iptables/ip6tables 手册简译

译文

名称

   iptables/ip6tables — 实现IPv4/IPv6包过滤以及网络地址转换（NAT）的管理员工具

摘要

   iptables [-t table] {-A|-C|-D} chain rule-specificationip6tables [-t table] {-A|-C|-D} chain rule-specificationiptables [-t table] -I chain [rulenum] rule-specificationiptables [-t table] -R chain rulenum rule-specificationiptables [-t table] -D chain rulenumiptables [-t table] -S [chain [rulenum]]iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...]iptables [-t table] -N chainiptables [-t table] -X [chain]iptables [-t table] -P chain targetiptables [-t table] -E old-chain-name new-chain-namerule-specification = [matches...] [target]match = -m matchname [per-match-options]target = -j targetname [per-target-options]

描述

   Iptables和ip6tables是用来通过Linux kernel设置、维护、以及检测IPv4和IPv6数据包过滤规则表的工具。有多种规则表可以被定义，每一张表都包含了一系列内建的链或者用户自定义的链，每一个链都是由一列规则组成，并且匹配一组数据包，每一个规则明确指出了对应匹配的包进行什么操作，这种方式叫做目标选择，是同一张表中用户自定义链上的跳跃转移

目标

   一条防火墙规则指明了对于一个数据包或者目标所应用的规则，如果数据包不匹配，下一条规则将会继续进行匹配，如果数据包匹配了，那么下一条规则将会被选中目标的值所指明，这可能是一个用户自定义的链名称，一个在iptables-extensions(8)中被描述过的目标，或者是特定值ACCEPT、DROP、RETURN中的一个。ACCPET意味着允许数据包通过，DROP意味着将数据包丢弃，RETURN意味着停止这条链的贯穿，然后在当前链的下一条链中重新开始。如果内建链结束了或者说内建链内的一条带有目标RETURN的规则匹配了，这条链所指明的目标的策略决定了这个包的命运。

表
目前有五个各不相关的表(当前或者任意时间使用的表是由内核配置选项和当前运行模块决定的).

   -t, --table table此选项指出了匹配某个表的数据包将被执行什么样的操作，如果内核被配置为自动模块加载且不存在已加载模块，那么内核将会尝试为这张表加载适当的模块各表如下:filter:默认的表(如果没有指明-t选项)，此表包含了内建的链INPUT (对于到达本地套阶层的数据包), FORWARD (对于经过此路由的包), 和OUTPUT  (本地产生的数据包)nat:当一个创建了新的连接的包被遇到的时候，nat表将会被查找。nat表里包含三个内建链PREROUTING (只要包到达就对其进行改变), OUTPUT (在路由之前改变本地数据包), 和POSTROUTING (改变将要发出去的数据包).在kernel 3.7. IPv6 NAT已经被支持了。mangle:这张表是专门进行数据包更改的.直到kernel 2.4.17 mangle表包含两条内建链PREROUTING(在路由之前改变进来的数据包)和OUTPUT (在路由之前改变本地产生的数据包).自kernel 2.4.18起mangle也开始支持了其他的三张表INPUT (对于自己进到盒子里的数据包),  FORWARD (改变将要经过box进行路由的数据包), and POSTROUTING (改变将要出去的数据包).raw:这张表主要是为了配置免连接的追踪很无踪迹目标的结合。他用高优先级来注册网络筛选系统钩子，北称作before ip_conntrack或者其他ip表.raw表提供以下内建链PREROUTING (对于通过任何其他网络接口到达的数据包) OUTPUT (对于本地进程产生的数据包)security:这张表是用来进行强制访问控制（Mandatory Access Control (MAC)）的网络规则, 比如被SECMARK禁用和CONNSECMARK的目标.强制访问控制被linux的安全模块继承了，例如SELinux.安全表被称作后过滤表，它允许过滤表中任何自由访问控制规则（Discretionary Access Control ）DAC在MAC规则之前生效. security表提供了以下的内建链INPUT  (对于自动进入盒子的数据包), OUTPUT (在路由之前改变本地生成的数据包),和FORWARD(改变通过盒子进行路由的数据包).

