iptables DROP policy
input and output drop
-A INPUT -p tcp -m tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --dport 22 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -p tcp -m tcp --sport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
raw>mangle>nat>filter
[root@n3 ~]# ip ru add from 172.16.16.2 lookup 9800 [ pref or prio ] 9800
[root@n3 ~]# ip rule show
0: from all lookup local
9800: from 172.16.16.2 lookup 9800
32766: from all lookup main
32767: from all lookup default
