防火墙_iptables设定
1.超级火墙管理
查看软件yum search iptables
yum list iptables-services.x86_64
安装软件yum install iptables -y
关闭普通火墙systemctl stop firewalld
systemctl mask firewalld
systemctl start iptables.service
systemctl enable iptables.service
不解析列出火墙设置iptables -nL //n不解析，L列出
配置文件vim /etc/sysconfig/iptables
刷新，临时清空iptables -F
清空> /etc/sysconfig/iptables
方法二，临时清空后service iptables save保存设定
添加火墙策略设置iptables -A INPUT -j ACCEPT
策略保存service iptables save
【实验】
[[email protected] ~]# yum search iptables
iptables-services.x86_64
[[email protected] ~]# yum list iptables-services.x86_64
[[email protected] ~]# systemctl stop firewalld
[[email protected] ~]# systemctl mask firewalld
ln -s '/dev/null' '/etc/systemd/system/firewalld.service'
[[email protected] ~]# systemctl start iptables.service
[[email protected] ~]# systemctl enable iptables.service
ln -s '/usr/lib/systemd/system/iptables.service' '/etc/systemd/system/basic.target.wants/iptables.service'
[[email protected] ~]# iptables -nL
[[email protected] ~]# vim /etc/sysconfig/iptables
[[email protected] ~]# iptables -F
[[email protected] ~]# iptables -nL
[[email protected] ~]# iptables -F
[[email protected] ~]# iptables -nL //此时为临时，重启动后失效
[[email protected] ~]# systemctl restart iptables.service
[[email protected] ~]# iptables -nL
[[email protected] ~]# > /etc/sysconfig/iptables //清空
[[email protected] ~]# iptables -F
[[email protected] ~]# iptables -nL
[[email protected] ~]# systemctl restart iptables.service
[[email protected] ~]# iptables -nL
添加火墙策略设置
[[email protected] ~]# iptables -A INPUT -j ACCEPT
[[email protected] ~]# iptables -nL
[[email protected] ~]# service iptables save//策略保存
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
2.iptables的设定
查看帮助man ipitables
-t指定表名filter -s来源sorce -i匹配端口eg：-i lo lo回环接口-A添加 -d目的地 -o端口
-I插入INPUT -p方式port --dport端口
-D删除 -j动作 ACCEPT|REJECT|DROP
filter所有经过本机内核的数据
nat从本机通过的数据不经过内核
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A INPUT -s 172.25.254.3 -j ACCEPT
【实验】
查看三个表
[[email protected] ~]# iptables -t nat -nL
[[email protected] ~]# iptables -t filter -nL
[[email protected] ~]# iptables -t mangle -nL
设置端口设定
[[email protected] ~]# iptables -t filter -A INPUT -i lo -j ACCEPT
[[email protected] ~]# iptables -t filter -A INPUT -s 172.25.254.3 -j ACCEPT
[[email protected] ~]# iptables -nL
[[email protected] ~]# iptables -A INPUT -j REJECT
[[email protected] ~]# iptables -D INPUT 1
[[email protected] ~]# iptables -D INPUT 2
[[email protected] westos]# ssh [email protected]//此时无法连接
ssh: connect to host 172.25.254.103 port 22: Connection refused
[[email protected] ~]# iptables -A INPUT -s 172.25.254.203 -p tcp --dport 22 -j ACCEPT
[[email protected] ~]# iptables -nL
ACCEPT tcp -- 172.25.254.203 0.0.0.0/0 tcp dpt:22
插入
[[email protected] ~]# iptables -I INPUT 1 -s 172.25.254.20 -p tcp --dport 22 -j ACCEPT
[[email protected] ~]# iptables -nL
ACCEPT tcp -- 172.25.254.20 0.0.0.0/0 tcp dpt:22
ACCEPT tcp -- 172.25.254.203 0.0.0.0/0 tcp dpt:22
[[email protected] ~]# systemctl start smb
[[email protected] westos]# smbclient -L //172.25.254.103
Enter root's password:
Connection to 172.25.254.103 failed (Error NT_STATUS_CONNECTION_REFUSED)
此时需要开启139和445端口
[[email protected] ~]# iptables -I INPUT 1 -s 172.25.254.203 -p tcp --dport 139 -j ACCEPT
[[email protected] ~]# iptables -I INPUT 1 -s 172.25.254.203 -p tcp --dport 445 -j ACCEPT
[[email protected] westos]# smbclient -L //172.25.254.103
Enter root's password:
Domain=[WESTOS_SERVER103] OS=[Unix] Server=[Samba 4.1.1]
Sharename Type Comment
--------- ---- -------
DATA Disk local sambadir
SYSTEMCTLDATA Disk /mnt
IPC$ IPC IPC Service (hello world 103)
Domain=[WESTOS_SERVER103] OS=[Unix] Server=[Samba 4.1.1]
Server Comment
--------- -------
