How To:防火墙规则去重
主要命令
iptables-save| awk ' !x[$0]++ | iptables-restore
演示:
[root@testname ~]# iptables -vL Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 761 47910 ACCEPT all -- any any anywhere anywhere state RELATED,ESTABLISHED 0 0 ACCEPT icmp -- any any anywhere anywhere 282 16920 ACCEPT all -- lo any anywhere anywhere 0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:ssh 16 1852 REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited 0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:rap-listen 0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpts:x11:x11-ssh-offset 0 0 ACCEPT udp -- any any anywhere anywhere state NEW udp dpt:xdmcp 0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpt:50001 0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpts:bmcpatrolagent:csvr-proxy 0 0 ACCEPT tcp -- any any anywhere anywhere state NEW tcp dpts:13700:13800 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 REJECT all -- any any anywhere anywhere reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 938 packets, 74222 bytes) pkts bytes target prot opt in out source destination [root@testname ~]# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 1531 -j ACCEPT [root@testname ~]# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 6000:6010 -j ACCEPT [root@testname ~]# iptables -A INPUT -m state --state NEW -m udp -p udp --dport 177 -j ACCEPT [root@testname ~]# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 50001 -j ACCEPT [root@testname ~]# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 3181:3190 -j ACCEPT [root@testname ~]# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 13700:13800 -j ACCEPT [root@testname ~]# iptables-save # Generated by iptables-save v1.4.7 on Sun Jun 21 19:59:46 2015 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [28:5520] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A INPUT -p tcp -m state --state NEW -m tcp --dport 1531 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 6000:6010 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 177 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 50001 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 3181:3190 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 13700:13800 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 1531 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 6000:6010 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 177 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 50001 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 3181:3190 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 13700:13800 -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Sun Jun 21 19:59:46 2015 [root@testname ~]# iptables-save| awk ' !x[$0]++' | iptables-restore [root@testname ~]# iptables-save # Generated by iptables-save v1.4.7 on Sun Jun 21 20:01:09 2015 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [5:636] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A INPUT -p tcp -m state --state NEW -m tcp --dport 1531 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 6000:6010 -j ACCEPT -A INPUT -p udp -m state --state NEW -m udp --dport 177 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 50001 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 3181:3190 -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 13700:13800 -j ACCEPT -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Sun Jun 21 20:01:09 2015