选项参数

   由iptables和ip6tables表明的选项可以被分成几组。

命令
以下选项指明了将要被执行的操作. 以下选项只能单独在命令行中被指明使用，除非其他被指出的情况。

   -A, --append chain rule-specification在选定的链后添加一个或者多个规则-C, --check chain rule-specification检测一条规则是否匹配此链中指定的规则，或者说检测匹配规则是否存在C-D, --delete chain rule-specification-D, --delete chain rulenum删除一个或者多个从链中指定的规则，可以使用规则号码或者匹配的规则信息-I, --insert chain [rulenum] rule-specification向选定的链中以给定序号向对应位置插入一条或者多条规则。-R, --replace chain rulenum rule-specification替换选定链中的一条规则-L, --list [chain]列出链中的所有规则，如果没有指定链，则所有的链中的规则都将被显示用法：iptables -t nat -n -L用法：iptables -L -v-S, --list-rules [chain]显示所与选中链中的规则，如果未选中具体的链，则所有链的规则将以iptables-save形式打印出来-F, --flush [chain]刷新选中的链或者所有的链（如果未指定具体的链）。此操作等于删除了所有的规则-Z, --zero [chain [rulenum]]将所有链中的数据包归零,或者清零给定的链，或者指定链中的具体规则-N, --new-chain chain用给定的名称创建一条用户自定的链-X, --delete-chain [chain]删除用户自定的链. 要删除的链必须不存在其他参考.-P, --policy chain target对于给定的目标设置链的策略-E, --rename-chain old-chain new-chain用给定的链名称重命名一条旧的链-h     帮助.  给出(当前最简)语法描述.

参数陈列
以下参数明组成了一条规则的设置(例如添加、删除、插入、替换、附加等命令).

   -4, --ipv4此选项对iptables和iptables-restore无效.-6, --ipv6如果一条规则使用了-6参数插入iptables-restore此操作将会被默默忽略，其他的用法会报错[!] -p, --protocol protocol检测规则或者数据包的传输协议.[!] -s, --source address[/mask][,...]指明源，地址可以是网路名称,主机名,网络地址 (with /mask), 或者普通ip[!] -d, --destination address[/mask][,...]指明目的-m, --match match指明一条匹配的规则进行使用-j, --jump target指明规则的目标（下一跳）-g, --goto chain指明进程应该在用户指定的链中继续执行[!] -i, --in-interface name数据包要通过或者接收的接口名称(只有进入INPUT, FORWARD and PREROUTING链的数据包需要指明)[!] -o, --out-interface name指明数据包将要被送往的接口名称-c, --set-counters packets bytes此参数可以使管理员初始化数据包和字节计数(在 INSERT,  APPEND,  REPLACE操作中).

更多选项参数
以下为附加的参数选项以及用法讲解

   -v, --verbose显示操作的详细输出信息  -w, --wait [秒]等待xtables锁，阻止一个程序的多实例同时运行，并且一段时间试图去获得执行锁。默认的，如果不能获取执行锁，程序将会退出。此参数将会使进程等待，一直到获得执行锁-n, --numeric数字化输出，ip地址和端口号将会以数字格式显示出来。默认的，此程序会尝试列出主机名称或者网络名称或者服务名称-x, --exact数字详述.显示具体的数据包值以及字节数,而不是大约的K's(multiples of 1000) M's (multiples of 1000K)G's (multiples of 1000M)，此参数只与-L参数相关--line-numbers在列出规则时为每一行的开头天加一个行号,并且对应着规则在链中的位置--modprobe=command当向一个链中添加或者插入规则时，使用此命令去加载任意所需模块(目标,匹配扩展等).

