2018-1-25 Linux Learning notes [important]

10.15 iptables Filter Table case

Iptables Filter Table Small case
Implement release 21,80 port and IP segment request release port 22 for source IP belonging to 133.168.133.0:
vi/usr/local/sbin/iptables.sh//Add the following:
#! /bin/bash
ipt= "/usr/sbin/iptables"
$ipt-F #清空之前的规则 (filter table)
$ipt-P INPUT DROP
$ipt-P OUTPUT ACCEPT
$ipt-P Fordard ACCEPT
$ipt-A input-m stat--state related,established-j ACCEPT #放行状态为RELATED, established request
$ipt-A input-s 192.168.133.0/24-p TCP--dport 22-j ACCEPT
$ipt-A input-p TCP--dport 80-j ACCEPT
$ipt-A input-p TCP--dport 21-j ACCEPT

Note:
The above script line 7th to add related because the client and the server to establish a connection, there are some additional connections need to be established, then the state becomes
Related, in order to be able to communicate not affected, so here need to add related.

ICMP Example:
Implement this function to ping other machines, but other machines can not ping through the machine:
Iptables-i input-p ICMP--icmp-type 8-j DROP

10.16/10.17/10.18 iptables NAT Table Application

Experimental background:
A machine two Nic Ens33 (192.168.133.130), ENS37 (192.168.100.1), ENS33 can Sisu network, ENS37 is only internal network, B machine only
ENS37 (192.168.100.100), and a machine ens37 can be communicated to interconnect.

* Requirement 1: Allow the B machine to connect the external network
(1) Turn on routing forwarding on a machine (1 means turn on route forwarding, default is 0, off state)
echo "1" >/proc/sys/net/ipv4/ip_forward
(2) Perform on Machine A
Iptables-t nat-a postrouting-s 192.168.100.0/24-o ens33-j Masquerade
(3) Set the gateway to 192.168.100.1 on the B machine

* Demand 2:C machine can only communicate with a, so that the C machine can directly connect the B machine's 22 port
(1) Turn on routing forwarding on a machine (1 means turn on route forwarding, default is 0, off state)
echo "1" >/proc/sys/net/ipv4/ip_forward
(2) Perform on Machine A
Iptables-t nat-a prerouting-d 192.168.133.130-p tcp--dport 1122-j DNAT--to 192.168.100.100:22
Iptables-t nat-a postrouting-s 192.168.100.100-j SNAT--to 192.168.133.130
(3) Set the gateway to 192.168.100.1 on the B machine

Note:

1. Use ifconfig temporarily to assign IP address to network card (after restart, if you want to change the configuration file permanently)
   Syntax: ifconfig NIC name IP address/24, for example:
   Ifconfig ens37 192.168.1.100/24
2. Setting up the Gateway
   Syntax: ROUTE add default GW IP address, for example:
   Route add default GW 192.168.100.1

2018-1-25 Linux Learning notes [important]