Cyclades AlterPath ACS, Справочник по командам

Страница: 138 / 420

122
Network
for the filter table:
•
INPUT - For packets coming into the box itself.
•
FORWARD - For packets being routed through the box.
•
OUTPUT - For locally-generated packets.
for the nat table:
•
PREROUTING - For altering packets as soon as they come in.
•
OUTPUT - For altering locally-generated packets as soon as they come in.
•
POSTROUTING - For altering packets as they are about to go out.
Rule
Each chain has a sequence of rules. These rules contain:
•
How the packet should appear in order to match the rule -> Some information
about the packet is checked according to the rule, for example, the IP header, the
input and output interfaces, the TCP flags and the protocol.
•
What to do when the packet matches the rule -> The packet can be accepted,
blocked, logged or jumped to a user-defined chain. For the nat table, the packet can
also have its source IP address and source port altered (for the POSTROUTING
chain) or have the destination IP address and destination port altered (for the
PREROUTING and OUTPUT chain).
When a chain is analyzed, the rules of this chain are reviewed one-by-one until the
packet matches one rule. If no rule is found, the default action for that chain will be
taken.
Syntax
An iptables tutorial is beyond the scope of this manual. For more information on
iptables, see the iptables man page (not included with the ACS) or the how-to:
http://www.netfilter.org or http://www.iptables.org
The syntax of the iptables command is:
# iptables -command chain rule-specification [-t table] [options]
# iptables -E old-chain-name new-chain-name
where:
•
table - Can be filter or nat. If the option -t is not specified, the filter table will be
assumed.