blocks|key|1189011|text|所以它看起来没有任何方法，并且已经被Netfilter小组确认了。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1189012|请参阅SO问题，How+can+I+programmatically+manage+iptables+rules+on+the+fly?|offset|length|1189013|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/109553/how-can-i-programatically-manage-iptables-rules-on-the-fly^0|0|8|1O|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|O|8|@]|9|@$D|P|E|Q|1|R]]|A|$]]|$1|F|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|G|$H|$5|I|J|K|A|$L|M]]]]

So it looks like there isn't any way and it's been acknowledged by Netfilter group. 

See SO question, <a href="https://stackoverflow.com/questions/109553/how-can-i-programatically-manage-iptables-rules-on-the-fly">How can I programmatically manage iptables rules on the fly?</a>

blocks|key|1186349|text|您可以与名为libiptc.的iptables库进行交互|type|unstyled|depth|inlineStyleRanges|offset|length|style|BOLD|CODE|entityRanges|data|1186350|这就是我如何创建到iptables的Perl接口：CPAN+IPTables::libiptc|1186351|但是libiptc库只为您提供了一个基本链结构的应用编程接口。访问和解析各个规则要复杂一些，因为它依赖于dyn-loading各个目标/匹配模块的共享库。|1186352|在我的CPAN+module中，我的方法是从iptables.c链接到do_command()，以进行规则更改。|1186353|你需要知道的另一件事是：|1186354|单个iptables调用执行以下操作：|1186355|libiptc将整个规则集从内核复制到userspace|1186356|Parse，然后进行一次或多次更改(通常只需通过iptables将其更改为内核|unordered-list-item|1186357|
|1186358|格式，通过libiptc|1186359|1186360|将整个(新)规则集从用户空间复制到内核。|1186361|1186362|因此，如果您每次只做一次更改，那么这将是一个繁重的过程。但您也可以利用这一点，一次执行许多更改，并让这些更改显示为内核的单个原子更改。|1186363|entityMap|0|LINK|mutability|MUTABLE|url|http://search.cpan.org/perldoc?IPTables::libiptc|1^0|6|7|6|7|F|8|0|9|8|P|M|0|0|2|7|1G|B|0|M|A|Z|C|3|B|1|0|0|B|0|2|8|0|0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|1E|8|@$9|1F|A|1G|B|C]|$9|1H|A|1I|B|D]|$9|1J|A|1K|B|D]]|E|@]|F|$]]|$1|G|3|H|5|6|7|1L|8|@$9|1M|A|1N|B|D]]|E|@$9|1O|A|1P|1|1Q]]|F|$]]|$1|I|3|J|5|6|7|1R|8|@$9|1S|A|1T|B|D]|$9|1U|A|1V|B|D]]|E|@]|F|$]]|$1|K|3|L|5|6|7|1W|8|@$9|1X|A|1Y|B|D]|$9|1Z|A|20|B|D]]|E|@$9|21|A|22|1|23]]|F|$]]|$1|M|3|N|5|6|7|24|8|@$9|25|A|26|B|C]]|E|@]|F|$]]|$1|O|3|P|5|6|7|27|8|@$9|28|A|29|B|D]]|E|@]|F|$]]|$1|Q|3|R|5|6|7|2A|8|@]|E|@]|F|$]]|$1|S|3|T|5|U|7|2B|8|@]|E|@]|F|$]]|$1|V|3|W|5|6|7|2C|8|@]|E|@]|F|$]]|$1|X|3|Y|5|U|7|2D|8|@]|E|@]|F|$]]|$1|Z|3|W|5|6|7|2E|8|@]|E|@]|F|$]]|$1|10|3|11|5|U|7|2F|8|@]|E|@]|F|$]]|$1|12|3|-4|5|6|7|2G|8|@]|E|@]|F|$]]|$1|13|3|14|5|6|7|2H|8|@]|E|@]|F|$]]|$1|15|3|-4|5|6|7|2I|8|@]|E|@]|F|$]]]|16|$17|$5|18|19|1A|F|$1B|1C]]|1D|$5|18|19|1A|F|$1B|1C]]]]

You can interface with the <code>iptables</code> library called <code>libiptc</code>.

