• -t filter|nat|mangle 指定 table。默认 filter。
  • ACCEPT, REJECT, DROP are terminating targets. They terminate processing of the packet in the current Netfilter hook. MARK, LOG and many others are non-terminating targets. They create some action based on the packet, and then proceed to the next rule.


# create new custom chain
iptables -t mangle -N DIVERT

# flush (清空) 某个 chain
iptables -F INPUT

# allow input
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# port range (inclusive)
iptables -A INPUT -p tcp --dport 6000:7000 -j ACCEPT
# multi port
iptables -A INPUT -p tcp -m multiport --dport 80,443 -j ACCEPT
# match NOT certain ports
iptables -A INPUT -p tcp -m multiport ! --dport 80,443 -j ACCEPT

# 允许本机主动发起的连接的所有(接收的)数据包
iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# 丢弃所有接收的连接状态不合法的包
iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

# vpn server. must also set net.ipv4.ip_forward=1
iptables -t nat -A POSTROUTING -j MASQUERADE
# 或者,限制仅对 src IP 是内网的数据包 MASQUERADE
iptables -t nat -A POSTROUTING -s -j MASQUERADE

# MSS CLAMP to fix all MTU related problems
iptables -t mangle -A POSTROUTING -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

# 对属于某个 ipset 的 dst IP 做策略路由,以 "china" 这个 ipset 为例
iptables -t mangle -A PREROUTING -m set --match-set china dst -j MARK --set-mark 0x1/0x1
iptables -t mangle -A OUTPUT -m set --match-set china dst -j MARK --set-mark 0x1/0x1
ip rule add fwmark 0x1/0x1 lookup main prio 1

# 对 PREROUTING 符合特定 mark 比特位的流量做 DNAT
iptables -t nat -A PREROUTING -m mark --mark 0x1/0x1 -j DNAT --to

# 劫持所有途径本机的udp 53 DNS 流量到本机
# 一般用在路由器上,配合 dnsmasq 使用。
iptables -t nat -A PREROUTING -p udp --dport 53 -j REDIRECT --to-port 53

# 概率匹配。用于做 round robin tcp 负载均衡。通常需要配合(-t nat POSTROUTING) SNAT。
iptables -A PREROUTING -t nat -p tcp -d --dport 27017 -m statistic --mode random --probability 0.33 -j DNAT --to-destination
# 另一种负载均衡方式。every(n) +packet(p). The rule will be evaluated every n packet starting at the packet p.
iptables -A PREROUTING -t nat -p tcp -d --dport 27017 -m statistic --mode nth --every 3 --packet 0 -j DNAT --to-destination



# 修改转发的数据包的TTL
iptables -t mangle -A PREROUTING -i eth0 -j TTL --ttl-set 64


# 添加规则时制定 comment
iptables -m comment --comment "__flag__"

# 移除所有包含某个 comment 的 iptables 规则
iptables-save | grep -v "__flag__" | iptables-restore

DNAT 到 lo 地址

出于安全考虑,内核默认不支持把外部流量 DNAT到本地回环地址,需要设置:

sysctl net.ipv4.conf.all.route_localnet=1

Last update: 2023-02-14 02:53:43 UTC