iptables点滴和命令范例

iptables是基于Linux内核的防火墙实现，高效，简单和便捷，信手拈来就可以架起一个安全性不错的网络防火墙！
下面是一些来自网络上的iptables范例，通常适用于RedHat环境！Iptables工作原理
外部包进入Interface（网口），由路由作出判断，
是给本地主机的，由INPUT处理，
不是给本地主机的，本机又开启了FORWARD功能，
由FORWARD规则处理，
本机发出的包由OUTPUT规则处理。
   Incoming                /－－          Outgoing         -->[Routing ]--->|FORWARD|------->            [Decision]     _____/        ^               |                          |               v                        ____              ___                      /                 /       Linux Firewall  |OUTPUT|            |INPUT|                    ____/             ___/                       ^               |                         |                ----> Local Process -----

FORWARD功能的开启：
echo 1 > /proc/sys/net/ipv4/ip_forward

没有开启此功能的防火墙无法设置ip伪装方式，共享上网只能用代理。

iptables的状态（stateful）检测功能-m state --state RELATED状态：NEW, ESTABLISHED, RELATED

基本命令举例：
/sbin/iptables -F #清空链表 /sbin/iptables -N block ＃新的规则链/sbin/iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT ＃ 状态检测/sbin/iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT ＃非ppp0的新连接都接受/sbin/iptables -A block -j LOG #记日志/sbin/iptables -A block -j DROP ＃拒绝其他的包/sbin/iptables -A INPUT -j block ＃引用规则到INPUT链/sbin/iptables -A FORWARD -j block #引用到FORWARD链/sbin/iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE # 对ppp0的IP地址伪装(此外需要用echo "1" > /proc/sys/net/ipv4/ip_forward
orsysctl -w net.ipv4.ip_forward=1）打开IP转发，永久生效则在/etc/sysctl.conf中加net.ipv4.ip_forward = 1关于伪装（Masquerade)和NAT（Network Address Transfer），DNAT（Servers in DMZ)伪装一般用于通过防火墙，DSL modem等设备共同接入Internet的情况下，内网主机需要经过IP包源地址改成公共出口设备的IP地址才能与公网主机通信的情况。

NAT的例子：/sbin/iptables -t nat -A PREROUTING -p tcp --dport 4662 -j DNAT --to 192.168.198.10NAT用在内部（例如DMZ中的Server）主机通过防火墙向外部提供服务时，负责端口转发这类任务。IPTABLES相关的网络资源scriptsDynamic iptables firewall

范例一比较简单的iptables应用！*filter:INPUT DROP [0:0]:FORWARD DROP [0:0]:OUTPUT DROP [0:0]

## Drop all incoming fragments-A INPUT -i eth0 -f -j DROP

## Drop outside packets with localhost address - anti-spoofing-A INPUT -s 127.0.0.0/255.0.0.0 -i ! lo -j DROP

## Pass all locally-originating packets-A INPUT -i lo -j ACCEPT-A OUTPUT -o lo -j ACCEPT

## Accept ICMP ping echo requests## (this allows other people to ping your machine, among other things),-A INPUT -p icmp --icmp-type echo-request -j ACCEPT

## Accept all traffic from a specific machine with IP x.x.x.x## replace x.x.x.x with the desired IP, then uncomment the line.#-A INPUT -p tcp -m tcp --syn -s x.x.x.x -j ACCEPT#-A INPUT -p tcp -m tcp --syn -s x.x.x.x -j ACCEPT#-A INPUT -p tcp -m tcp --syn -s x.x.x.x -j ACCEPT

## Accept traffic on port p from a specific machine with IP x.x.x.x## replace p with the desired port number, and replace x.x.x.x with## the desired IP, then uncomment the line.#-A INPUT -p tcp -m tcp --syn -s x.x.x.x --dport p -j ACCEPT

## Accept ftp-data and ftp (ports 20 & 21)-A INPUT -p tcp -m tcp --syn --dport 20 -j ACCEPT-A INPUT -p tcp -m tcp --syn --dport 21 -j ACCEPT

## Accept ssh (port 22)-A INPUT -p tcp -m tcp --syn --dport 22 -j ACCEPT

## Accept telnet (port 23)#-A INPUT -p tcp -m tcp --syn --dport 23 -j ACCEPT

## Accept smtp (port 25)-A INPUT -p tcp -m tcp --syn --dport 25 -j ACCEPT

## If you serve DNS, accept dns (port 53) -A INPUT -p tcp -m tcp --syn --dport 53 -j ACCEPT-A INPUT -p udp -m tcp --syn --dport 53 -j ACCEPT

