一、安装及使用

（一）安装

[root@k8s-node1 sysconfig]# pwd
/etc/sysconfig

[root@k8s-node1 sysconfig]# yum install iptables

[root@k8s-node1 sysconfig]# yum install iptables-services

[root@k8s-node1 sysconfig]# ls -l | grep iptables
-rw-------. 1 root root  550 8月   8 19:41 iptables
-rw-------. 1 root root 2116 8月   8 19:41 iptables-config
[root@k8s-node1 sysconfig]# pwd
/etc/sysconfig

systemctl stop firewalld 停用

systemctl mask firewalld 禁用

（二）使用

[root@k8s-node1 sysconfig]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy DROP)
target     prot opt source               destination         
DOCKER-USER  all  --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-1  all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
DOCKER     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (2 references)
target     prot opt source               destination         
ACCEPT     tcp  --  0.0.0.0/0            172.17.0.2           tcp dpt:8081

Chain DOCKER-ISOLATION-STAGE-1 (1 references)
target     prot opt source               destination         
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0           
DOCKER-ISOLATION-STAGE-2  all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-ISOLATION-STAGE-2 (2 references)
target     prot opt source               destination         
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
DROP       all  --  0.0.0.0/0            0.0.0.0/0           
RETURN     all  --  0.0.0.0/0            0.0.0.0/0           

Chain DOCKER-USER (1 references)
target     prot opt source               destination         
RETURN     all  --  0.0.0.0/0            0.0.0.0/0      

允许所有input:

iptables -P INPUT ACCEPT

开机启动:

systemctl enable iptables

systemctl stop/start/restart iptables

chkconfig iptables off/on 永久关闭/开启

手动配置端口:

[root@k8s-node1 sysconfig]# clear
oot@k8s-node1 sysconfig]# vim /etc/sysconfig/iptables
▽
1 # sample configuration for iptables service
2 # you can edit this manually or use system-config-firewall
3 # please do not ask us to add additional ports/services to this default configuration
4 *filter
5 :INPUT ACCEPT [0:0]
6 :FORWARD ACCEPT [0:0]
7 :OUTPUT ACCEPT [0:0]
8 -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
9 -A INPUT -p icmp -j ACCEPT
10 -A INPUT -i lo -j ACCEPT
11 -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
12 -A INPUT -j REJECT --reject-with icmp-host-prohibited
13 -A FORWARD -j REJECT --reject-with icmp-host-prohibited
14 COMMIT

保存配置:

service iptables save

（三）常用规则

查看: iptables -L -n

允许所有通过: iptables -P INPUT ACCEPT

清空默认规则: iptables -F

清空自定义规则: iptables -X

计数器归零: iptables -Z

允许本地（lo接口数据包)访问: iptables -A INPUT -i lo -j ACCEPT

开放端口: iptables -A INPUT -p tcp --dport 22 -j ACCEPT

允许ping: iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT

允许接受本机请求之后的返回数据:  iptables -A INPUT -m state --state RELATED, ESTABLISHED -j ACCEPT

其他入站丢弃: iptables -P INPUT DROP

其他出站放行: iptables -P OUTPUT ACCEPT

所有转发丢弃: iptables -P FORWARD DROP

接收某ip所有请求: iptables -A INPUT -p tcp -s <ip> -j ACCEPT

过滤所有非以上规则请求: iptables -P INPUT DROP

封停ip: iptables -I INPUT -s <ip> -j DROP

解封ip: iptables -D INPUT -s <ip> -j DROP

保存配置: service iptables save

二、理解

1. 传输协议:

tcp udp icmp

2. 服务类型:

http ftp smtp

3. 处理方式:

accept reject drop

tcp/ip协议栈属于内核的一部分

web服务 属于 用户空间

web服务 监听 套接字 (IP:Port)，响应客户端请求时，响应报文的目标终点为 客户端, 此时 web 的ip:port成了原点。

netfilter 属于内核的一部分，内核中设置关卡，所有进出报文需通过关卡（input/output关卡）检查以做出放行、阻止，iptables中称为链。

IP_FORWARD用于将报文转发给其他机器

5种链:

路由前: PREROUTING

转发: FORWARD

路由后: POSTROUTING

进入本机: INPUT

从本机出去: OUTPUT

4种table:

filter: 负责过滤功能，iptables_filter，内核模块

nat: network address translation, iptables_nat

mangle: iptable_mangle, 报文拆解、修改、重装

raw: iptable_raw, 关闭nat上启用的连接追踪

优先级: raw->mangle->nat->filter

链与able:

prerouting: raw/nat/mangle

input: mangle/filter (centos7 nat)

forward: mangle/filter

output: raw/nat/mangle/filter

postrouting: mangle/nat

表(功能) ----链(钩子)

raw: prerouting/output

mangle: prerouting/input/forward/output/postrouting

nat: prerouting/ouput/postrouting(centos7 input)

filter: input/forward/output

linux主机支持转发:

