linux基础防火墙基础题

1.INPUT和OUTPUT默认策略为DROP；

iptables -P INPUT DROP
iptables -P OUTPUT DROP
得改成ACCEPT要不远程不了

2.限制本地主机的web服务器在周二、周五不允许访问；新请求的速率不能超过150个每秒；web服务器包含了demo字符串的页面不允许访问；web服务器仅允许响应报文离开本机；

[root@wjh ~]# iptables -I INPUT 1 -d 192.168.100.10 -p tcp --dport 80 -m limit --limit 150/second -m time --weekdays Tue,Fri -j REJECT       
[root@wjh ~]# iptables -I OUTPUT 1 -d 192.168.100.10 -p tcp --dport 80 -m string --string "demo" --algo kmp -j REJECT          
[root@wjh ~]# iptables -I OUTPUT 2 -m state --state RELATED,ESTABLISHED -j ACCEPT

3.在工作时间，即周一到周五的8:30-18:00，开放本机的samba服务共享的目录给192.168.100.20网络中的主机访问；数据访问次数每分钟不得超过20个；

[root@wjh ~]# iptables -I INPUT 1 -s 192.168.100.20 -p tcp --dport 22 -m time --timestart 08:30 --timestop 18:00 --weekdays Mon,Tue,Wed,Thu,Fri -j ACCEPT 
[root@wjh ~]# iptables -I INPUT 2 -s 192.168.100.20 -p tcp --dport 22  -m connlimit --connlimit-above 5 -j REJECT

4.开放本机的ssh服务给192.168.100.9-192.168.100.155中的主机，新请求建立的速率一分钟不得超过3个；仅允许响应报文通过其服务端口离开本机；

[root@wjh ~]# iptables -A INPUT -p tcp --dport 22 -m iprange --src-range 192.168.100.9-192.168.100.155 -m limit --limit 3/min -j ACCEPT
[root@wjh ~]# iptables -A OUTPUT -p tcp --dport 22 -m iprange --dst-range 192.168.100.9-192.168.100.155 -m state --state ESTABLISHED -j ACCEPT

5.定制源地址访问策略：1)接收来自192.168.100.30的IP访问；2)拒绝来自192.168.200.0/24网段的访问
编辑/etc/hosts.allow
vsftpd: 192.168.100.30

[root@wjh ~]# iptables -I INPUT -s 192.168.200.0/24 -j DROP 

6.目标地址192.168.100.20的访问给予记录,并查看/var/log/message

[root@wjh ~]# iptables -A INPUT -s 192.168.100.20 -j LOG

7.定制端口访问策略：1)拒绝任何地址访问本机的8081端口；2)拒绝192.168.200.0/24网段的1024-65534的源端口访问SSH

[root@wjh ~]# iptables -A INPUT -p tcp --dport 8081 -j DROP
[root@wjh ~]# iptables -A INPUT -p tcp -s 192.168.200.0/24 --sport 1024:65534 --dport ssh -j DROP

8.定制防火墙的MAC地址访问策略：1)清除所以已经存的规则；2)将INPUT设为DROP;3)将目标计算机192.168.100.30的MAC设为ACCEPT

[root@wjh ~]# iptables -F
[root@wjh ~]# iptables -X
[root@wjh ~]# iptables -Z
[root@wjh ~]# iptables -P INPUT DROP
[root@wjh ~]# iptables -A INPUT -m mac --mac-source 00:0c:29:ef:43:36  -j ACCEPT

9.定制防火墙的NAT访问策略：1)清除所有NAT策略；2)重置ip_forward为1；3)通过SNAT设定来源于192.168.100.20网段通过ens33转发出去；4)用iptables观察转发的数据包。

[root@wjh ~]# iptables -F -t nat
[root@wjh ~]# iptables -X -t nat 
[root@wjh ~]# iptables -Z -t nat 
[root@wjh ~]# echo "1" > /proc/sys/net/ipv4/ip_forward
[root@wjh ~]# iptables -t nat -A POSTROUTING -o eno16777736 -j SNAT --to 192.168.100.20
[root@wjh ~]# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 1 packets, 60 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    1    60 SNAT       all  --  *      eno16777736  0.0.0.0/0            0.0.0.0/0            to:192.168.100.20

10.端口转发访问策略:1)清除所有NAT策略；2)重置ip_forward为1；3)通过DNAT设定为所有访问192.168.100.30的22端口，都访问到192.168.100.20的22端口；4)设定所有到192.168.100.20的22端口的数据包都通过FORWARD转发；5)设定回应数据包,即通过NAT的POSTROUTING设定,使通讯正常。

[root@wjh ~]# iptables -F -t nat
[root@wjh ~]# iptables -X -t nat
[root@wjh ~]# iptables -Z -t nat
[root@wjh ~]# echo "1" > /proc/sys/net/ipv4/ip_forward 
[root@wjh ~]# iptables -t nat -A PREROUTING -d 192.168.100.30 -p tcp --dport 22 -j DNAT  --to-destination 192.168.100.20:20
[root@wjh ~]# iptables -A FORWARD -p tcp -d 192.168.100.20 --dport 22 -j ACCEPT
[root@wjh ~]# iptables -t nat -I POSTROUTING -p tcp --dport 22 -j MASQUERADE
[root@wjh ~]# iptables -nvL -t nat
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            192.168.100.30       tcp dpt:22 to:192.168.100.20:20

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 MASQUERADE  tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22

Firewalld练习题
1.配置防火墙规则允许192.168.100.0/24 网段的用户对controller和compute进行ssh访问;禁止192.168.200.0/24 网段的用户对controller和compute进行ssh访问.

