前言:
当前各位老铁们对“iptables域名”可能比较关心,大家都需要了解一些“iptables域名”的相关内容。那么小编也在网络上收集了一些关于“iptables域名””的相关文章,希望你们能喜欢,我们快快来了解一下吧!#头条文章发文任务#
2、1 iptables命令--帮助信息。
[root@Nagios2 ~]# iptables -h iptables v1.4.7Usage: iptables -[AD] chain rule-specification [options] iptables -I chain [rulenum] rule-specification [options] iptables -R chain rulenum rule-specification [options] iptables -D chain rulenum [options] ###删除规则 iptables -[LS] [chain [rulenum]] [options] iptables -[FZ] [chain] [options] iptables -[NX] chain iptables -E old-chain-name new-chain-name iptables -P chain target [options] #(其中-p等同于 –policy规则) iptables -h (print this help information)Commands:Either long or short options are allowed.提示:这款请注意。长格式短格式命令都可用、为了打字我们习惯于端格式 --append -A chain Append to chain --delete -D chain Delete matching rule from chain --delete -D chain rulenum Delete rule rulenum (1 = first) from chain --insert -I chain [rulenum] Insert in chain as rulenum (default 1=first) --replace -R chain rulenum Replace rule rulenum (1 = first) in chain --list -L [chain [rulenum]] List the rules in a chain or all chains --list-rules -S [chain [rulenum]] Print the rules in a chain or all chains --flush -F [chain] Delete all rules in chain or all chains --zero -Z [chain [rulenum]] Zero counters in chain or all chains --new -N chain Create a new user-defined chain --delete-chain -X [chain] Delete a user-defined chain --policy -P chain target Change policy on chain to target --rename-chain -E old-chain new-chain Change chain name, (moving any references)Options:[!] --proto -p proto protocol: by number or name, eg. `tcp'[!] --source -s address[/mask][...] source specification[!] --destination -d address[/mask][...] destination specification[!] --in-interface -i input name[+] network interface name ([+] for wildcard) --jump -j target target for rule (may load target extension) --goto -g chain jump to chain with no return --match -m match extended match (may load extension) --numeric -n numeric output of addresses and ports[!] --out-interface -o output name[+] network interface name ([+] for wildcard) --table -t table table to manipulate (default: `filter') --verbose -v verbose mode --line-numbers print line numbers when listing --exact -x expand numbers (display exact values)[!] --fragment -f match second or further fragments only --modprobe=<command> try to insert modules using this command --set-counters PKTS BYTES set the counter during insert/append[!] --version -V print package version.[root@Nagios2 ~]#2、2实践iptables命令规则2、2、1启动并查看iptables
[root@Nagios2 ~]# /etc/init.d/iptables startiptables: Applying firewall rules: [ OK ][root@Nagios2 ~]#
iptables 所有链和规则查看
Iptables –L –n 或者 iptables –L –n –t filter 或者 iptables –L –n –x –v 中文说明:-L :列出一个或所有链的规则-v:显示详细信息、包括每条规则匹配包数量和匹配字节数-x:在v的基础上、进制自动单位换算(K,M)-n: 只显示IP地址和端口号码。不显示域名和服务名称-t : 接表名、如果不加-t,默认就是 –t filter
[root@Nagios2 ~]# iptables -L -nChain INPUT (policy ACCEPT)target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT)target prot opt source destination REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT)target prot opt source destination
默认是filter的,没有加 –t 默认查看的就是如果想要查看NAT的表
[root@Nagios2 ~]# iptables -L -n -t nat Chain PREROUTING (policy ACCEPT)target prot opt source destination Chain POSTROUTING (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@Nagios2 ~]#2、2、2清除默认规则
