iptables 관련

• 규칙 추가 (-A)
• 규칙 삽입 (-I)
• 규칙 교환 (-R)
• 규칙 제거 (-D) 
  

• 127.0.0.1 은 'loopback' 인터페이스
• 테스트에 유용

byoungguk@linuxtip:~$ ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.040 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.040/0.040/0.040/0.000 ms

[root@localhost ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

• ping 막기

[root@localhost ~]# iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP
[root@localhost ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       icmp --  127.0.0.1            0.0.0.0/0          

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
[root@localhost ~]# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 0 received, 100% packet loss, time 0ms

• 규칙 제거

[root@localhost ~]# iptables -D INPUT 1
[root@localhost ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

[root@localhost ~]# iptables -D INPUT -s 127.0.0.1 -p icmp -j DROP
[root@localhost ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

• 옵션

'-s', '--source', '--src'
'-d', '--destination', '--dst'
'-s ! localhost' => localhost 로 부터 오는 패킷 아닌 경우
'-p ! TCP'
'-i'('--in-interface')와 '-o'('--out-interface')

• 체인 생성

[root@localhost ~]# iptables -N byoungguk
[root@localhost ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain byoungguk (0 references)
target     prot opt source               destination

• 체인 삭제

[root@localhost ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination 

• 체인 세부 내용 비우기

[root@localhost ~]# iptables -F FORWARD

• 모든 체인 내용 비우기

[root@localhost ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       icmp --  127.0.0.1            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DROP       icmp --  127.0.0.1            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       icmp --  127.0.0.1            0.0.0.0/0           
[root@localhost ~]# iptables -F
[root@localhost ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination