防火墙的配置-白红宇

防火墙的配置

阅读量：4312 次

发布时间：2019-06-06

本文共 22587 字，大约阅读时间需要 75 分钟。

丢弃来自192.168.10.36的所有数据包-A追加规则

[root@chenxi ~]# iptables -A INPUT -s 192.168.10.36 -j DROP

查看默认表的规则，带行号显示

[root@chenxi ~]# iptables -vnL --line-numbersChain INPUT (policy ACCEPT 271 packets, 20573 bytes)num   pkts bytes target     prot opt in     out     source               destination         1       37  3108 DROP       all  --  *      *       192.168.10.36        0.0.0.0/0           Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 48 packets, 4440 bytes)num   pkts bytes target     prot opt in     out     source               destination

　允许来自192.168.10.36的所有数据包

[root@chenxi ~]# iptables -vnL --line-numbersChain INPUT (policy ACCEPT 44 packets, 3358 bytes)num   pkts bytes target     prot opt in     out     source               destinatio1        8   672 ACCEPT     all  --  *      *       192.168.10.36        0.0.0.0/0 2       37  3108 DROP       all  --  *      *       192.168.10.36        0.0.0.0/0 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destinatioChain OUTPUT (policy ACCEPT 16 packets, 2256 bytes)num   pkts bytes target     prot opt in     out     source               destination

查看nat表里的链

[root@chenxi ~]# iptables -vnL --line-numbers -t natChain PREROUTING (policy ACCEPT 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destination         Chain INPUT (policy ACCEPT 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destination         Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)num   pkts bytes target     prot opt in     out     source               destination         [root@chenxi ~]# iptables -vnL --line-numbers -t natChain PREROUTING (policy ACCEPT 3 packets, 240 bytes)num   pkts bytes target     prot opt in     out     source               destination         Chain INPUT (policy ACCEPT 2 packets, 162 bytes)num   pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 1 packets, 716 bytes)num   pkts bytes target     prot opt in     out     source               destination         Chain POSTROUTING (policy ACCEPT 1 packets, 716 bytes)num   pkts bytes target     prot opt in     out     source               destination

　查看规则

[root@chenxi ~]# iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         ACCEPT     all  --  192.168.10.36        0.0.0.0/0           DROP       all  --  192.168.10.36        0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination

删除第1条规则

[root@chenxi ~]# iptables -D INPUT 1[root@chenxi ~]# iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         DROP       all  --  192.168.10.36        0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination

　　添加允许192.168.10.1主的作用报文出入本机-s源地址-d目标

[root@chenxi ~]# iptables -A INPUT -s 192.168.10.1 -j ACCEPT[root@chenxi ~]# iptables -A OUTPUT -d 192.168.10.1 -j ACCEPT[root@chenxi ~]# iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         DROP       all  --  192.168.10.36        0.0.0.0/0           ACCEPT     all  --  192.168.10.1         0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            192.168.10.1

　　修改默认规则为拒绝表默认过滤表

[root@chenxi ~]# iptables -P INPUT DROP[root@chenxi ~]# iptables -P OUTPUT DROP[root@chenxi ~]# iptables -nLChain INPUT (policy DROP)target     prot opt source               destination         DROP       all  --  192.168.10.36        0.0.0.0/0           ACCEPT     all  --  192.168.10.1         0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            192.168.10.1

　在192.168.10.36主机用ping命令测试

[root@mail bin]# ping 192.168.10.40PING 192.168.10.40 (192.168.10.40) 56(84) bytes of data.

　在192.168.10.40 主机添加允许192.168.10.36数据包进来的规则

[root@chenxi ~]# iptables -A INPUT -s 192.168.10.36 -j ACCEPT[root@chenxi ~]# tcpdump -i ens33 -nn icmptcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes08:39:08.910676 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 40976, seq 149, length 6408:39:09.910752 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 40976, seq 150, length 6408:39:10.922666 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 40976, seq 151, length 6408:39:11.940137 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 40976, seq 152, length 64

　　在192.168.10.40主机上添加允许目标主机为192.169.10.36的开发规则

[root@chenxi ~]# iptables -A OUTPUT -d 192.168.10.36 -j ACCEPT[root@chenxi ~]# iptables -nLChain INPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  192.168.10.1         0.0.0.0/0           ACCEPT     all  --  192.168.10.36        0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            192.168.10.1        ACCEPT     all  --  0.0.0.0/0            192.168.10.36       08:40:53.800793 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 40976, seq 253, length 6408:40:53.801135 IP 192.168.10.40 > 192.168.10.36: ICMP echo reply, id 40976, seq 253, length 64