[root@wjh ~]# firewall-cmd  --zone=public --add-rich-rule="rule family="ipv4" source address="192.168.100.0/24" service name="ssh" accept"
success
[root@wjh ~]# firewall-cmd  --zone=public --add-rich-rule="rule family="ipv4" source address="192.168.200.0/24" service name="ssh" reject"
success
[root@wjh ~]# firewall-cmd --list-all
public (default, active)
  interfaces: eno16777736
  sources: 
  services: dhcpv6-client https ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="192.168.100.0/24" service name="ssh" accept
        rule family="ipv4" source address="192.168.200.0/24" service name="ssh" reject

2.配置端口转发在controller和compute配置端口转发，要求：在192.168.200.0/24网段中的主机，访问server的本地端口5321将被转发到80端口此设置必须永久有效、设置开机启动防火墙.

[root@wjh ~]# firewall-cmd --permanent --zone=public --add-rich-rule 'rule family="ipv4" source address="192.168.200.0/24" forward-port port="5321" protocol="tcp"  to-port="80"' 
success
[root@wjh ~]# firewall-cmd --reload
success
[root@wjh ~]# firewall-cmd --list-all
public (default, active)
  interfaces: eno16777736
  sources: 
  services: dhcpv6-client https ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="192.168.200.0/24" forward-port port="5321" protocol="tcp" to-port="80"

3.开启80端口,查看80端口状态;

[root@wjh ~]# firewall-cmd --zone=public --add-port=80/tcp
success
[root@wjh ~]# firewall-cmd --list-all
public (default, active)
  interfaces: eno16777736
  sources: 
  services: dhcpv6-client https ssh
  ports: 80/tcp
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="192.168.200.0/24" forward-port port="5321" protocol="tcp" to-port="80"

4.允许来自主机 192.168.100.20 的80 端口的 IPv4 的 TCP 流量，并将流量转发到 6532 端口上；

[root@wjh ~]# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="192.168.100.20" forward-port port="80" protocol="tcp"  to-port="6532"'
success
[root@wjh ~]# firewall-cmd --list-all
public (default, active)
  interfaces: eno16777736
  sources: 
  services: dhcpv6-client https ssh
  ports: 80/tcp
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="192.168.200.0/24" forward-port port="5321" protocol="tcp" to-port="80"
        rule family="ipv4" source address="192.168.100.20" forward-port port="80" protocol="tcp" to-port="6532"

5.每分钟允许2个新连接访问ftp服务；

[root@wjh ~]# firewall-cmd --add-rich-rule='rule service name=ftp limit value=2/m accept'
success
[root@wjh ~]# firewall-cmd --list-all
public (default, active)
  interfaces: eno16777736
  sources: 
  services: dhcpv6-client https ssh
  ports: 80/tcp
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
        rule service name="ftp" accept limit value="2/m"
        rule family="ipv4" source address="192.168.200.0/24" forward-port port="5321" protocol="tcp" to-port="80"
        rule family="ipv4" source address="192.168.100.20" forward-port port="80" protocol="tcp" to-port="6532"

6.修改默认区域为home，并添加接口ens33到当前默认区域下，查询出结果；

[root@wjh ~]# firewall-cmd --set-default-zone=home
success
[root@wjh ~]# firewall-cmd --zone=home --add-interface=ens33
success
[root@wjh ~]# firewall-cmd --get-default-zone
home

7.放开ssh服务，并限制只有192.168.100.30可以访问3306端口；

[root@wjh ~]# firewall-cmd --add-rich-rule="rule family="ipv4" source address="192.168.100.30" port protocol="tcp" port="3306" accept"
success

8.增加666端口到public域上，并查询结果；

[root@wjh ~]# firewall-cmd --zone=public --add-port=666/tcp
success
[root@wjh ~]# firewall-cmd --list-all
home (default, active)
  interfaces: eno16777736 ens33
  sources: 
  services: dhcpv6-client ipp-client mdns samba-client ssh
  ports: 
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="192.168.100.30" port port="3306" protocol="tcp" accept

9.将tcp协议1000-8888端口，添加到home区域下；并添加192.168.100.0/24网段到home区域；

[root@wjh ~]# firewall-cmd --zone=home --add-port=1000-8888/tcp
success
[root@wjh ~]# firewall-cmd --zone=home --add-source=192.168.100.0/24
success
[root@wjh ~]# firewall-cmd --list-all --zone=home
home (default, active)
  interfaces: eno16777736 ens33
  sources: 192.168.100.0/24
  services: dhcpv6-client ipp-client mdns samba-client ssh
  ports: 1000-8888/tcp
  masquerade: no
  forward-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="192.168.100.30" port port="3306" protocol="tcp" accept

10.修改home区域绑定的网卡接口，将它绑定到internal区域，并查询接口所在区域结果；

[root@wjh ~]# firewall-cmd --zone=internal --change-interface=ens33
success
[root@wjh ~]# firewall-cmd --get-zone-of-interface=ens33
internal