iptables
iptalbes的三个表
filter 这个表主要用于过滤包的，是系统预设的表，这个表也是用的最多的。内建三个链INPUT、OUTPUT以及FORWARD。INPUT作用于进入本机的包；OUTPUT作用于本机送出的包；FORWARD作用于那些跟本机无关的包。
nat 主要用处是网络地址转换，也有三个链。PREROUTING 链的作用是在包刚刚到达防火墙时改变它的目的地址，如果需要的话。OUTPUT链改变本地产生的包的目的地址。POSTROUTING链在包就要离开防火墙之前改变其源地址。该表用的不多，但有时候会用到。
mangle 这个表主要是用于给数据包打标记，然后根据标记去操作哪些包。这个表几乎不怎么用。
查看filter表规则
[root@localhost ~]# iptables -t filter -nvL Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 12345 18M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 3 208 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 11 1175 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 7575 packets, 462K bytes) pkts bytes target prot opt in out source destination
查看nat表规则
[root@localhost ~]# iptables -t nat -nvL Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
查看mangle表规则
[root@localhost ~]# iptables -t mangle -nvL Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination
平时用的最多的就是filter表
filter 设置规则
例如：
以etho网卡做限制，过滤80端口和IP不让访问。（80 12.12.12.12)
[root@localhost ~]# iptables -t filter -I INPUT -p tcp --dport 80 -s 12.12.12.12 -j REJECT 拒绝这个包 [root@localhost ~]# iptables -t filter -I INPUT -p tcp --dport 80 -s 12.12.12.12 -j DROP 扔掉这个包
查看刚刚设置的规则
[root@localhost ~]# iptables -t filter -nvL 正常情况下的输入 Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 REJECT tcp -- * * 12.12.12.12 0.0.0.0/0 tcp dpt:80 reject-with icmp-port-unreachable 12903 18M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 3 208 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 45 4461 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 39 packets, 3960 bytes) pkts bytes target prot opt in out source destination
[root@localhost ~]# iptables -nvL 默认的是filter的表 Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 REJECT tcp -- * * 12.12.12.12 0.0.0.0/0 tcp dpt:80 reject-with icmp-port-unreachable 12932 18M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 3 208 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 45 4461 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 58 packets, 7200 bytes) pkts bytes target prot opt in out source destination
例如我现在封掉下面这个IP
[root@localhost ~]# w 01:39:34 up 1:04, 4 users, load average: 0.08, 0.02, 0.01 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT root tty1 - 00:55 42:49 0.06s 0.06s -bash root pts/0 192.168.1.110 01:00 37:45 0.05s 0.05s -bash root pts/1 192.168.1.110 01:02 2:05 0.25s 0.25s -bash root pts/2 192.168.1.110 01:38 0.00s 0.16s 0.09s w
[root@localhost ~]# iptables -t filter -I INPUT -p tcp --dport 80 -s 192.168.1.110 -j REJECT
用浏览器访问192.168.1.110 一直在转圈
[root@localhost ~]# iptables -nvL
可以看到pkts 和bytes有包被过滤掉的数据
取消这个规则
[root@localhost ~]# iptables -t filter -D INPUT -p tcp --dport 80 -s 192.168.1.110 -j REJECT
增加一条规则
[root@localhost ~]# iptables -t filter -A INPUT -p tcp --dport 80 -s 223.21.186.27 -j REJECT
减A可以增加到最上头的规则
[root@localhost ~]# iptables -t filter -I INPUT -p tcp --dport 80 -s 223.21.186.27 -j REJECT [root@localhost ~]# iptables -nvL
清除数值0
[root@localhost ~]# iptables -Z
清空规则
[root@localhost ~]# iptables -F 默认清空的是filter表 清除别的得添加指定规则 [root@localhost ~]# iptables -nvL Chain INPUT (policy ACCEPT 6 packets, 432 bytes) pkts bytes target prot opt in out source destination Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 4 packets, 448 bytes) pkts bytes target prot opt in out source destination
保存规则
[root@localhost ~]# service iptables save iptables：将防火墙规则保存到 /etc/sysconfig/iptables： [确定]
重启规则
[root@localhost ~]# service iptables restart iptables：将链设置为政策 ACCEPT：mangle nat filter [确定] iptables：清除防火墙规则： [确定] iptables：正在卸载模块： [确定] iptables：应用防火墙规则： [确定]
备份
[root@localhost ~]# iptables-save >1.ipt [root@localhost ~]# cat 1.ipt # Generated by iptables-save v1.4.7 on Sun Mar 27 02:13:42 2016 *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [41:6216] -A INPUT -s 192.168.1.110/32 -p tcp -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT # Completed on Sun Mar 27 02:13:42 2016
恢复
[root@localhost ~]# iptables-restore < 1.ipt [root@localhost ~]# iptables -nvL Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 REJECT tcp -- * * 192.168.1.110 0.0.0.0/0 tcp dpt:80 reject-with icmp-port-unreachable 20 1440 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 11 packets, 1240 bytes) pkts bytes target prot opt in out source destination
仅允许工作日的工作时间访问本机 UDP 53 端口
iptables -A INPUT -p udp --dport 53 -m time --timestart 08:00 --timestop 18:00 --weekdays Mon,Tue,Wen,Thu,Fri -j ACCEPT
允许 172.16.0.1 ~ 172.16.0.100 的主机访问本机 TCP 3306 端口
iptables -A INPUT -p tcp --dport 3306 -m iprange --src-range 172.16.0.1-172.16.0.100 -j ACCEPT