當(dāng)前位置：首頁(yè) > 编程资源 > 编程问答 >内容正文

编程问答

Iptables防火墙配置

發(fā)布時(shí)間：2024/4/17 编程问答 30 豆豆

生活随笔收集整理的這篇文章主要介紹了 Iptables防火墙配置小編覺得挺不錯(cuò)的,現(xiàn)在分享給大家,幫大家做個(gè)參考.

iptables 服務(wù)的配置文件：/etc/sysconfig/iptables-config

系統(tǒng)默認(rèn)策略：? /etc/sysconfig/iptables

一? 查看現(xiàn)有iptables配置信息

?[root@Linux-180Desktop]# iptables -tfilter -L

Chain INPUT (policy ACCEPT)

target????prot opt source??????????????destination??? ?????

ACCEPT????all? --? anywhere???????????? anywhere??????????? state RELATED,ESTABLISHED

ACCEPT????icmp --? anywhere???????????? anywhere???????????

ACCEPT????all? --? anywhere???????????? anywhere???????????

ACCEPT????tcp? --? anywhere????????? ???anywhere??????????? state NEW tcp dpt:ssh

REJECT????all? --? anywhere???????????? anywhere??????????? reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

target????prot opt source??????????????destination????????

REJECT????all? --? anywhere???????????? anywhere??????????? reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

target????prot opt source??????????????destination????????

[root@Linux-180 Desktop]# iptables -t nat -L

Chain PREROUTING (policy ACCEPT)

target????prot opt source??????????????destination????????

Chain POSTROUTING (policy ACCEPT)

target????prot opt source??????????????destination????????

Chain OUTPUT (policy ACCEPT)

target????prot opt source??????????????destination????

[root@Linux-180 Desktop]# service iptables status

Table: nat

Chain PREROUTING (policy ACCEPT)

num?target???? prot opt source?????????????? destination????????

Chain POSTROUTING (policy ACCEPT)

num?target???? prot opt source?????????????? destination????????

Chain OUTPUT (policy ACCEPT)

num?target???? prot opt source?????????????? destination????????

Table: filter

Chain INPUT (policy ACCEPT)

num?target???? prot opt source?????????????? destination????????

1???ACCEPT???? all? --?0.0.0.0/0??????????? 0.0.0.0/0??????? ???state RELATED,ESTABLISHED

2???ACCEPT???? icmp --? 0.0.0.0/0??????????? 0.0.0.0/0??????????

3???ACCEPT???? all? --?0.0.0.0/0??????????? 0.0.0.0/0??????????

4???ACCEPT???? tcp? --?0.0.0.0/0??????????? 0.0.0.0/0?????????? state NEW tcp dpt:22

5?? ?REJECT????all? --? 0.0.0.0/0??????????? 0.0.0.0/0?????????? reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

num?target???? prot opt source?????????????? destination????????

1???REJECT???? all? --?0.0.0.0/0??????????? 0.0.0.0/0?????? ????reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

num?target???? prot opt source?????????????? destination?????

清除規(guī)則和定義默認(rèn)策略

1清除鏈中所有已定義的規(guī)則

[root@Linux-180 Desktop]# iptables -L

Chain INPUT (policy ACCEPT)

target????prot opt source? ?????????????destination????????

ACCEPT????all? --? anywhere???????????? anywhere??????????? state RELATED,ESTABLISHED

ACCEPT????icmp --? anywhere???????????? anywhere???????????

ACCEPT????all? --? anywhere???????????? anywhere???????????

ACCEPT????tcp? --?anywhere???????????? anywhere??????????? state NEW tcp dpt:ssh

REJECT????all? --? anywhere???????????? anywhere??????????? reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

target????prot opt source??????????????destination??? ?????

REJECT????all? --? anywhere???????????? anywhere??????????? reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

target????prot opt source??????????????destination????????

[root@Linux-180 Desktop]# iptables -F

[root@Linux-180 Desktop]# iptables -L

Chain INPUT (policy ACCEPT)

target????prot opt source??????????????destination????????

Chain FORWARD (policy ACCEPT)

target????prot opt source??????????????destination????????

Chain OUTPUT (policy ACCEPT)

target????prot opt source??? ???????????destination???

