Iptables防火墙配置

iptables 服务的配置文件：/etc/sysconfig/iptables-config

系统默认策略： /etc/sysconfig/iptables

一查看现有iptables配置信息

[root@Linux-180Desktop]# iptables -tfilter -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

ACCEPT icmp -- anywhere anywhere

ACCEPT all -- anywhere anywhere

ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh

REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

target prot opt source destination

REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

[root@Linux-180 Desktop]# iptables -t nat -L

Chain PREROUTING (policy ACCEPT)

target prot opt source destination

Chain POSTROUTING (policy ACCEPT)

target prot opt source destination

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

[root@Linux-180 Desktop]# service iptables status

Table: nat

Chain PREROUTING (policy ACCEPT)

num target prot opt source destination

Chain POSTROUTING (policy ACCEPT)

num target prot opt source destination

Chain OUTPUT (policy ACCEPT)

num target prot opt source destination

Table: filter

Chain INPUT (policy ACCEPT)

num target prot opt source destination

1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0

3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22

5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

num target prot opt source destination

1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

num target prot opt source destination

清除规则和定义默认策略

1清除链中所有已定义的规则

[root@Linux-180 Desktop]# iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED

ACCEPT icmp -- anywhere anywhere

ACCEPT all -- anywhere anywhere

ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh

REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

target prot opt source destination

REJECT all -- anywhere anywhere reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

[root@Linux-180 Desktop]# iptables -F

[root@Linux-180 Desktop]# iptables -L

Chain INPUT (policy ACCEPT)

target prot opt source destination

Chain FORWARD (policy ACCEPT)

target prot opt source destination

Chain OUTPUT (policy ACCEPT)

target prot opt source destination

语法规则

iptables [-t table] -P [chain] [ACCEPT|DROP]

-P 定义策略，ACCEPT 接受数据包 DROP直接丢弃数据包，对数据包不作任何回应

[root@Linux-180 Desktop]# iptables -P INPUT DROP

[root@Linux-181 network-scripts]# ping172.16.40.180

PING 172.16.40.180 (172.16.40.180) 56(84)bytes of data.

--- 172.16.40.180 ping statistics ---

8 packets transmitted, 0 received, 100%packet loss, time 7866ms

[root@Linux-180 Desktop]# iptables -P INPUT ACCEPT

[root@Linux-181 network-scripts]# ping172.16.40.180

PING 172.16.40.180 (172.16.40.180) 56(84)bytes of data.

64 bytes from 172.16.40.180: icmp_seq=1ttl=64 time=0.284 ms

64 bytes from 172.16.40.180: icmp_seq=2ttl=64 time=0.248 ms

64 bytes from 172.16.40.180: icmp_seq=3ttl=64 time=0.223 ms

64 bytes from 172.16.40.180: icmp_seq=4ttl=64 time=0.224 ms

64 bytes from 172.16.40.180: icmp_seq=5ttl=64 time=0.344 ms

--- 172.16.40.180 ping statistics ---

5 packets transmitted, 5 received, 0%packet loss, time 4771ms

rtt min/avg/max/mdev =0.223/0.264/0.344/0.048 ms

设置数据包的基本判断条件

语法

iptables [-AI 链] [-io网络接口] [-p 协议] [-s 来源地址/子网掩码] [-d 目标地址/子网掩码] [--sport 端口范围] [--dport 端口范围] -j [ACCEPT/DROP/REJECT]

如

#iptables -A INPUT -i lo -j ACCEPT

#iptables -A INPUT -i eth0 -s 172.16.40.0/24 -j ACCEPT

#iptables -A INPUT -s 172.16.40.181 -d 172.16.40.180 –pTCP --dport 22 -j ACCEPT

指定拒绝源目标IP (在机器172.16.40.180上执行)

#iptables -A INPUT -s 172.16.40.181 -j REJECT

Linux机器，IP为172.16.4.181不可以ping通172.16.40.180机器

[root@Linux-181 network-scripts]# ping 172.16.40.180

PING 172.16.40.180 (172.16.40.180) 56(84) bytes of data.

From 172.16.40.180 icmp_seq=1 Destination Port Unreachable

From 172.16.40.180 icmp_seq=2 Destination Port Unreachable

From 172.16.40.180 icmp_seq=3 Destination Port Unreachable

--- 172.16.40.180 ping statistics ---

3 packets transmitted, 0 received, +3 errors, 100% packet loss, time2434ms

Windows机器，IP为172.16.4.80仍然可以ping通172.16.40.180机器

C:\Users\fengjw>ping 172.16.40.180

正在 Ping 172.16.40.180 具有 32 字节的数据:

来自 172.16.40.180 的回复: 字节=32 时间<1ms TTL=64

172.16.40.180 的 Ping 统计信息:

数据包: 已发送 = 4，已接收 = 4，丢失 = 0 (0% 丢失)，

往返行程的估计时间(以毫秒为单位):

最短 = 0ms，最长 = 0ms，平均 = 0ms

拒绝使用本机的ssh服务

# iptables -A INPUT -ptcp --dport 22 -j REJECT

图形配置方式

# system-config-firewall

转载于:https://blog.51cto.com/newcourage/1928435

Iptables防火墙配置相关推荐

Iptables防火墙配置详解
iptables防火墙配置详解 iptables简介 iptables是基于内核的防火墙,功能非常强大,iptables内置了filter,nat和mangle三张表. (1)filter表负责过滤数 ...
Linux学习笔记 --iptables防火墙配置
iptables防火墙配置一.防火墙简介 1.功能: 1)通过源端口,源IP地址,源MAC地址,包中特定标记和目标端口,IP,MAC来确定数据包是否可以通过防火墙 2)分割内网和外网[附带的路由器的 ...
centos iptables 防火墙配置
2019独角兽企业重金招聘Python工程师标准>>> 配置Cento6.4 iptables防火墙. 1. 查看防火墙状态 service iptables status #或 / ...
iptables防火墙配置工具ShoreWall的安装和使用实例
shorewall不是一个daemon的程序,它是一个加载iptables指令的套件,所以请别指望使用ps -aux这类的指令来查询它的行程,接下来的部份就分别说明各个设定文件的功能及格式. 本质上来 ...
Keepalived 无法自动转换主备角色，请关注 iptables 防火墙配置
最近在研究服务器高可用集群 (HA)-- 搭建了主备两台Keepalived,配置什么的全是网上照抄的,被验证过无数遍的示例-- 然而Master和Backup无法自动切换.两边会同时绑定浮动IP(V ...
Linux下iptables防火墙配置
目录一.Linux防火墙基础 1.1 防火墙概述 1.2 四表五链二. iptables--命令 2.1 iptables的安装 2.2 iptables的配置方法三.配置Filter表防火墙 ...
Linux中iptables防火墙配置实例分享
转自:http://www.jbxue.com/LINUXjishu/9827.html iptables -I OUTPUT -d 192.168.1.2 -j DROP // 禁止往外向192.1 ...
服务器防火墙，linux下iptables防火墙配置相关
iptables防火墙 iptables常用命令 iptables配置文件`/etc/sysconfig/iptables` iptables服务命令 -- 启动服务 -- 停止服务 -- 重启服务 ...
阿里云服务器配置开发环境第五章：Centos7.3切换为iptables防火墙
centos7.3默认使用的防火墙应该是firewall,而不是iptables.而我们xxmj服务器使用的是iptables防火墙.所以,在配置防火墙之前,我们需要先关闭firewall,安装ipt ...

Iptables防火墙配置

Iptables防火墙配置相关推荐

最新文章

热门文章