17. Local Firewall, 17. Firewall

17. Local Firewall, 17. Firewall
Local Firewall

 

[Root @ localhost root] # vi fw. sh

#! /bin/bashmodprobe ip_conntrack_ftpIPT="iptables -A INPUT"iptables -F INPUT$IPT -i lo -j ACCEPT$IPT -p tcp -s  192.168.170.0/24 -m multiport \--dport 21,25,80,110 -j ACCEPT$IPT -p tcp -s 192.168.170.1 --dport 22 -j ACCEPT$IPT -m state --state RELATED,ESTABLISHED -j ACCEPT$IPT -j REJECT

(Explanation)

modprobe ip_conntrack_ftp

Explicitly Add the module. In order to solve the problem of ftp connection, the command (such as ls) cannot be executed.

IPT="iptables -A INPUT"

-A indicates adding A rule.-D indicates deleting A rule.-F indicates clearing A rule.

iptables -F INPUT

Clear INPUT chain

$ Ipt-i lo-j ACCEPT-I interface

-O-out Interface

That is, all the send-back interfaces receive

$IPT -p tcp -s  192.168.170.0/24 -m multiport \--dport 21,25,80,110 -j ACCEPT

-p   tcp/udp/imap

-S source IP address

-D target IP Address

-- Sport Source Port

-Dport: Target Port

For the network segment 192.168.170.0/24, packets whose ports are 80,110 and receive

$IPT -p tcp -s 192.168.170.1 --dport 22 -j ACCEPT

Allow Windows to locally connect to Linux (PuTTY)

$IPT -m state --state RELATED,ESTABLISHED -j ACCEPT

State:

NEW Connection RELATED connection ESTABLISHED has ESTABLISHED connection INVALID illegal connection

Allow related connections. receive packets after a connection is established

$IPT -j REJECT

Does not meet all the above rejection

[root@localhost root]#  

Sh fw. sh

 

In Windows, use the command line

Basically finished. The content of the mid-term volume will be sent next time.