That's how I have created my Perl interface to <code>iptables</code>: <a href="http://search.cpan.org/perldoc?IPTables::libiptc" rel="nofollow noreferrer">CPAN IPTables::libiptc</a>

But the <code>libiptc</code> library only gives you an API to the basic chain structures.
Accessing and parsing the individual rules is a bit more complicated, as it depends on <code>dyn-loading</code> the shared libs of the individual target/match modules.

My approach in my <a href="http://search.cpan.org/perldoc?IPTables::libiptc" rel="nofollow noreferrer">CPAN module</a> is that I have linked with <code>do_command()</code> from <code>iptables.c</code>, for doing rule changes.

Another thing you need to know is: 

That a single <code>iptables</code> call, perform these actions:

<ol>
<li>Copy the entire ruleset from the kernel to userspace</li>
<li>Parse it with <code>libiptc</code></li>
<li>Perform one or several changes (usually just one change via iptables cmd)</li>
<li>Transform it to kernel blob format, by libiptc</li>
<li>Copy the entire (new) ruleset from userspace to kernel.</li>
</ol>

Thus, a heavy process, if you only make a single change each time.
But you can also use this to your advantage, and perform many changes at once, and have these appear as a single atomic change, by/for the kernel.

blocks|key|5530114|text|正如我在ltrace-ing+iptables+-L的评论中所说的那样，我发现我的Debian/Sid上有一个包含libipq和相关库的iptables-dev包。您可能想要使用它。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5530115|entityMap|0|LINK|mutability|MUTABLE|url|http://linux.die.net/man/3/libipq^0|4|6|F|B|1W|C|1L|6|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]|$9|Q|A|R|B|C]|$9|S|A|T|B|C]]|D|@$9|U|A|V|1|W]]|E|$]]|$1|F|3|-4|5|6|7|X|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

As I said in a comment, by <code>ltrace</code>-ing <code>iptables -L</code>, I fould that there is an <code>iptables-dev</code> package on my Debian/Sid with <a href="http://linux.die.net/man/3/libipq" rel="nofollow">libipq</a> and related libraries. You probably might want to use it.

blocks|key|3914946|text|我将使用/+proc+/net/下的proc-fileystem查看http://www.netfilter.org/documentation/FAQ/netfilter-faq-3.html#ss3.9并查找proc(在不同的问题中)|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|3914947|entityMap|0|LINK|mutability|MUTABLE|url|http://www.netfilter.org/documentation/FAQ/netfilter-faq-3.html#ss3.9^0|Y|1X|0|0^^$0|@$1|2|3|4|5|6|7|L|8|@]|9|@$A|M|B|N|1|O]]|C|$]]|$1|D|3|-4|5|6|7|P|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]]]

I would use the proc-fileystem under /proc/net/
Have a look at <a href="http://www.netfilter.org/documentation/FAQ/netfilter-faq-3.html#ss3.9" rel="nofollow">http://www.netfilter.org/documentation/FAQ/netfilter-faq-3.html#ss3.9</a> and look for proc (in different questions)

blocks|key|3914995|text|嗯，为什么他不研究iptables的来源来获得一个想法呢？如果源代码只包含所需的代码，我不明白为什么要使用strace来解决这个问题。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3914996|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|D|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|E|8|@]|9|@]|A|$]]]|C|$]]

Hm why shouln't he look into the sources of iptables to get an idea? I can not see why one would use strace to figure it out if the sources just contains the needed code.

Is there a way we can query iptables programmatically without making use of shell script? I don't have liberty of using shell script to run iptables command and grep output. Is there a native (API) level access to iptables using GNU C? At the bare minimum I would like to query default policy of iptables. 

I was hoping to use /proc file system but I don't think its <a href="http://www.lowth.com/rope/ProcFileSystem" rel="nofollow">implemented yet.</a>

How to programmatically access iptables?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

有没有一种方法可以不用shell脚本就能以编程方式查询iptables？我没有使用shell脚本运行iptables命令和grep输出的权限。是否存在对使用GNU C的iptables的本机(API)级别访问？至少我想查询iptables的默认策略。我希望使用/proc文件系统，但我不认为它是

问如何以编程方式访问iptables？
EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何以编程方式访问iptables？EN

回答 5

Stack Overflow用户

Stack Overflow用户

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何以编程方式访问iptables？
EN