在现代网络环境中，Linux系统作为核心的服务器和客户端平台，其防火墙配置直接影响着系统的安全性和网络通信的稳定性。Linux防火墙，如`iptables`和`nftables`，是系统管理员用于控制入站和出站流量的重要工具。 随着云计算、容器化和微服务架构的普及，防火墙的灵活性和性能需求日益提升。 也是因为这些，掌握Linux防火墙状态的查看方法，对于运维人员和开发人员来说至关重要。本文将详细介绍如何查看Linux防火墙的状态，包括`iptables`和`nftables`的使用方法，以及如何通过命令行和脚本实现自动化管理，确保系统在复杂网络环境中的稳定运行。 一、Linux防火墙的基本概念与功能 Linux系统中，防火墙主要通过`iptables`和`nftables`来实现流量控制。`iptables`是传统防火墙工具，基于规则匹配机制，适用于大多数Linux发行版；而`nftables`是现代防火墙工具，提供了更高效的处理能力，支持更复杂的规则集和更灵活的配置。两者都提供了查看当前防火墙状态的功能，帮助管理员了解网络流量的流向和限制情况。 二、查看iptables防火墙状态的方法 2.1使用`iptables`查看规则列表 `iptables`提供了一个`-L`选项，用于列出所有规则。管理员可以通过以下命令查看当前的iptables规则： ```bash sudo iptables -L -n ``` - `-L`：列出规则。 - `-n`：以数字形式显示规则，避免解析主机名。 示例输出： ``` Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 REJECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 reject-with icmp-type 3 ``` 2.2使用`iptables-save`保存规则 如果需要保存当前的iptables规则以备后续使用，可以使用以下命令： ```bash sudo iptables-save > /etc/iptables/rules.v4 ``` 此命令会将当前的规则保存到指定的文件中，方便后续恢复或迁移。 2.3查看防火墙策略状态 `iptables`提供了`-v`选项，用于显示详细的规则处理信息： ```bash sudo iptables -L -n -v ``` 此命令将显示每个规则的匹配信息、处理状态以及匹配的IP地址和端口。 三、查看nftables防火墙状态的方法 1.1使用`nft`命令查看规则 `nftables`使用`nft`命令来管理规则，查看规则列表可以使用以下命令： ```bash sudo nft list ruleset ``` 示例输出： ``` root@host:~ nft list ruleset table { chain { type filter hook input priority 0; policy accept; iif lo iif6 lo ct state established,related accept ct type flow iif lo ct state new reject ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3 ct type flow iif lo ct state new reject-with icmp-type 3
