???????????????NAT?????
????1????????????NAT?????????
[root@tp rc.d]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target       prot opt source                 destination
Chain POSTROUTING (policy ACCEPT)
target       prot opt source                 destination
SNAT         all    --    192.168.0.0/24         anywhere              to:211.101.46.235
Chain OUTPUT (policy ACCEPT)
target       prot opt source                 destination
???????NAT??????ú????(?????????????????????????????????????).???????????NAT???ο????????????
?????????????????????NAT??????????????????????NAT??????????????????е?
??????????????????????
????[root@tp ~]# iptables -F -t nat
????[root@tp ~]# iptables -X -t nat
????[root@tp ~]# iptables -Z -t nat
????2????????
????????????NAT????????(???????????NAT????????????????)??
??????????????????DROP??.???????????ACCEPT.
?????????????????IP???
????[root@tp sysconfig]# iptables -t nat -A PREROUTING -i eth0 -s 10.0.0.0/8 -j DROP
????[root@tp sysconfig]# iptables -t nat -A PREROUTING -i eth0 -s 172.16.0.0/12 -j DROP
????[root@tp sysconfig]# iptables -t nat -A PREROUTING -i eth0 -s 192.168.0.0/16 -j DROP
????????????????????MSN??QQ??BT??????????????????????????IP??(???????????????)
????????
?????????211.101.46.253??????????
????[root@tp ~]# iptables -t nat -A PREROUTING    -d 211.101.46.253 -j DROP
????????FTP(21)???
????[root@tp ~]# iptables -t nat -A PREROUTING -p tcp --dport 21 -j DROP
????????д??Χ??????????????????????.
????[root@tp ~]# iptables -t nat -A PREROUTING    -p tcp --dport 21 -d 211.101.46.253 -j DROP
?????????????211.101.46.253?????FTP??????????????????.??web(80???)????.
??????????д??????????QQ??MSN???????????IP???????????????????Э?飬??????д????.
??????
????drop???????
????[root@tp ~]# iptables -A INPUT     -m state --state INVALID -j DROP
????[root@tp ~]# iptables -A OUTPUT    -m state --state INVALID -j DROP
????[root@tp ~]# iptables-A FORWARD -m state --state INVALID -j DROP
??????????????????????????????
????[root@tp ~]# iptables-A INPUT -m state --state ESTABLISHED??RELATED -j ACCEPT
????[root@tp ~]# iptables-A OUTPUT -m state --state ESTABLISHED??RELATED -j ACCEPT
????[root@tp ~]# /etc/rc.d/init.d/iptables save
????????????д??/etc/sysconfig/iptables???????.д????e???????????￡????????????
????[root@tp ~]# service iptables restart
????????????棬????д?????????Σ???????????棬???????飬??????????????
????????????й??????????????????
????д??????￡???????????????μ????????????????????飬????????????????????в????????????????????.
???????????????????????.????IPTABLES????????????????????????????????????????????????￡????????.