匹配与目标拓展

   iptables可以使用扩展的数据包匹配和目标模块，可用列表可以查看iptables-extensions(8)

问题诊断

   各种错误将会显示到标准输出.退出码为0表示正确的执行.一般的错误原因是因为无效的或者命令参数的滥用，这些错误将会产生一个错误码2，其他的错误将会产生退出码1

ip链的兼容

   此iptable与Rusty Russell的ipchains非常相似.主要的区别在于链INPUT和OUTPUT是分别由本地生成的数据包和外部进入的数据包的贯穿。所以每一个数据包只通过以下三个链(除了回环阻塞，因为其既包含INPUT也包含OUTPUT链; 在此之前一个向前的数据包将通过所有三个链另一个差别在于 -i代表着输入接口; -o代表着输出接口, 两个参数都可以使数据包进入FORWARD链.不同形式的NAT已经被剔出;当使用默认的`filter'表时， iptables是一个带有扩展选项的完全的包过滤模块.这将明了先前的许多关于ip伪装和包过滤的疑虑，所以下列选项的处理完全不同-j MASQ-M -S-M -L对于iptables还有其他一些不同点，可自寻.

拓展阅读

   iptables-apply(8), iptables-save(8), iptables-restore(8), iptables-extensions(8),如何过滤数据包详细讲述了iptables对于数据包过滤的用法,如何进行NAT详述了NAT,如何进行网络过滤详述了没有在标准中指出的关于此部分内容的扩展网络过滤奇技详述了网络过滤的内部实现，详细文档请浏览http://www.netfilter.org/.

原文：

IPTABLES(8) iptables 1.4.21 IPTABLES(8)

NAME
iptables/ip6tables — administration tool for IPv4/IPv6 packet filtering and NAT

SYNOPSIS

   iptables [-t table] {-A|-C|-D} chain rule-specificationip6tables [-t table] {-A|-C|-D} chain rule-specificationiptables [-t table] -I chain [rulenum] rule-specificationiptables [-t table] -R chain rulenum rule-specificationiptables [-t table] -D chain rulenumiptables [-t table] -S [chain [rulenum]]iptables [-t table] {-F|-L|-Z} [chain [rulenum]] [options...]iptables [-t table] -N chainiptables [-t table] -X [chain]iptables [-t table] -P chain targetiptables [-t table] -E old-chain-name new-chain-namerule-specification = [matches...] [target]match = -m matchname [per-match-options]target = -j targetname [per-target-options]

DESCRIPTION
Iptables and ip6tables are used to set up, maintain, and inspect the tables of IPv4 and IPv6 packet filter rules in the
Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also con‐
tain user-defined chains.

   Each  chain is a list of rules which can match a set of packets.  Each rule specifies what to do with a packet that matches.This is called a `target', which may be a jump to a user-defined chain in the same table.

TARGETS
A firewall rule specifies criteria for a packet and a target. If the packet does not match, the next rule in the chain is
examined; if it does match, then the next rule is specified by the value of the target, which can be the name of a user-
defined chain, one of the targets described in iptables-extensions(8), or one of the special values ACCEPT, DROP or RETURN.

   ACCEPT means to let the packet through.  DROP means to drop the packet on the floor.   RETURN  means  stop  traversing  thischain and resume at the next rule in the previous (calling) chain.  If the end of a built-in chain is reached or a rule in abuilt-in chain with target RETURN is matched, the target specified by the chain policy determines the fate of the packet.

TABLES
There are currently five independent tables (which tables are present at any time depends on the kernel configuration
options and which modules are present).

