设置iptables重新路由端口后，如何撤消该端口？

13

我已经在许多站点上阅读了如何使用iptables在Linux中将一个端口重新路由到另一个端口。例如，将端口80重新路由到8080看起来像这样...

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080

我担心的是，如果我改变主意怎么办？我还没有读过任何提供纠正它语法的内容。我以为有一种（简单的？）方法，但是我在Linux上太新了，无法直观地弄清楚如何在不重新安装OS的情况下将端口80恢复为其原始行为。

linux iptables

— Syndog
source

6

您可以使用-D选项iptables从链中删除规则。例如

首先列出您要从中删除规则的链，使用--line-numbers

sudo iptables -L RH-Firewall-1-INPUT  -n --line-numbers

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
2    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
3    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
4    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
5    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
6    ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353
7    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631
8    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631
9    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
10   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
11   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

删除第6行

sudo iptables -D RH-Firewall-1-INPUT 6
sudo iptables -L RH-Firewall-1-INPUT  -n --line-numbers

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
2    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
3    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
4    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
5    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
6    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631
8    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
10   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

如果你有保存在一个文件你的iptables配置不会忘记更新文件（iptables-save，service iptables save等等）

— 3转
source

23

如果要编写脚本，则按定义更容易删除：

例：

加上：

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080

注意-A吗？这意味着添加。

去除：

iptables -t nat -D PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080

注意-D吗？这意味着删除。

— 破坏
source

这非常有用！

— MadPhysicist

3

http://linux.die.net/man/8/iptables：

hem

iptables -L, --list [chain]
    List all rules in the selected chain. If no chain is selected, all chains are listed. As every other iptables command, it applies to the specified table (filter is the default), so NAT rules get listed by

    iptables -t nat -n -L

    Please note that it is often used with the -n option, in order to avoid long reverse DNS lookups. It is legal to specify the -Z (zero) option as well, in which case the chain(s) will be atomically listed and zeroed. The exact output is affected by the other arguments given. The exact rules are suppressed until you use

    iptables -L -v

...

iptables -D, --delete chain rule-specification
iptables -D, --delete chain rulenum
    Delete one or more rules from the selected chain. There are two versions of this command: the rule can be specified as a number in the chain (starting at 1 for the first rule) or a rule to match.

— 你好71
source

0

破坏行为的答案是正确的。由于我仍然没有足够的意见对此发表评论，因此我添加了其他信息作为新答案：

添加新的重新路由规则

$ sudo iptables -t nat -D PREROUTING -p tcp --dport 443 -j REDIRECT --to 5671

列出NAT规则

$ sudo iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         
REDIRECT   tcp  --  anywhere             anywhere             tcp dpt:https redir ports 5671

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

该-t nat交换机对于路由规则是必不可少的。

删除规则

$ sudo iptables -t nat -D PREROUTING -p tcp --dport 443 -j REDIRECT --to 5671
[ec2-user@ip-172-31-27-46 ~]$ sudo iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         

Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

— 威宝
source