語(yǔ)法規(guī)則

?iptables?[-t table]? -P? [chain]?[ACCEPT|DROP]

-P 定義策略，ACCEPT 接受數(shù)據(jù)包?? DROP直接丟棄數(shù)據(jù)包，對(duì)數(shù)據(jù)包不作任何回應(yīng)

[root@Linux-180 Desktop]# iptables -P INPUT? DROP

[root@Linux-181 network-scripts]# ping172.16.40.180

PING 172.16.40.180 (172.16.40.180) 56(84)bytes of data.

--- 172.16.40.180 ping statistics ---

8 packets transmitted, 0 received, 100%packet loss, time 7866ms

[root@Linux-180 Desktop]# iptables -P INPUT? ACCEPT

[root@Linux-181 network-scripts]# ping172.16.40.180

PING 172.16.40.180 (172.16.40.180) 56(84)bytes of data.

64 bytes from 172.16.40.180: icmp_seq=1ttl=64 time=0.284 ms

64 bytes from 172.16.40.180: icmp_seq=2ttl=64 time=0.248 ms

64 bytes from 172.16.40.180: icmp_seq=3ttl=64 time=0.223 ms

64 bytes from 172.16.40.180: icmp_seq=4ttl=64 time=0.224 ms

64 bytes from 172.16.40.180: icmp_seq=5ttl=64 time=0.344 ms

--- 172.16.40.180 ping statistics ---

5 packets transmitted, 5 received, 0%packet loss, time 4771ms

rtt min/avg/max/mdev =0.223/0.264/0.344/0.048 ms

設(shè)置數(shù)據(jù)包的基本判斷條件

語(yǔ)法

iptables? [-AI 鏈]? [-io網(wǎng)絡(luò)接口]? [-p 協(xié)議] [-s 來源地址/子網(wǎng)掩碼] ?[-d 目標(biāo)地址/子網(wǎng)掩碼] [--sport 端口范圍]?[--dport 端口范圍] ?-j [ACCEPT/DROP/REJECT]

?????

如

??#iptables? -A INPUT? -i lo?-j ACCEPT

#iptables? -A INPUT? -i eth0?-s? 172.16.40.0/24 -j ACCEPT

#iptables? -A INPUT? -s?172.16.40.181? -d 172.16.40.180 –pTCP? --dport 22? -j ACCEPT

指定拒絕源目標(biāo)IP (在機(jī)器172.16.40.180上執(zhí)行)

#iptables? -A INPUT?-s? 172.16.40.181? -j?REJECT

Linux機(jī)器，IP為172.16.4.181不可以ping通172.16.40.180機(jī)器

[root@Linux-181 network-scripts]# ping 172.16.40.180

PING 172.16.40.180 (172.16.40.180) 56(84) bytes of data.

From 172.16.40.180 icmp_seq=1 Destination Port Unreachable

From 172.16.40.180 icmp_seq=2 Destination Port Unreachable

From 172.16.40.180 icmp_seq=3 Destination Port Unreachable

--- 172.16.40.180 ping statistics ---

3 packets transmitted, 0 received, +3 errors, 100% packet loss, time2434ms

Windows機(jī)器，IP為172.16.4.80仍然可以ping通172.16.40.180機(jī)器

C:\Users\fengjw>ping 172.16.40.180

正在 Ping 172.16.40.180 具有 32 字節(jié)的數(shù)據(jù):

來自 172.16.40.180 的回復(fù): 字節(jié)=32 時(shí)間<1ms TTL=64

172.16.40.180 的 Ping 統(tǒng)計(jì)信息:

??? 數(shù)據(jù)包: 已發(fā)送 = 4，已接收 = 4，丟失 = 0 (0% 丟失)，

往返行程的估計(jì)時(shí)間(以毫秒為單位):

??? 最短 = 0ms，最長(zhǎng) = 0ms，平均 = 0ms

拒絕使用本機(jī)的ssh服務(wù)

# iptables? -A ?INPUT? -ptcp? --dport? 22? -j? REJECT

圖形配置方式

# system-config-firewall

轉(zhuǎn)載于:https://blog.51cto.com/newcourage/1928435

總結(jié)

以上是生活随笔為你收集整理的Iptables防火墙配置的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。

上一篇：除醛重要性美博士环保为您解答！！
下一篇： NetApp 7MTT 工具进行存储数据