iptables 可以加载comment模块，对规则加以解释，方便管理！
1 | # iptables -m comment -help |
2 | iptables v1.4.10 |
3 | . |
4 | . |
5 | . |
6 | comment match options: |
7 | --comment COMMENT Attach a comment to a rule |
示例：
01 | # iptables -t filter -I INPUT -p tcp --dport 21 -j ACCEPT -m comment --comment "remark" |
02 | # iptables -t filter -I INPUT -m comment --comment "remark" -p tcp --dport 21 -j ACCEPT |
03 |
04 | # iptables -t filter -nL INPUT |
05 | Chain INPUT (policy ACCEPT) |
06 | target prot opt source destination |
07 | ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 /* remark */ |
08 | ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 /* remark */ tcp dpt:21 |
09 |
10 |
11 |
12 | # iptables -t filter -I INPUT -m comment --comment "remark1" -p tcp --dport 21 -j ACCEPT -m comment --comment "remark2" |
13 |
14 | # iptables -t filter -nL INPUT |
15 | Chain INPUT (policy ACCEPT) |
16 | target prot opt source destination |
17 | ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 /* remark1 */ tcp dpt:21 /* remark2 */ |
参考：
http://spamcleaner.org/en/misc/iptables-comment.html