## Accept http (port 80)-A INPUT -p tcp -m tcp --syn --dport 80 -j ACCEPT

## Accept pop3 (port 110)-A INPUT -p tcp -m tcp --syn --dport 110 -j ACCEPT

## Accept inbound identd (port 113)-A INPUT -p tcp -m tcp --syn --dport 113 -j ACCEPT## or you can reject and send back a TCP RST packet instead#-A INPUT -p tcp -m tcp --dport 113 -j REJECT --reject-with tcp-reset

## Accept imap (port 143)-A INPUT -p tcp -m tcp --syn --dport 143 -j ACCEPT

## Accept https (port 443)-A INPUT -p tcp -m tcp --syn --dport 443 -j ACCEPT

## Accept imaps (port 993)-A INPUT -p tcp -m tcp --syn --dport 993 -j ACCEPT

## Accept pop3s (port 995)-A INPUT -p tcp -m tcp --syn --dport 995 -j ACCEPT

## Accept mysql (port 3306)-A INPUT -p tcp -m tcp --syn --dport 3306 -j ACCEPT

## Accept dns (port 53) - your nameservers with IP x.x.x.x#-A INPUT -p udp -m udp -s x.x.x.x --sport 53 -d 0/0 -j ACCEPT#-A INPUT -p udp -m udp -s x.x.x.x --sport 53 -d 0/0 -j ACCEPT#-A INPUT -p udp -m udp -s x.x.x.x --sport 53 -d 0/0 -j ACCEPT

## Allow inbound established and related outside communication-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

## Drop outside initiated connections-A INPUT -m state --state NEW -j REJECT

## Allow all outbound tcp, udp, icmp traffic with state-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT-A OUTPUT -p udp -m state --state NEW,ESTABLISHED -j ACCEPT-A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPTCOMMIT

Comments

Post a Comment

Popular posts from this blog

Freeware Software Top 300 from winAddons.Com!

来自winAddons.Com的推荐，最好的300款免费软件，其中当然不乏Open Source的品牌产品，如OpenOffice，Firefox等，也包含了Windows平台下常用的不花钱的玩意儿，如Adobe Acrobat Reader等。 全文摘录如下， 对我个人经常使用和熟悉的一些产品进行了评价！！ Office 办公软件 OpenOffice - 最著名的免费的办公套件 PC Suite 602 - office suite AbiWord - text editor Atlantis Nova - text editor Microsoft PowerPoint Viewer - power point files viewer Adobe Reader - pdf reader Foxit PDF Reader - pdf reader PDFCreator - 优秀的PDF制作引擎，用于直接打印到PDF文件 Doc Convertor - document convertor Convert - unit convertor Converber - unit convertor Sunbird - calendar/organizer EssentialPIM Free - calendar/organizer PhraseExpress - speed up your writing ATnotes - create notes on the desktop Archive managers 压缩文件管理器 7-Zip - 最流行的免费压缩工具 IZArc - compression program TugZIP - compression program CabPack - compression program Universal Extractor - extract files from any type of archive Internet 因特网 Firefox - 火狐，火狐 Internet Explorer - web browser Maxthon - web browser Opera - web browser Avant Browser - web browser Thu...
Read more

What is DevOPS?

Image
What is DevOPS? As be a DevOPS engineer more than five years in the past, I was always asked what is DevOPS or what is a DevOPS role or what should a DevOPS Engineer do? Or even question like how to be a good DevOPS? What? How? should be the most two frequently questions from almost all organizations. As I am working with  Amazon Web Service  for a long time with my DevOPS career, I tried to get answers from AWS guys frist as they have a special section about AWS DevOPS, also they have AWS DevOPS certificate cources, even though I never try such cources. This is the first page said about DevOPS on AWS DevOPS to answer "What is DevOPS?", DevOps is the combination of cultural philosophies, practices, and tools that increases an organization’s ability to deliver applications and services at high velocity: evolving and improving products at a faster pace than organizations using traditional software development and infrastructure management processes. This speed enable...
Read more

RPM Build Tips!

Now, I am trying to build a Linux system based on the Fedora Core Release! Working with the RPM system in deep.The unpackaged file terminate the build process under RPM 4.x! Unpackaged files message in RPM-4.1 and following RPM version 4.1 and following demonstrate a new behaviour in the rpmbuild process. Previously, a build process might place any number of files, say in the %install stanza, when running the make install part of a Makefile , in the customary /var/tmp/%{name}-root/ BuildRoot (the RPM_BUILD_ROOT ). Once through that part of the Makefile , it can then completely ignore these files in the %files binary packaging stanza. This often happens when an upstream maintainer adds, or deletes items from new directory spurs in the make install , and the change might be missed during an unattended or automated rebuild. This option permits careful packagers to cross check the quality of their packaging. So as a cross check, /usr/lib/rpm/check-files is now enabled during ...
Read more