Linux：iptables 常用命令
主機環境：
[root@test1280 ~]# cat /etc/redhat-release
CentOS release 6.8 (Final)
[root@test1280 ~]# uname -a
Linux test1280 2.6.32-642.el6.x86_64 #1 SMP Tue May 10 17:27:01 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
開放主機指定端口（以8080爲例）：
方法一：修改配置文件（/etc/sysconfig/iptables）
修改前：
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
修改後：
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
即：添加一行：
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
然後執行命令使進程重載配置生效：
[root@test1280 ~]# service iptables reload
iptables: Trying to reload firewall rules: [ OK ]
方法二：通過命令直接添加規則
執行命令：
[root@test1280 ~]# iptables -I INPUT -p tcp --dport 8080 -j ACCEPT
執行前狀態：
[root@test1280 ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
執行後狀態：
[root@test1280 ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080
2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
3 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
6 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
可以看到新增一行：
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080
注意，以方法二新增的規則是存在於iptables進程內存中未持久化的。
如果需要持久化配置，需要執行：
[root@test1280 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
iptables是一個二進制可執行程序：
/sbin/iptables
[root@test1280 ~]# which iptables
/sbin/iptables
[root@test1280 ~]# file `which iptables`
/sbin/iptables: symbolic link to `/etc/alternatives/iptables.x86_64'
[root@test1280 ~]# file -L `which iptables`
/sbin/iptables: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, stripped
同時，有一個同名的shell腳本，也叫做iptables：
/etc/init.d/iptables
[root@test1280 ~]# file /etc/init.d/iptables
/etc/init.d/iptables: POSIX shell script text executable
1.查看狀態：service iptables status
[root@test1280 ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
2.宕停服務：service iptables stop
[root@test1280 ~]# service iptables stop
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
3.啓動服務：service iptables start
[root@test1280 ~]# service iptables start
iptables: Applying firewall rules: [ OK ]
3.重啓服務：service iptables restart
[root@test1280 ~]# service iptables restart
iptables: Setting chains to policy ACCEPT: filter [ OK ]
iptables: Flushing firewall rules: [ OK ]
iptables: Unloading modules: [ OK ]
iptables: Applying firewall rules: [ OK ]
4.重載配置：service iptables reload
[root@test1280 ~]# service iptables reload
iptables: Trying to reload firewall rules: [ OK ]
我們修改iptables配置文件 /etc/sysconfig/iptables 後，iptables 進程不會自動刷新配置。
此時，需要重啓（restart） iptables 或者 通知 iptables 動態重載（reload）配置。
5.保存配置：service iptables save
[root@test1280 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
我們通過 iptables 運行時修改的規則都是存在於進程內存空間，當我們重啓進程（服務），原先設置的配置將丟失。
如果要持久化 iptables 進程規則到配置文件，可以執行此命令。
通常，配置文件將被持久化到 /etc/sysconfig/iptables。
6.其他命令：
[root@test1280 ~]# service iptables
Usage: iptables {start|stop|reload|restart|condrestart|status|panic|save}
具體的實現可以查看 /etc/init.d/iptables 腳本。
在非root下查看iptables status，將會輸出：
[test1280@test1280 ~]$ service iptables status
iptables: Only usable by root. [WARNING]
參考：
1.https://www.cnblogs.com/pangguoming/p/5956151.html