   -t, --table tableThis  option  specifies  the  packet matching table which the command should operate on.  If the kernel is configuredwith automatic module loading, an attempt will be made to load the appropriate module for that table  if  it  is  notalready there.The tables are as follows:filter:This  is  the  default table (if no -t option is passed). It contains the built-in chains INPUT (for packets des‐tined to local sockets), FORWARD (for packets being routed through the box), and  OUTPUT  (for  locally-generatedpackets).nat:This  table is consulted when a packet that creates a new connection is encountered.  It consists of three built-ins: PREROUTING (for altering packets as soon as they come in), OUTPUT (for  altering  locally-generated  packetsbefore  routing), and POSTROUTING (for altering packets as they are about to go out).  IPv6 NAT support is avail‐able since kernel 3.7.mangle:This table is used for specialized packet alteration.  Until kernel 2.4.17 it had two built-in chains: PREROUTING(for  altering  incoming  packets before routing) and OUTPUT (for altering locally-generated packets before rout‐ing).  Since kernel 2.4.18, three other built-in chains are also supported: INPUT (for packets  coming  into  thebox  itself),  FORWARD (for altering packets being routed through the box), and POSTROUTING (for altering packetsas they are about to go out).raw:This table is used mainly for configuring exemptions from connection tracking in  combination  with  the  NOTRACKtarget.   It registers at the netfilter hooks with higher priority and is thus called before ip_conntrack, or anyother IP tables.  It provides the following built-in chains: PREROUTING (for packets  arriving  via  any  networkinterface) OUTPUT (for packets generated by local processes)security:This  table is used for Mandatory Access Control (MAC) networking rules, such as those enabled by the SECMARK andCONNSECMARK targets.  Mandatory Access Control is implemented by Linux Security Modules  such  as  SELinux.   Thesecurity  table  is  called  after the filter table, allowing any Discretionary Access Control (DAC) rules in thefilter table to take effect before MAC rules.  This table provides the  following  built-in  chains:  INPUT  (forpackets  coming into the box itself), OUTPUT (for altering locally-generated packets before routing), and FORWARD(for altering packets being routed through the box).

OPTIONS
The options that are recognized by iptables and ip6tables can be divided into several different groups.

COMMANDS
These options specify the desired action to perform. Only one of them can be specified on the command line unless otherwise
stated below. For long versions of the command and option names, you need to use only enough letters to ensure that iptables
can differentiate it from all other options.

   -A, --append chain rule-specificationAppend one or more rules to the end of the selected chain.  When the source and/or destination names resolve to  morethan one address, a rule will be added for each possible address combination.-C, --check chain rule-specificationCheck whether a rule matching the specification does exist in the selected chain. This command uses the same logic as-D to find a matching entry, but does not alter the existing iptables configuration and uses its exit code  to  indi‐cate success or failure.-D, --delete chain rule-specification-D, --delete chain rulenumDelete  one or more rules from the selected chain.  There are two versions of this command: the rule can be specifiedas a number in the chain (starting at 1 for the first rule) or a rule to match.-I, --insert chain [rulenum] rule-specificationInsert one or more rules in the selected chain as the given rule number.  So, if the rule number is 1,  the  rule  orrules are inserted at the head of the chain.  This is also the default if no rule number is specified.-R, --replace chain rulenum rule-specificationReplace a rule in the selected chain.  If the source and/or destination names resolve to multiple addresses, the com‐mand will fail.  Rules are numbered starting at 1.-L, --list [chain]List all rules in the selected chain.  If no chain is selected, all chains are listed. Like every other iptables com‐mand, it applies to the specified table (filter is the default), so NAT rules get listed byiptables -t nat -n -LPlease  note  that  it  is often used with the -n option, in order to avoid long reverse DNS lookups.  It is legal tospecify the -Z (zero) option as well, in which case the chain(s) will be atomically listed  and  zeroed.   The  exactoutput is affected by the other arguments given. The exact rules are suppressed until you useiptables -L -v-S, --list-rules [chain]Print  all  rules  in  the  selected chain.  If no chain is selected, all chains are printed like iptables-save. Likeevery other iptables command, it applies to the specified table (filter is the default).-F, --flush [chain]Flush the selected chain (all the chains in the table if none is given).  This is  equivalent  to  deleting  all  therules one by one.-Z, --zero [chain [rulenum]]Zero  the  packet  and byte counters in all chains, or only the given chain, or only the given rule in a chain. It islegal to specify the -L, --list (list) option as well, to see the counters immediately before they are cleared.  (Seeabove.)-N, --new-chain chainCreate a new user-defined chain by the given name.  There must be no target of that name already.-X, --delete-chain [chain]Delete  the optional user-defined chain specified.  There must be no references to the chain.  If there are, you mustdelete or replace the referring rules before the chain can be deleted.  The chain must be empty, i.e. not contain anyrules.  If no argument is given, it will attempt to delete every non-builtin chain in the table.-P, --policy chain targetSet  the  policy  for  the  chain to the given target.  See the section TARGETS for the legal targets.  Only built-in(non-user-defined) chains can have policies, and neither built-in nor user-defined chains can be policy targets.-E, --rename-chain old-chain new-chainRename the user specified chain to the user supplied name.  This is cosmetic, and has no effect on the  structure  ofthe table.-h     Help.  Give a (currently very brief) description of the command syntax.