/pro/sys/net/ipv4/ip_forward

规则:

基本条件: source ip, destination ip

扩展条件: source port, destination port

协作(target):

ACCEPT: 允许通过

DROP: 直接丢弃，不回复。

REJECT: 拒绝，回复响应信息

SNAT: 源地址转换, 内网用户用同一个公网连接外网

MASQUERADE: SNAT的特殊形式，用于动态、临时可能变动的ip上

DNAT: 目标地址转换

REDIRECT: 本机做端口映射

LOG: /var/log/messages文件中记录日志信息，除了记录不作任何操作，让数据包匹配下一条rule

三、命令

1. 查看表 iptables -t filter(默认)/raw/mangle/nat -L INPUT -v

-t: target

-L: list

-v: verbose

-I: insert （链的首部）

-A: append (链的尾部)

-s: source

-j: jump

-F: flush

-R: replace

-P: policy

[root@k8s-node1 sysconfig]# iptables --help
iptables v1.4.21

Usage: iptables -[ACD] chain rule-specification [options]
iptables -I chain [rulenum] rule-specification [options]
iptables -R chain rulenum rule-specification [options]
iptables -D chain rulenum [options]
iptables -[LS] [chain [rulenum]] [options]
iptables -[FZ] [chain] [options]
iptables -[NX] chain
iptables -E old-chain-name new-chain-name
iptables -P chain target [options]
iptables -h (print this help information)

Commands:
Either long or short options are allowed.
--append  -A chain            Append to chain
--check   -C chain            Check for the existence of a rule
--delete  -D chain            Delete matching rule from chain
--delete  -D chain rulenum
Delete rule rulenum (1 = first) from chain
--insert  -I chain [rulenum]
Insert in chain as rulenum (default 1=first)
--replace -R chain rulenum
Replace rule rulenum (1 = first) in chain
--list    -L [chain [rulenum]]
List the rules in a chain or all chains
--list-rules -S [chain [rulenum]]
Print the rules in a chain or all chains
--flush   -F [chain]          Delete all rules in  chain or all chains
--zero    -Z [chain [rulenum]]
Zero counters in chain or all chains
--new     -N chain            Create a new user-defined chain
--delete-chain
-X [chain]          Delete a user-defined chain
--policy  -P chain target
Change policy on chain to target
--rename-chain
-E old-chain new-chain
Change chain name, (moving any references)
Options:
--ipv4      -4              Nothing (line is ignored by ip6tables-restore)
--ipv6      -6              Error (line is ignored by iptables-restore)
[!] --protocol  -p proto        protocol: by number or name, eg. `tcp'
[!] --source    -s address[/mask][...]
source specification
[!] --destination -d address[/mask][...]
destination specification
[!] --in-interface -i input name[+]
network interface name ([+] for wildcard)
--jump -j target
target for rule (may load target extension)
--goto      -g chain
jump to chain with no return
--match       -m match
extended match (may load extension)
--numeric     -n              numeric output of addresses and ports
[!] --out-interface -o output name[+]
network interface name ([+] for wildcard)
--table       -t table        table to manipulate (default: `filter')
--verbose     -v              verbose mode
--wait        -w [seconds]    maximum wait to acquire xtables lock before give up
--wait-interval -W [usecs]    wait time to try to acquire xtables lock
default is 1 second
--line-numbers                print line numbers when listing
--exact       -x              expand numbers (display exact values)
[!] --fragment  -f              match second or further fragments only
--modprobe=<command>          try to insert modules using this command
--set-counters PKTS BYTES     set the counter during insert/append
[!] --version   -V              print package version.

示例:

iptables --line-numbers -vnL INPUT

iptables -t filter -I INPUT <line-num> -s <source-ip> -j DROP

iptables -t filter -D INPUT <rule line-num>

iptables -t filter -D INPUT -s <source-ip> -j DROP 

iptables -t filter -F <rule name>

iptables -t filter -R INPUT <rule line-no> -s <source-ip> -j <target>

iptables -t filter -P INPUT DROP

四、保存规则

/etc/sysconfig/iptables

iptables save

cat /etc/sysconfig/iptables

iptables restart重启（未保存会丢失）

iptables-save > /etc/sysconfig/iptables

iptables-restore < /etc/sysconfig/iptables

会覆盖