iptables防火墙

标签（空格分隔）： 未分类

---

查看防火墙规则

[root@wanghongwei ~]# iptables -L -nv
# 入栈
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         
#转发
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         
#出栈
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         

默认看这个表

[root@wanghongwei ~]# iptables -t filter -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

[root@wanghongwei ~]# iptables -t nat -L
\Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

关闭防火墙指定链规则

#关闭转链规则
[root@wanghongwei ~]# iptables -P FORWARD DROP
#查看链规则
[root@wanghongwei ~]# iptables -L -nv
Chain INPUT (policy ACCEPT 28 packets, 1848 bytes)pkts bytes target     prot opt in     out     source               destination         Chain FORWARD (policy DROP 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 15 packets, 1396 bytes)pkts bytes target     prot opt in     out     source               destination       

允许访问本机中位于 80 端口的 Web 服务，禁止访问其他端口的 TCP 请求
iptables
-A 在最后追加
-I 在第一行插入
-p 协议
-j 类型 DROP无回复 REJECT 拒绝，但有回复

[root@wanghongwei ~]# iptables -A INPUT -p tcp --dport 80 -j ACCEPT
[root@wanghongwei ~]# iptables -L -nv
Chain INPUT (policy ACCEPT 28 packets, 1848 bytes)pkts bytes target     prot opt in     out     source               destination         0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0           tcp dpt:80 Chain FORWARD (policy DROP 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 15 packets, 1396 bytes)pkts bytes target     prot opt in     out     source               destination         

iptables
-F 清理所有表规则

[root@wanghongwei ~]# iptables -F

-D 删除指定链的第几个规则

[root@wanghongwei ~]# iptables -D INPUT 3
# 如指定数量大于实际规则则会出现提示
iptables: Index of deletion too big.

-P 对链添加规则

[root@wanghongwei ~]# iptables -P INPUT REJECT

实现开启防火墙ssh指定IP仍能连接

设置INPUT链

#设置INPUT链规则
#-I 在首行添加 INPUT指定链 -s 源端口 -d 目标端口 -p 指定协议[root@wanghongwei ~]# iptables -I INPUT -s 192.168.200.1 -d 192.168.200.51 -p tcp --dport 22 -j ACCEPT
#查看规则添加情况
[root@wanghongwei ~]# iptables -L -nv
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         32  2112 ACCEPT     tcp  --  *      *       192.168.200.1        192.168.200.51      tcp dpt:22 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 17 packets, 1580 bytes)pkts bytes target     prot opt in     out     source               destination         

设置OUTPUT链

[root@wanghongwei ~]# iptables -L -nv
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         303 20124 ACCEPT     tcp  --  *      *       192.168.200.1        192.168.200.51      tcp dpt:22 Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         21  1896 ACCEPT     tcp  --  *      *       192.168.200.51       192.168.200.1       tcp spt:22 

修改链规则

[root@wanghongwei ~]# iptables -P INPUT DROP
[root@wanghongwei ~]# iptables -P FORWARD DROP
[root@wanghongwei ~]# iptables -P OUTPUT DROP
[root@wanghongwei ~]# iptables -L -nv
Chain INPUT (policy DROP 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         543 35984 ACCEPT     tcp  --  *      *       192.168.200.1        192.168.200.51      tcp dpt:22 Chain FORWARD (policy DROP 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         Chain OUTPUT (policy DROP 0 packets, 0 bytes)pkts bytes target     prot opt in     out     source               destination         149 14504 ACCEPT     tcp  --  *      *       192.168.200.51       192.168.200.1       tcp spt:22 

iptables实现不同网段之间相互通信
|主机|IP|备注|
|—|---|
|服务器|192.168.200.100 192.168.100.100 |不配置网关|
|客户端1|192.168.200.222|网关为服务器200网段IP地址|
|客户端2|192.168.100.200|网关为服务器100网段IP地址|

修改配置文件，开启IPV4转发

[root@FWQ ~]# vim /etc/sysctl.conf 
# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled.  See sysctl(8) and
# sysctl.conf(5) for more details.# Controls IP packet forwarding
net.ipv4.ip_forward = 1# Controls source route verification
net.ipv4.conf.default.rp_filter = 1
#即时生效配置文件
[root@FWQ ~]# sysctl -p
net.ipv4.ip_forward = 1
net.ipv4.conf.default.rp_filter = 1
net.ipv4.conf.default.accept_source_route = 0
kernel.sysrq = 0
kernel.core_uses_pid = 1
net.ipv4.tcp_syncookies = 1
error: "net.bridge.bridge-nf-call-ip6tables" is an unknown key
error: "net.bridge.bridge-nf-call-iptables" is an unknown key
error: "net.bridge.bridge-nf-call-arptables" is an unknown key
kernel.msgmnb = 65536
kernel.msgmax = 65536
kernel.shmmax = 68719476736
kernel.shmall = 4294967296

##测试跨网段测试

端口匹配
–sport 源端口
–dport 目标端口

SNAT：源地址转换。
DNAT：目标地址转换。
转换源地址进行访问外网
SNAT规则

1)iptables -t nat -A POSTROUTING -s 内网IP -j SNAT --to-source 公网IP //适用于静态公网IP地址

2)iptables -t nat -A POSTROUTING -s 内网IP -j MASQUERADE

[root@FWQ ~]# iptables -t nat -A POSTROUTING -s 192.168.200.0/24 -o eth1 -j SNAT --to-source 192.168.100.100

DNAT规则
iptables -t nat -A PREROUTING -i 进网卡 -d 进网关IP地址 -p tcp --dport 80 -j DNAT --to-destination 跳转到IP地址:端口
转换目标地址实现用户访问80端口，进行跳转到内部web服务器的指定端口

[root@FWQ ~]# iptables -t nat -A PREROUTING -i eth1 -d 192.168.100.100 -p tcp --dport 80 -j DNAT --to-destination 192.168.200.222:8080

默认防火墙规则在重启后自动清空，需导出防火墙配置进行备份

#保存防火墙配置
[root@FWQ ~]# iptables-save > /sysconfig/iptables 
#查看已保存的防火墙配置
[root@FWQ ~]# cat /etc/init.d/iptables 
# Generated by iptables-save v1.4.7 on Tue Jul 30 05:43:34 2019
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A PREROUTING -d 192.168.100.100/32 -i eth1 -p tcp -m tcp --dport 80 -j DNAT --to-destination 192.168.200.222:8080 
-A POSTROUTING -s 192.168.200.0/24 -o eth1 -j SNAT --to-source 192.168.100.100 
COMMIT
# Completed on Tue Jul 30 05:43:34 2019

备份防火墙文件，通过md5sum命令可以检查防火墙是否被恶意更改，可写脚本进行监控

#备份防火墙配置文件
[root@FWQ ~]# cp /etc/init.d/iptables iptables.bak
#通过md5sum对比两文件是否有差异
[root@FWQ ~]# md5sum iptables.bak 
90fa43ac006d491de7b64771d08b2371  iptables.bak
[root@FWQ ~]# md5sum /etc/init.d/iptables 
90fa43ac006d491de7b64771d08b2371  /etc/init.d/iptables

连接外网