　添加192.168.10.36的icmp协议可ping通192.168.10.40主机的规则

[root@chenxi ~]# iptables -A INPUT -s 192.168.10.36 -p icmp -j ACCEPT   进主机的规则[root@mail bin]# ping 192.168.10.40PING 192.168.10.40 (192.168.10.40) 56(84) bytes of data.[root@chenxi ~]# tcpdump -i ens33 -nn icmptcpdump: verbose output suppressed, use -v or -vv for full protocol decodelistening on ens33, link-type EN10MB (Ethernet), capture size 262144 bytes08:55:23.850949 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 6, length 6408:55:24.851240 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 7, length 6408:55:25.851304 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 8, length 6408:55:26.855839 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 9, length 6408:55:27.853459 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 10, length 6408:55:28.854609 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 11, length 6408:55:29.857906 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 12, length 6408:55:30.856784 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 13, length 6408:55:31.858473 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 14, length 6408:55:32.857969 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 15, length 6408:55:33.859005 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 16, length 6408:55:34.914116 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 17, length 6408:55:35.916034 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 18, length 6408:55:36.916717 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 19, length 6408:55:37.940721 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 20, length 6408:55:38.935520 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 21, length 6408:55:39.935601 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 4148[root@chenxi ~]# iptables -A OUTPUT -d 192.168.10.36 -p icmp -j ACCEPT 出主机的规则[root@chenxi ~]# iptables -nLChain INPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  192.168.10.1         0.0.0.0/0           ACCEPT     icmp --  192.168.10.36        0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            192.168.10.1        ACCEPT     icmp --  0.0.0.0/0            192.168.10.36       8, seq 22, length 6408:55:39.935702 IP 192.168.10.40 > 192.168.10.36: ICMP echo reply, id 41488, seq 22, length 6408:55:40.936550 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 23, length 6408:55:40.936628 IP 192.168.10.40 > 192.168.10.36: ICMP echo reply, id 41488, seq 23, length 6408:55:41.938630 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 24, length 6408:55:41.938690 IP 192.168.10.40 > 192.168.10.36: ICMP echo reply, id 41488, seq 24, length 6408:55:42.939814 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 25, length 6408:55:42.939889 IP 192.168.10.40 > 192.168.10.36: ICMP echo reply, id 41488, seq 25, length 6408:55:43.941753 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 26, length 6408:55:43.941831 IP 192.168.10.40 > 192.168.10.36: ICMP echo reply, id 41488, seq 26, length 6408:55:44.975164 IP 192.168.10.36 > 192.168.10.40: ICMP echo request, id 41488, seq 27, length 6408:55:44.975228 IP 192.168.10.40 > 192.168.10.36: ICMP echo reply, id 41488, seq 27, length 64[root@mail bin]# ping 192.168.10.40PING 192.168.10.40 (192.168.10.40) 56(84) bytes of data.64 bytes from 192.168.10.40: icmp_seq=22 ttl=64 time=0.493 ms64 bytes from 192.168.10.40: icmp_seq=23 ttl=64 time=1.09 ms64 bytes from 192.168.10.40: icmp_seq=24 ttl=64 time=0.336 ms64 bytes from 192.168.10.40: icmp_seq=25 ttl=64 time=1.36 ms64 bytes from 192.168.10.40: icmp_seq=26 ttl=64 time=0.430 ms64 bytes from 192.168.10.40: icmp_seq=27 ttl=64 time=0.243 ms

　　在192.168.10.40的主机上添加允许192.168.10.36访问本机22端口

[root@mail bin]# ssh 192.168.10.40ssh: connect to host 192.168.10.40 port 22: Connection timed out[root@chenxi ~]# iptables -A INPUT -s 192.168.10.36 -p tcp --dport 22 -j ACCEPT   进来数据包[root@chenxi ~]# iptables -A OUTPUT -d 192.168.10.36 -p tcp --sport 22 -j ACCEPT   返回数据包[root@chenxi ~]# iptables -nLChain INPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  192.168.10.1         0.0.0.0/0           ACCEPT     icmp --  192.168.10.36        0.0.0.0/0           ACCEPT     tcp  --  192.168.10.36        0.0.0.0/0            tcp dpt:22Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            192.168.10.1        ACCEPT     icmp --  0.0.0.0/0            192.168.10.36       ACCEPT     tcp  --  0.0.0.0/0            192.168.10.36        tcp spt:22[root@mail bin]# ssh 192.168.10.40The authenticity of host '192.168.10.40 (192.168.10.40)' can't be established.RSA key fingerprint is c9:1c:63:b4:a2:a5:c4:cf:5a:a2:46:19:81:63:d2:f5.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '192.168.10.40' (RSA) to the list of known hosts.root@192.168.10.40's password: Last login: Tue Mar 19 08:37:05 2019 from 192.168.10.1[root@chenxi ~]#

