply(8), iptables-save(8), iptables-restore(8), iptables-extensions(8), "The packet-filtering-HOWTO" iptables , "The NAT-HOWTO" , "The netfilter-extensions-HOWTO" , , "The netfilter-hacking-HOWTO" . https://www.netfilter.org/. iptables, . ipnatctl, iptables, "mangle", , , . TOS . REJECT. ULOG NFQUEUE, libiptc, TTL, DSCP, ECN. "Netfilter" : , , , . : , , , , . , . iptables/ip6tables 1.8.10. () Aleksandr Felda ; GNU (GNU General Public License - GPL, 3 ) , - . - , , () () () <>. iptables 1.8.10 IPTABLES(8)