Workgroup Master
--------- -------
！！！！！！！！！！！！！！！！
iptables -nL 中是从上往下依次执行，要注意顺序
7.iptables策略设置二
-R修改策略信息
-P(大写)更改默认设定Policy，默认只能用ACCEPT和DROP
-N添加
-E更名
-X删除
【实验】
[[email protected] ~]# iptables -R INPUT 2 -s 172.25.254.203 -p tcp --dport 53 -j ACCEPT
[[email protected] ~]# iptables -nL
ACCEPT tcp -- 172.25.254.203 0.0.0.0/0 tcp dpt:53
[[email protected] ~]# iptables -P INPUT DROP
[[email protected] ~]# iptables -nL
Chain INPUT (policy DROP)
[[email protected] ~]# iptables -P INPUT ACCEPT
[[email protected] ~]# iptables -t filter -N westos
[[email protected] ~]# iptables -nL
Chain westos (0 references)
target prot opt source destination
[[email protected] ~]# iptables -t filter -E westos WESTOS
[[email protected] ~]# iptables -nL
Chain WESTOS (0 references)
[[email protected] ~]# iptables -t filter -X WESTOS
[[email protected] ~]# iptables -nL
此时的WESTOS消失
8.超级火墙的优化
iptables -F
netstat -antlupe
-m
iptables -A INPUT -m state --state NEW -i lo -j ACCEPT //允许回环接口接入
iptables -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT //允许ssh接口接入
iptables -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT //允许dns接口接入
iptables -A INPUT -m state --state NEW -p tcp --dport 139 -j ACCEPT //允许smb接口接入
iptables -A INPUT -m state --state NEW -p tcp --dport 445 -j ACCEPT //允许smb接口接入
iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT //允许http接口接入
iptables -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT //允许https接口接入
iptables -A INPUT ! -s 172.25.254.3 -j ACCEPT //不允许不是3的机器接入，满足3或者满足以上所有才可接入
iptables -nL
service iptables save //保存
//RELATED 以前来过的端口，历史记录存在过的
//ESTABLISHED 正在进行的端口
【实验】
[[email protected] ~]# iptables -F
[[email protected] ~]# iptables -nL
[[email protected] ~]# netstat -antlupe
tcp 0 0 172.25.254.103:22 172.25.254.3:40876 ESTABLISHED 0 98920 5720/sshd: [email protected]
[[email protected] ~]# iptables -A INPUT -m state --state NEW -i lo -j ACCEPT [[email protected] ~]# iptables -A INPUT -m state --state NEW -p tcp --dport 22 -j ACCEPT
[[email protected] ~]# iptables -A INPUT -m state --state NEW -p tcp --dport 53 -j ACCEPT
[[email protected] ~]# iptables -A INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT
[[email protected] ~]# iptables -A INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT
[[email protected] ~]# iptables -A INPUT ! -s 172.25.254.3 -j ACCEPT
[[email protected] ~]# iptables -nL
//RELATED 以前来过的端口，历史记录存在过的
//ESTABLISHED 正在进行的端口
[[email protected] ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
10.NAT的设置 源地址转换
【准备】
virt-manager虚拟机管理器
server加一个网卡，设置为192.168.0.103
desktop单网卡设置为192.168.0.203
检测desktop ping方法
route -n检测网关设置
ifconfig检测ip设置
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 172.25.254.103
把192.168.0.203发送来的数据包来源转换为172.25.254.103
在desktop加入网关192.168.0.103，重启网络route -n查看
【实验】
[[email protected] ~]# iptables -t nat -nL //查看
Chain POSTROUTING (policy ACCEPT) //表示在路由后
[[email protected] ~]# iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 172.25.254.103 //SNAT源地址转换
[[email protected] ~]# iptables -t nat -nL
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 0.0.0.0/0 0.0.0.0/0 to:172.25.254.103
在desktop加入网关192.168.0.103，重启网络route -n查看 ping172.25.254.103检测（可通）
ping172.25.254.3不通
------------>原因：内核功能未开启（路由）
[[email protected] ~]# sysctl -a | grep ip_forward
net.ipv4.ip_forward = 0
[[email protected] ~]# vim /etc/sysctl.conf
5 net.ipv4.ip_forward = 1
[[email protected] ~]# sysctl -p
net.ipv4.ip_forward = 1
此时用desktop客户机ping172.25.254.3可通
检测：
用192.168.0.203 ssh [email protected]
后用w查看访问的数据来源
[[email protected] ~]# iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-dest 192.168.0.203 //-i input 数据入口 数据入口eth1看不到，不能用eth1
[[email protected] ~]# iptables -nL
[[email protected] ~]# iptables -nL -t nat