PARAMETERS
The following parameters make up a rule specification (as used in the add, delete, insert, replace and append commands).

   -4, --ipv4This option has no effect in iptables and iptables-restore.  If a rule using the -4 option is inserted with (and onlywith) ip6tables-restore, it will be silently ignored. Any other uses will throw an error. This option allows  to  putboth IPv4 and IPv6 rules in a single rule file for use with both iptables-restore and ip6tables-restore.-6, --ipv6If  a  rule  using  the -6 option is inserted with (and only with) iptables-restore, it will be silently ignored. Anyother uses will throw an error. This option allows to put both IPv4 and IPv6 rules in a single rule file for use withboth iptables-restore and ip6tables-restore.  This option has no effect in ip6tables and ip6tables-restore.[!] -p, --protocol protocolThe  protocol  of  the rule or of the packet to check.  The specified protocol can be one of tcp, udp, udplite, icmp,icmpv6,esp, ah, sctp, mh or the special keyword "all", or it can be a numeric value, representing one of these proto‐cols  or  a  different one.  A protocol name from /etc/protocols is also allowed.  A "!" argument before the protocolinverts the test.  The number zero is equivalent to all. "all" will match with all protocols and is taken as  defaultwhen  this  option  is omitted.  Note that, in ip6tables, IPv6 extension headers except esp are not allowed.  esp andipv6-nonext can be used with Kernel version 2.6.11 or later.  The number zero is equivalent to all, which means  thatyou  cannot test the protocol field for the value 0 directly. To match on a HBH header, even if it were the last, youcannot use -p 0, but always need -m hbh.[!] -s, --source address[/mask][,...]Source specification. Address can be either a network name, a hostname, a network IP address (with /mask), or a plainIP address. Hostnames will be resolved once only, before the rule is submitted to the kernel.  Please note that spec‐ifying any name to be resolved with a remote query such as DNS is a really bad idea.  The mask can be either an  ipv4network  mask  (for  iptables)  or a plain number, specifying the number of 1's at the left side of the network mask.Thus, an iptables mask of 24 is equivalent to 255.255.255.0.  A "!" argument before the address specification invertsthe  sense of the address. The flag --src is an alias for this option.  Multiple addresses can be specified, but thiswill expand to multiple rules (when adding with -A), or will cause multiple rules to be deleted (with -D).[!] -d, --destination address[/mask][,...]Destination specification.  See the description of the -s (source) flag for a detailed  description  of  the  syntax.The flag --dst is an alias for this option.-m, --match matchSpecifies a match to use, that is, an extension module that tests for a specific property. The set of matches make upthe condition under which a target is invoked. Matches are evaluated first to last as specified on the  command  lineand work in short-circuit fashion, i.e. if one extension yields false, evaluation will stop.-j, --jump targetThis  specifies  the target of the rule; i.e., what to do if the packet matches it.  The target can be a user-definedchain (other than the one this rule is in), one of the special builtin targets which decide the fate  of  the  packetimmediately,  or an extension (see EXTENSIONS below).  If this option is omitted in a rule (and -g is not used), thenmatching the rule will have no effect on the packet's fate, but the counters on the rule will be incremented.-g, --goto chainThis specifies that the processing should continue in a user specified chain. Unlike the --jump  option  return  willnot continue processing in this chain but instead in the chain that called us via --jump.[!] -i, --in-interface nameName  of  an  interface  via which a packet was received (only for packets entering the INPUT, FORWARD and PREROUTINGchains).  When the "!" argument is used before the interface name, the sense is inverted.  If the interface name endsin  a  "+", then any interface which begins with this name will match.  If this option is omitted, any interface namewill match.[!] -o, --out-interface nameName of an interface via which a packet is going to be sent (for packets entering the FORWARD, OUTPUT and POSTROUTINGchains).  When the "!" argument is used before the interface name, the sense is inverted.  If the interface name endsin a "+", then any interface which begins with this name will match.  If this option is omitted, any  interface  namewill match.[!] -f, --fragmentThis  means  that the rule only refers to second and further IPv4 fragments of fragmented packets.  Since there is noway to tell the source or destination ports of such a packet (or ICMP type), such a packet will not match  any  ruleswhich  specify  them.   When  the  "!"  argument  precedes the "-f" flag, the rule will only match head fragments, orunfragmented packets. This option is IPv4 specific, it is not available in ip6tables.-c, --set-counters packets bytesThis enables the administrator to initialize the packet and byte counters of a rule (during INSERT,  APPEND,  REPLACEoperations).

