一旦我将iptable设置为重新路由一个端口，如何撤消它？

Question

我在许多网站上读过如何在Linux中使用iptables将一个端口重新路由到另一个端口。例如，重新路由端口80到8080应该是这样的.

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080

我担心的是，如果我改变主意了呢？我还没有读到给出语法来纠正它的任何地方。我想有一个(简单的？)这样做的方法，但我在Linux太新，无法直观地知道如何恢复端口80的原始行为，而不重新安装操作系统。

Answer 1

您可以使用-D选项iptables从链中删除规则。例如

首先列出要从其中删除规则的链，使用行号。

sudo iptables -L RH-Firewall-1-INPUT  -n --line-numbers

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
2    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
3    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
4    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
5    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
6    ACCEPT     udp  --  0.0.0.0/0            224.0.0.251         udp dpt:5353
7    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631
8    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631
9    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
10   ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
11   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

删除第6行

sudo iptables -D RH-Firewall-1-INPUT 6
sudo iptables -L RH-Firewall-1-INPUT  -n --line-numbers

Chain RH-Firewall-1-INPUT (2 references)
num  target     prot opt source               destination
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
2    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
3    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 255
4    ACCEPT     esp  --  0.0.0.0/0            0.0.0.0/0
5    ACCEPT     ah   --  0.0.0.0/0            0.0.0.0/0
6    ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0           udp dpt:631
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:631
8    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
9    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
10   REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

如果您将iptables配置保存在文件中，请不要忘记更新文件(iptables-save、service iptables save等)。

Answer 2

如果您正在编写脚本，那么从定义上来说更容易删除：

示例：

增加：

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080

注意到-A了吗？意思是加。

移除：

iptables -t nat -D PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080

注意到-D了吗？意思是删除。

Answer 3

http://linux.die.net/man/8/iptables：

嗯哼

iptables -L, --list [chain]
    List all rules in the selected chain. If no chain is selected, all chains are listed. As every other iptables command, it applies to the specified table (filter is the default), so NAT rules get listed by

    iptables -t nat -n -L

    Please note that it is often used with the -n option, in order to avoid long reverse DNS lookups. It is legal to specify the -Z (zero) option as well, in which case the chain(s) will be atomically listed and zeroed. The exact output is affected by the other arguments given. The exact rules are suppressed until you use

    iptables -L -v

...

iptables -D, --delete chain rule-specification
iptables -D, --delete chain rulenum
    Delete one or more rules from the selected chain. There are two versions of this command: the rule can be specified as a number in the chain (starting at 1 for the first rule) or a rule to match.