为了从头学起,我们需要首先清除掉所有的默认规则、具体的命令为
Iptables –F ###清除所有规则Iptables –X ####删除用户自定义的链Iptables –Z ####链的计数器清零
提示:默认情况下,我们清除规则是对filter表的操作、如果是nat表、我们需要iptables –t nat –F
实例演示2:[root@Nagios2 ~]# iptables -F[root@Nagios2 ~]# iptables –flush2、2、3 iptables规则语法
1)禁止ssh默认的22端口
[root@Nagios2 ~]# iptables -A INPUT -p tcp --dport 22 -j DROP[root@Nagios2 ~]# iptables -t filter -A INPUT -p tcp --dport 22 -j DROP 提示:1、iptables 默认用的就是filter表 。因此,以上两条命令等价。2、其中INPUT DROP 等关键词要大写的3、行为参数--jump -j target 提示: target 的常见的处理方法有ACCEPT(接受),DROP(丢弃),REJECT(拒接)其中、一般不使用REJECT行为、REJECT会带来安全隐患、在这里我们只需要记住ACCEPT(接受)、DROP(丢弃)即可、
扩展:删除设定的规则
iptables –D INPUT –p tcp –dport 22 –j DROP
删除规则法二:
首先显示规则号
[root@Nagios2 ~]# iptables -L -n --line-numbersChain INPUT (policy ACCEPT)num target prot opt source destination 1 DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:21 Chain FORWARD (policy ACCEPT)num target prot opt source destination Chain OUTPUT (policy ACCEPT)num target prot opt source destination [root@Nagios2 ~]#[root@Nagios2 ~]# iptables -D INPUT 1
删除规则三:
执行iptables –F 清除所有的规则,临时生效。重启防火墙或重启计算机失效
删除规则法四:
重启防火墙/etc/init.d/iptables restart
2) 禁止11.0.0.0/24 网段连入
iptables -A INPUT –i eth0 -s 11.0.0.0/24 -j DROPiptables -t filter -A INPUT –i eth0 -s 11.0.0.0/24 -j DROP
iptables 默认的标记是filter表。因此上两条命令等价。
3) 测试 【! 非】
1、源地址不是192.168.131.201 的禁止连接
iptables –A INPUT –I eth1 –s ! 192.168.131.201 –j DROP iptables –A INPUT –I eth1 –s ! 192.168.131.201 –j ACCEPT[root@Nagios2 ~]# iptables -I INPUT -p icmp --icmp-type 8 -i eth0 -s ! 192.168.131.1 -j DROP小提示:1) 这里-i eht0表示数据包的进入接口为eth0、类似的参数还有-o匹配数据流出的网络接口例如:-o eth1 表示数据包的进入接口为eth1.记忆方法:-in-interface –i [!] input name [+] Network interface name ([+] for wildcard)-out-interface –o [!] ouput name[+] Network interface name ([+] for wildcard)
2、源地址不是192.168.131.0/24 的禁止连接
iptables -A INPUT -s ! 192.168.131.0/24 -j DROP等价于Iptables –t filter –I INPUT –i eht0 –s ! 192.168.131.0/24 –j DROP
3、封掉3300端口
iptables –A INPUT –p tcp –dport 3300 –j DROP
4、匹配指定协议
Iptables –A INPUT –p tcpIptables –A INPUT –p udp小提示:-p 参数可以匹配协议名或者协议号。--proto –p [!] portoThe specified protocol can be one of tcp,udp ,icmp.or all
5、匹配协议外的所有协议
Iptables –A INPUT –p ! tcp
6、匹配主机
Iptables –A INPUT –s 192.168.131.10Iptables –A INPUT –s ! 192.168.131.10
7、匹配网段
8、匹配端口之外的端口
Iptables –A INPUT –p tcp –dport !20 -j DROP
9、匹配端口范围
Iptables –A INPUT –p tcp –sport 22:80 ###源端口的22 和80端口就是来访主机的端口iptables -A INPUT -p tcp -m multiport --dport 21,22,23,24 -j ACCEPT ###目的端口。就是本地端口Iptables –I INPUT –p tcp –dport 3306:8809 –j ACCEPT
10、匹配ICMP端口和ICMP类型
Iptables –A INPUT –p icmp –icmp-type 8例如:iptables –A INPUT –p imcp –icmp-type 8 –j DROPIptables –A INPUT –p icmp –m icmp –icmp-type any –j ACCEPTIptables –A FORWARD –s 192.168.132.0/24 –p icmp –m icmp –icmp-type any –j ACCEPT
11、匹配指定的网络接口
Iptables –A INPUT –i eth0 ###进入端口的数据包Iptables –A INPUT –o eth1 ###出入的端口数据包
12、安全保护
Syn-flood protection;[root@Nagios4 ~]# iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPTFurtive port scanner :[root@Nagios4 ~]# iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPTPing of death:[root@Nagios4 ~]# iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
标签: #iptables域名