　　拒绝源地址为192.168.10.36主机的tcp的第一次握手连接

[root@chenxi ~]# iptables -I INPUT 2 -s 192.168.10.36 -p tcp --syn -j REJECT[root@chenxi ~]# iptables -nLChain INPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  192.168.10.1         0.0.0.0/0           REJECT     tcp  --  192.168.10.36        0.0.0.0/0            tcp flags:0x17/0x02 reject-with icmp-port-unreachableACCEPT     icmp --  192.168.10.36        0.0.0.0/0           ACCEPT     tcp  --  192.168.10.36        0.0.0.0/0            tcp dpt:22Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            192.168.10.1        ACCEPT     icmp --  0.0.0.0/0            192.168.10.36       ACCEPT     tcp  --  0.0.0.0/0            192.168.10.36        tcp spt:22[root@mail ~]# ssh 192.168.10.40ssh: connect to host 192.168.10.40 port 22: Connection refused[root@mail ~]# ssh 192.168.10.40ssh: connect to host 192.168.10.40 port 22: Connection refused[root@mail bin]# ssh 192.168.10.40The authenticity of host '192.168.10.40 (192.168.10.40)' can't be established.RSA key fingerprint is c9:1c:63:b4:a2:a5:c4:cf:5a:a2:46:19:81:63:d2:f5.Are you sure you want to continue connecting (yes/no)? yesWarning: Permanently added '192.168.10.40' (RSA) to the list of known hosts.root@192.168.10.40's password: Last login: Tue Mar 19 08:37:05 2019 from 192.168.10.1[root@chenxi ~]# lsanaconda-ks.cfg[root@chenxi ~]# ip a1: lo: 
     
       mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo       valid_lft forever preferred_lft forever    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: ens33: 
      
        mtu 1500 qdisc pfifo_fast state UP group default qlen 1000    link/ether 00:0c:29:40:c2:01 brd ff:ff:ff:ff:ff:ff    inet 192.168.10.40/24 brd 192.168.10.255 scope global noprefixroute ens33       valid_lft forever preferred_lft forever    inet6 fe80::6e0:d902:bf99:5840/64 scope link noprefixroute        valid_lft forever preferred_lft forever3: ens37: 
       
         mtu 1500 qdisc pfifo_fast state UP group default qlen 1000    link/ether 00:0c:29:40:c2:0b brd ff:ff:ff:ff:ff:ff    inet 192.168.10.133/24 brd 192.168.10.255 scope global noprefixroute dynamic ens37       valid_lft 1453sec preferred_lft 1453sec    inet6 fe80::24a2:2585:2b12:e5ab/64 scope link noprefixroute        valid_lft forever preferred_lft forever

　　用允许192.168.10.36可以访问本机的22端口的tcp状态连接第一次握手替换点拒绝所有来源192.168.10.36TCP第一握手拒绝规则

[root@chenxi ~]# iptables -R INPUT 2 -s 192.168.10.36 -p tcp --dport 22 --syn -j ACCEPT    -R 替换[root@chenxi ~]# iptables -nLChain INPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  192.168.10.1         0.0.0.0/0           ACCEPT     tcp  --  192.168.10.36        0.0.0.0/0            tcp dpt:22 flags:0x17/0x02ACCEPT     icmp --  192.168.10.36        0.0.0.0/0           ACCEPT     tcp  --  192.168.10.36        0.0.0.0/0            tcp dpt:22Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            192.168.10.1        ACCEPT     icmp --  0.0.0.0/0            192.168.10.36       ACCEPT     tcp  --  0.0.0.0/0            192.168.10.36        tcp spt:22[root@mail ~]# ssh 192.168.10.40root@192.168.10.40's password: Last login: Tue Mar 19 09:23:21 2019 from 192.168.10.36[root@chenxi ~]#

