about iptables

Ser Olmy · 01-29-2014, 02:34 AM

If you've run iptables -A INPUT -j DROP, you've added a rule, not altered the chain policy.

To remove a single rule, you must know its number in the chain. The command iptables -L INPUT --line-numbers will produce a numbered list of the rules in the INPUT chain.

Once you know the number, you can delete the rule with iptables -D INPUT <number>. Replace <number> with the relevant number as shown in the list.

byran cheung · 02-06-2014, 07:57 PM

Quote:

Originally Posted by Ser Olmy

If you've run iptables -A INPUT -j DROP, you've added a rule, not altered the chain policy.

To remove a single rule, you must know its number in the chain. The command iptables -L INPUT --line-numbers will produce a numbered list of the rules in the INPUT chain.

Once you know the number, you can delete the rule with iptables -D INPUT <number>. Replace <number> with the relevant number as shown in the list.

thx reply ,

Your method works fine to remove the chain rules that with line number , but I find that the DROP policy do not have line number , would advise what can I do ? thanks

#/sbin/iptables -L -v
Chain INPUT (policy DROP 4996 packets, 589K bytes)
pkts bytes target prot opt in out source destination
0 0 ACCEPT tcp -- virbr0 any anywhere anywhere tcp dpt:domain
0 0 ACCEPT udp -- virbr0 any anywhere anywhere udp dpt:bootps

Ser Olmy · 02-07-2014, 02:42 AM

The policy doesn't have a rule number, because it's the chain policy, not a rule.

You change the policy with

Code:

iptables -P <CHAIN> <ACTION>

where <CHAIN> is the name of the chain (say, INPUT) and <ACTION> is either ACCEPT or DROP. The policy cannot be deleted.