OTHER OPTIONS
The following additional options can be specified:

   -v, --verboseVerbose  output.   This option makes the list command show the interface name, the rule options (if any), and the TOSmasks.  The packet and byte counters are also listed, with the suffix  'K',  'M'  or  'G'  for  1000,  1,000,000  and1,000,000,000  multipliers respectively (but see the -x flag to change this).  For appending, insertion, deletion andreplacement, this causes detailed information on the rule or rules to be printed. -v may be specified multiple  timesto possibly emit more detailed debug statements.-w, --wait [seconds]Wait  for  the xtables lock.  To prevent multiple instances of the program from running concurrently, an attempt willbe made to obtain an exclusive lock at launch.  By default, the program will exit if the  lock  cannot  be  obtained.This  option  will  make  the  program  wait  (indefinitely  or for optional seconds) until the exclusive lock can beobtained.-n, --numericNumeric output.  IP addresses and port numbers will be printed in numeric format.  By default, the program  will  tryto display them as host names, network names, or services (whenever applicable).-x, --exactExpand  numbers.   Display the exact value of the packet and byte counters, instead of only the rounded number in K's(multiples of 1000) M's (multiples of 1000K) or G's (multiples of 1000M).  This option is only relevant  for  the  -Lcommand.--line-numbersWhen  listing  rules,  add  line  numbers to the beginning of each rule, corresponding to that rule's position in thechain.--modprobe=commandWhen adding or inserting rules into a chain, use command to load any necessary modules  (targets,  match  extensions,etc).

MATCH AND TARGET EXTENSIONS
iptables can use extended packet matching and target modules. A list of these is available in the iptables-extensions(8)
manpage.

DIAGNOSTICS
Various error messages are printed to standard error. The exit code is 0 for correct functioning. Errors which appear to
be caused by invalid or abused command line parameters cause an exit code of 2, and other errors cause an exit code of 1.

BUGS
Bugs? What’s this? ;-) Well, you might want to have a look at http://bugzilla.netfilter.org/

COMPATIBILITY WITH IPCHAINS
This iptables is very similar to ipchains by Rusty Russell. The main difference is that the chains INPUT and OUTPUT are
only traversed for packets coming into the local host and originating from the local host respectively. Hence every packet
only passes through one of the three chains (except loopback traffic, which involves both INPUT and OUTPUT chains); previ‐
ously a forwarded packet would pass through all three.

   The other main difference is that -i refers to the input interface; -o refers to the output interface, and both  are  avail‐able for packets entering the FORWARD chain.The  various  forms  of NAT have been separated out; iptables is a pure packet filter when using the default `filter' table,with optional extension modules.  This should simplify much of the previous confusion over the combination of IP  masquerad‐ing and packet filtering seen previously.  So the following options are handled differently:-j MASQ-M -S-M -LThere are several other changes in iptables.

