iptables -S打印一组规则，但iptables-save打印带有一堆附加规则的超集。有什么不同？为什么不iptables -S打印附加规则？
例如，iptables -S不打印更改 Wireguard 接口 (wg0) 上的 SMTP（端口 25）数据包源地址的规则 ( -A POSTROUTING -o wg0 -j SNAT --to-source 10.0.0.2)，但iptables-save打印该规则？我猜想iptables -S可能只打印一条链，但iptables -h说：
--list-rules -S [chain [rulenum]]
Print the rules in a chain or all chains
...这似乎意味着当没有给定链参数时它将打印所有链。
# Generated by iptables-save v1.8.4 on Sat Jan 30 06:47:36 2021
*mangle
:PREROUTING ACCEPT [175762948:152635787911]
:INPUT ACCEPT [85129338:67722036020]
:FORWARD ACCEPT [90631707:84913651708]
:OUTPUT ACCEPT [43631301:2479371699]
:POSTROUTING ACCEPT [134263118:87393032790]
-A OUTPUT -p tcp -m tcp --dport 465 -j MARK --set-xmark 0x2/0xffffffff
-A OUTPUT -p tcp -m tcp --dport 25 -j MARK --set-xmark 0x2/0xffffffff
COMMIT
# Completed on Sat Jan 30 06:47:36 2021
# Generated by iptables-save v1.8.4 on Sat Jan 30 06:47:36 2021
*filter
:INPUT ACCEPT [367:62684]
:FORWARD ACCEPT [10426:4247532]
:OUTPUT ACCEPT [50809:2739507]
:f2b-sshd - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -i lo -j ACCEPT
-A INPUT -i enp2s0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i enp2s0 -j DROP
-A FORWARD -i enxa0cec802c711 -o enp2s0 -j DROP
-A f2b-sshd -s 200.140.81.94/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 177.92.35.201/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 94.43.219.173/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 14.228.195.50/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 66.96.232.50/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 71.217.140.138/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 14.249.54.134/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 201.209.161.174/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 174.30.109.183/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 71.217.167.42/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 116.193.139.76/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 41.89.234.2/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 182.71.223.194/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 173.202.19.15/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 180.112.138.132/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN
COMMIT
# Completed on Sat Jan 30 06:47:36 2021
# Generated by iptables-save v1.8.4 on Sat Jan 30 06:47:36 2021
*nat
:PREROUTING ACCEPT [444244:60896263]
:INPUT ACCEPT [168098:15673985]
:OUTPUT ACCEPT [120570:8875499]
:POSTROUTING ACCEPT [113904:8359713]
-A POSTROUTING -o enp2s0 -j MASQUERADE
-A POSTROUTING -o wg0 -j SNAT --to-source 10.0.0.2
COMMIT
# Completed on Sat Jan 30 06:47:36 2021
与
iptables v1.8.4 (legacy): option "-s" requires an argument
Try `iptables -h' or 'iptables --help' for more information.
root@sputnik:/home/nathan# iptables -S
-P INPUT ACCEPT
-P FORWARD ACCEPT
-P OUTPUT ACCEPT
-N f2b-sshd
-A INPUT -p tcp -m multiport --dports 22 -j f2b-sshd
-A INPUT -i lo -j ACCEPT
-A INPUT -i enp2s0 -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i enp2s0 -j DROP
-A FORWARD -i enxa0cec802c711 -o enp2s0 -j DROP
-A f2b-sshd -s 200.140.81.94/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 177.92.35.201/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 94.43.219.173/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 14.228.195.50/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 66.96.232.50/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 71.217.140.138/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 14.249.54.134/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 201.209.161.174/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 174.30.109.183/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 71.217.167.42/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 116.193.139.76/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 41.89.234.2/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 182.71.223.194/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 173.202.19.15/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -s 180.112.138.132/32 -j REJECT --reject-with icmp-port-unreachable
-A f2b-sshd -j RETURN
答案1
RTFM（阅读精细手册）：
man iptables:
-S, --list-rules [链] 打印所选链中的所有规则。如果没有选择链，则像 iptables-save 一样打印所有链。与其他所有 iptables 命令一样，它适用于指定的表（过滤器是默认值）。 ：
所以重点似乎是输出仅限于筛选桌子。
然而iptable-保存以适合经典配置文件的格式转储整套规则。
man iptable-save
-t, --table tablename
restrict output to only one table. If the kernel is configured
with automatic module loading, an attempt will be made to load
the appropriate module for that table if it is not already
there.
If not specified, output includes all available tables.
请注意所有可用的桌子作为此处的默认设置。
我在 CentOS 7 上查到了这个。