不是斑竹能说不？
iptables-save用来把当前的规则存入一个文件里以备iptables-restore使用。它的使用很简单，只有两个参数：
iptables-save [-c] [-t table]
参数-c的作用是保存包和字节计数器的值。这可以使我们在重启防火墙后不丢失对包和字节的统计。带-c参数的iptables-save命令使重启防火墙而不中断统计记数程序成为可能。这个参数默认是不使用的。
参数-t指定要保存的表，默认是保存所有的表。下面给出未装载任何规则的情况下iptables-save的输出。
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
*filter
:INPUT ACCEPT [404:19766]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [530:43376]
COMMIT
# Completed on Wed Apr 24 10:19:17 2002
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
*mangle
:PREROUTING ACCEPT [451:22060]
:INPUT ACCEPT [451:22060]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [594:47151]
:POSTROUTING ACCEPT [594:47151]
COMMIT
# Completed on Wed Apr 24 10:19:17 2002
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:17 2002
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [3:450]
:OUTPUT ACCEPT [3:450]
COMMIT
# Completed on Wed Apr 24 10:19:17 2002
我们来解释一下这个输出格式。#后面的是注释。表都以*<table-name>开始，例如*mangle。每个表都包含链和规则，链的详细说明是:<chain-name> <chain-policy> [<packet-counter>:<byte-counter>]。例如，链的名字是 PREROUTING，策略是ACCEPT，然后是包记数器和字节计数器，这两个计数器和iptables -L -v输出中用到的计数器一样。每个表的描述都以关键字COMMIT结束，它说明在这一点，就要把规则装入内核了。
上面的例子是最基本的，我想用一个简短的例子说明会更好，其中包含一个非常小的规则集Iptables-save ruleset。iptables-save的输出如下：
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
*filter
:INPUT DROP [1:229]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i eth1 -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Wed Apr 24 10:19:55 2002
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
*mangle
:PREROUTING ACCEPT [658:32445]
:INPUT ACCEPT [658:32445]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [891:68234]
:POSTROUTING ACCEPT [891:68234]
COMMIT
# Completed on Wed Apr 24 10:19:55 2002
# Generated by iptables-save v1.2.6a on Wed Apr 24 10:19:55 2002
*nat
:PREROUTING ACCEPT [1:229]
:POSTROUTING ACCEPT [3:450]
:OUTPUT ACCEPT [3:450]
-A POSTROUTING -o eth0 -j SNAT --to-source 195.233.192.1
COMMIT
# Completed on Wed Apr 24 10:19:55 2002
每个命令前都有包和字节计数器，这说明使用了-c参数。除了有计数器，其他的都和普通的脚本一样。现在的问题是怎么把输出保存到文件中。非常简单，既然使用linux，你应该早就知道了，用重定向啊：
iptables-save -c > /etc/iptables-save
这就会把规则集保存到/etc/iptables-save中，而且还有计数器。
复制代码