SEE ALSO
iptables-apply(8), iptables-save(8), iptables-restore(8), iptables-extensions(8),

   The packet-filtering-HOWTO details iptables usage for packet filtering, the NAT-HOWTO details NAT, the netfilter-extensions-HOWTO details the extensions that are not in the standard distribution, and the netfilter-hacking-HOWTO details the  netfil‐ter internals.See http://www.netfilter.org/.

AUTHORS
Rusty Russell originally wrote iptables, in early consultation with Michael Neuling.

   Marc  Boucher  made  Rusty abandon ipnatctl by lobbying for a generic packet selection framework in iptables, then wrote themangle table, the owner match, the mark stuff, and ran around doing cool stuff everywhere.James Morris wrote the TOS target, and tos match.Jozsef Kadlecsik wrote the REJECT target.Harald Welte wrote the ULOG and NFQUEUE target, the new libiptc, as well as the TTL, DSCP, ECN matches and targets.The Netfilter Core Team is: Marc Boucher, Martin Josefsson, Yasuyuki Kozakai, Jozsef Kadlecsik, Patrick McHardy, James  Mor‐ris, Pablo Neira Ayuso, Harald Welte and Rusty Russell.Man page originally written by Herve Eychenne <rv@wallfire.org>.

VERSION
This manual page applies to iptables/ip6tables @PACKAGE_AND_VERSION@.

iptables 1.4.21 IPTABLES(8)

iptables/ip6tables 手册简译相关推荐

mysql+last_query_cost_辛星简译MySQL中的last_query_cost_MySQL
我们都知道在MySQL中可以通过show status like 'last_query_cost' 来查看查上一个查询的代价,而且它是io_cost和cpu_cost的开销总和,它通常也是我们评价一 ...
用python汇总pdf文件_Python处理PDF文件-简译与总结
最近看到一篇介绍Python中pyPDF模块的文章,详细介绍了使用pyPDF模块获取PDF文件信息,合并拆分PDF文件等功能.很方便,在此搬运分享以下: 全文介绍了以下几方面的功能提取文件信息旋转 ...
Xen为什么一定要进入内核 —— [简译] KVM is Linux, Xen is not
Xen为什么一定要进入内核这个问题我问了一位名为笑遍世界的博主,这位博主在写一本名为<KVM虚拟化原理与实践>的书,在他的博客上连载了书里面的部分章节,目前我在网上能找到最好的中文资料就 ...
【简译】关于依赖反转原则、控制反转和依赖注入的抽象的初学者指南
原文在此. ======================================分割线==================================== 介绍文章以介绍依赖反转原则开始 ...
mysql+last_query_cost_辛星简译MySQL中的last_query_cost
我们都知道在MySQL中可以通过show status like 'last_query_cost' 来查看查上一个查询的代价,而且它是io_cost和cpu_cost的开销总和,它通常也是我 ...
ALE重新授权，简译笔记
ALE Reauthorization(重新授权记为Reauth) 在WFP的Application Layer Enforcement(ALE)层的网络流量是用ALE flows来过滤的.一旦一个 ...
python不可以处理pdf文件_Python处理PDF文件-简译与总结
最近看到一篇介绍Python中pyPDF模块的文章,详细介绍了使用pyPDF模块获取PDF文件信息,合并拆分PDF文件等功能.很方便,在此搬运分享以下: 全文介绍了以下几方面的功能提取文件信息旋转 ...
iptables知识点总结
文章目录一.参考链接和本次实验地址 1.1.参考链接 1.2.单机实验环境 1.3.非单机实验环境(主要是演示NAT实验) 二.防火墙概述和linux防火墙概述 2.1.防火墙概念引入和不同防火墙类 ...
iptables之snat
看内核snat部分,有如下几个标志位,有点混淆,所以看下下发规则命令行iptables是如何指定的. #define NF_NAT_RANGE_MAP_IPS (1 << 0) #defi ...
linux平台下防火墙iptables原理(转)
原文地址:http://www.cnblogs.com/ggjucheng/archive/2012/08/19/2646466.html iptables简介 netfilter/iptables( ...

iptables/ip6tables 手册简译

译文

原文：

iptables/ip6tables 手册简译相关推荐

最新文章

热门文章