　　自定义链

[root@chenxi ~]# iptables -N chenxi  创建链[root@chenxi ~]# iptables -nvL Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         12738  768K ACCEPT     all  --  *      *       192.168.10.1         0.0.0.0/0           Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         17882 3969K ACCEPT     all  --  *      *       0.0.0.0/0            192.168.10.1        Chain chenxi (0 references) pkts bytes target     prot opt in     out     source               destination         [root@chenxi ~]# iptables -X chenxi   删除自定义链[root@chenxi ~]# iptables -nvL Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         12776  771K ACCEPT     all  --  *      *       192.168.10.1         0.0.0.0/0           Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         17897 3971K ACCEPT     all  --  *      *       0.0.0.0/0            192.168.10.1        [root@chenxi ~]# iptables -N chenxi[root@chenxi ~]# iptables -A chenxi -p tcp --tcp-flags ALL ALL -j REJECT   TCP状态连接标志位全为1拒绝掉[root@chenxi ~]# iptables -A chenxi -p tcp --tcp-flags ALL NONE -j REJECT  TCP状态连接全为0 拒绝掉[root@chenxi ~]# iptables -nvL Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         13181  801K ACCEPT     all  --  *      *       192.168.10.1         0.0.0.0/0           Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         18067 3989K ACCEPT     all  --  *      *       0.0.0.0/0            192.168.10.1        Chain chenxi (0 references) pkts bytes target     prot opt in     out     source               destination             0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x3F reject-with icmp-port-unreachable    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x00 reject-with icmp-port-unreachable

　　关联自定义链

[root@chenxi ~]# iptables -A INPUT -s 192.168.10.36 -j chenxi   把所有来源地址为192.168.10.36的数据包都丢到chenxi这个链里[root@chenxi ~]# iptables -nvL Chain INPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         13333  812K ACCEPT     all  --  *      *       192.168.10.1         0.0.0.0/0               0     0 chenxi     all  --  *      *       192.168.10.36        0.0.0.0/0           Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target     prot opt in     out     source               destination         18124 3995K ACCEPT     all  --  *      *       0.0.0.0/0            192.168.10.1        Chain chenxi (1 references) pkts bytes target     prot opt in     out     source               destination             0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x3F reject-with icmp-port-unreachable    0     0 REJECT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x00 reject-with icmp-port-unreachable

删除已关联的自定义链

[root@chenxi ~]# iptables -nLChain INPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  192.168.10.1         0.0.0.0/0           chenxi     all  --  192.168.10.36        0.0.0.0/0           CHENXI     all  --  0.0.0.0/0            0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            192.168.10.1        cx         all  --  0.0.0.0/0            0.0.0.0/0           Chain CHENXI (1 references)target     prot opt source               destination         ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:80ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:443ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:53ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp dpt:53Chain chenxi (1 references)target     prot opt source               destination         REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x3F reject-with icmp-port-unreachableREJECT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x00 reject-with icmp-port-unreachableChain cx (1 references)target     prot opt source               destination         ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp spt:80ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp spt:443ACCEPT     udp  --  0.0.0.0/0            0.0.0.0/0            udp spt:53ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp spt:53[root@chenxi ~]# iptables -D INPUT 3[root@chenxi ~]# iptables -D CHENXI 1[root@chenxi ~]# iptables -D CHENXI 1[root@chenxi ~]# iptables -D CHENXI 1[root@chenxi ~]# iptables -D CHENXI 1[root@chenxi ~]# iptables -D CHENXI 1iptables: Index of deletion too big.[root@chenxi ~]# iptables -D CHENXI 1iptables: Index of deletion too big.[root@chenxi ~]# iptables -X CHENXI [root@chenxi ~]# iptables -D OUTPUT 2[root@chenxi ~]# iptables -D cx 1[root@chenxi ~]# iptables -D cx 1[root@chenxi ~]# iptables -D cx 1[root@chenxi ~]# iptables -D cx 1[root@chenxi ~]# iptables -D cx 1iptables: Index of deletion too big.[root@chenxi ~]# iptables -D cx 1iptables: Index of deletion too big.[root@chenxi ~]# iptables -nLChain INPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  192.168.10.1         0.0.0.0/0           chenxi     all  --  192.168.10.36        0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy DROP)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            192.168.10.1        Chain chenxi (1 references)target     prot opt source               destination         REJECT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x3F reject-with icmp-port-unreachableREJECT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp flags:0x3F/0x00 reject-with icmp-port-unreachableChain cx (0 references)target     prot opt source               destination