xuegod2阶段10
[root@xuegod63 ~]# rpm -ivh /media/cdrom/Packages/iptables-1.4.7-11.el6.x86_64.rpm
warning: /media/cdrom/Packages/iptables-1.4.7-11.el6.x86_64.rpm: Header V3 RSA/SHA256 Signature, key ID fd431d51: NOKEY
Preparing... ########################################### [100%]
package iptables-1.4.7-11.el6.x86_64 is already installed
[root@xuegod63 ~]# ls /etc/sysconfig/iptables
/etc/sysconfig/iptables
[root@xuegod63 ~]# /etc/init.d/iptables start
[root@xuegod63 ~]# chkconfig --list iptables
iptables 0:off1:off2:on3:on4:on5:on6:off
使用iptables 保护公司的web服务器
[root@xuegod63 ~]# iptables -A INPUT -i lo -j ACCEPT 放行环回路口
[root@xuegod63 ~]# iptables -A INPUT -p tcp --dport 22 -j ACCEPT 放行ssh
[root@xuegod63 ~]# iptables -A INPUT -p tcp --dport 80 -j ACCEPT放行http
放行已建立的连接和产生的相关连接
[root@xuegod63 ~]# iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[root@xuegod63 ~]# iptables -P INPUT DROP 默认策略
[root@xuegod63 ~]# /etc/init.d/iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
[root@xuegod63 ~]# iptables -A INPUT -i lo -j ACCEPT
[root@xuegod63 ~]# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
[root@xuegod63 ~]# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
[root@xuegod63 ~]# iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
[root@xuegod63 ~]# iptables -P INPUT DROP
[root@xuegod63 ~]# /etc/init.d/iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
[root@xuegod63 ~]# service httpd start
Starting httpd: [ OK ]
[root@xuegod63 ~]# yum -y install vsftpd
[root@xuegod63 ~]# /etc/init.d/vsftpd restart
Shutting down vsftpd: [ OK ]
2 使用iptables 搭建路由器，通过snat 功能， 是内网pc机可以上网
[root@xuegod63 ~]# echo "1" > /proc/sys/net/ipv4/ip_forward 开启路由转发
[root@xuegod63 ~]# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296
[root@xuegod63 ~]# iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -j SNAT --to 192.168.1.63
[root@xuegod62 /]# cat ifcfg-eth0 客户端配置
# Advanced Micro Devices [AMD] 79c970 [PCnet32 LANCE]
DEVICE=eth0
BOOTPROTO=static
HWADDR=00:0C:29:18:7B:8B
IPV6INIT=no
IPV6_AUTOCONF=no
ONBOOT=yes
IPADDR=192.168.2.62
NETMASK=255.255.255.0
DNS=202.106.0.20
GATEWAY=192.168.2.1
[root@xuegod62 /]# cat resolv.conf
search localdomain
nameserver 202.106.0.20
nameserver 192.168.2.1
[root@xuegod63 /]# cat /etc/resolv.conf
; generated by /sbin/dhclient-script
nameserver 202.106.0.20
nameserver 192.168.2.1
search localhost
拒绝访问服务器 和通过服务器访问别的主机
[root@xuegod63 ~]# echo "1" > /proc/sys/net/ipv4/ip_forward 开启路由转发
[root@xuegod63 /]# iptables -F
[root@xuegod63 /]# /etc/init.d/iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
[root@xuegod63 /]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@xuegod63 /]# iptables -A INPUT -s 192.168.2.62 -j DROP
[root@xuegod63 /]# /etc/init.d/iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
经验证客户端已Ping 不通服务器
[root@xuegod63 /]# iptables -F
[root@xuegod63 /]# /etc/init.d/iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
[root@xuegod63 /]# iptables -A FORWARD -s 192.168.2.62 -j DROP
[root@xuegod63 /]# /etc/init.d/iptables save
添加规则，要添加在最靠近数据流源的链上，减少不必要的开销
使用ＤＮＡＴ功能，将内网web server 端口映射到路由器上
[root@xuegod63 /]# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.2.62:80
[root@xuegod63 /]# /etc/init.d/iptables saveiptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
[root@xuegod63 /]# iptables -t nat -A PREROUTING -d 192.168.1.63 -p tcp --dport 80 -j DNAT --to 192.168.2.62:80 或者
[root@xuegod63 /]# iptables -t nat -A PREROUTING -i ppp0 -p tcp --dport 81 -j DNAT --to 192.168.2.62:81 如果是adsl , 就得这样写
总结
[root@xuegod63 /]# iptables -t filter -A INPUT -j DROP 丢弃所有
[root@xuegod63 /]# iptables -D INPUT 1 删除第1条规则
[root@xuegod63 /]# iptables -D INPUT -s 192.168.2.62 -j DROP 禁止62 访问服务器
[root@xuegod63 /]# iptables -P INPUT ACCEPT 默认接受所有
[root@xuegod63 /]# iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -j SNAT --to 192.168.1.63 将内网地址映射到外网端口
[root@xuegod63 /]# iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to 192.168.2.1:80 将80端口进来的数据连接到2.1服务器
[root@xuegod63 /]# iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE
地址伪装
[root@xuegod63 /]# iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
匹配状态
[root@xuegod63 /]# iptables -A FORWARD -m mac --mac-source xx:xx:xx:xx:xx:xx: -j DROP
匹配mac
[root@xuegod63 /]# iptables -A FORWARD -d 192.168.2.62 -m limit --limit 50/s -j ACCEPT
匹配速率
[root@xuegod63 /]# iptables -A INPUT -p tcp -m multiport --dports 21,22,25,80,110 -j ACCEPT
多端口匹配