曲径通幽论坛

标题: -L(--line-numbers)/-D --- 列出规则及删除 [打印本页]

作者: beyes 时间: 2012-3-18 09:26
标题: -L(--line-numbers)/-D --- 列出规则及删除
删除规则使用 -D 选项，其语法为：

iptables [-t table] -D chain rulenum

上面 chain 是“链”，即 INPUT, OUTPUT, FORWARD 此类。
rulenum 是规则序号，用在使用 -L 选项时可搭配 --line-number 子项看到。

使用 -L 选项列出所有规则：

# iptables -L
Chain INPUT (policy ACCEPT)
target    prot opt source             destination
ACCEPT    tcp  --  anywhere          m50-134.163.com    tcp dpt:smtp
ACCEPT    tcp  --  anywhere          m50-134.163.com    tcp dpt:smtp
ACCEPT    tcp  --  anywhere          m50-132.163.com    tcp dpt:smtp
ACCEPT    tcp  --  anywhere          m50-133.163.com    tcp dpt:smtp

Chain FORWARD (policy ACCEPT)
target    prot opt source             destination
TCPMSS    tcp  --  172.16.36.0/24    anywhere          tcp flags:FIN,SYN,RST,ACK/SYN TCPMSS set 1356
ACCEPT    tcp  --  anywhere          anywhere          tcp dpt:smtp

Chain OUTPUT (policy ACCEPT)
target    prot opt source             destination
ACCEPT    tcp  --  anywhere          anywhere          tcp dpt:smtp

搭配 --line-numbers 给列出的规则添加编号：

# iptables -L --line-numbers
Chain INPUT (policy ACCEPT)
num  target    prot opt source             destination
1 ACCEPT    tcp  --  anywhere          m50-134.163.com    tcp dpt:smtp
2 ACCEPT    tcp  --  anywhere          m50-134.163.com    tcp dpt:smtp
3 ACCEPT    tcp  --  anywhere          m50-132.163.com    tcp dpt:smtp
4 ACCEPT    tcp  --  anywhere          m50-133.163.com    tcp dpt:smtp

Chain FORWARD (policy ACCEPT)
num  target    prot opt source             destination
1 TCPMSS    tcp  --  172.16.36.0/24    anywhere          tcp flags:FIN,SYN,RST,ACK/SYN TCPMSS set 1356
2 ACCEPT    tcp  --  anywhere          anywhere          tcp dpt:smtp

Chain OUTPUT (policy ACCEPT)
num  target    prot opt source             destination
1 ACCEPT    tcp  --  anywhere          anywhere          tcp dpt:smtp

只列出 INPUT 链的规则：

# iptables -L INPUT --line-numbers
Chain INPUT (policy ACCEPT)
num  target    prot opt source             destination
1 ACCEPT    tcp  --  anywhere          m50-134.163.com    tcp dpt:smtp
2 ACCEPT    tcp  --  anywhere          m50-134.163.com    tcp dpt:smtp
3 ACCEPT    tcp  --  anywhere          m50-132.163.com    tcp dpt:smtp
4 ACCEPT    tcp  --  anywhere          m50-133.163.com    tcp dpt:smtp

使用 -D 选项删除指定的规则：

# iptables -D INPUT 3
# iptables -L INPUT --line-numbers
Chain INPUT (policy ACCEPT)
num  target    prot opt source             destination
1 ACCEPT    tcp  --  anywhere          m50-134.163.com    tcp dpt:smtp
2 ACCEPT    tcp  --  anywhere          m50-134.163.com    tcp dpt:smtp
3 ACCEPT    tcp  --  anywhere          m50-133.163.com    tcp dpt:smtp

欢迎光临曲径通幽论坛 (http://www.groad.net/bbs/)