Home > Developer > Linux

How to Use iptables in enterprise in Centos

Source: Internet
Author: User
Developer on Alibaba Coud: Build your first app with APIs, SDKs, and tutorials on the Alibaba Cloud. Read more ＞

Iptables enterprise applications:

, An experiment environment built using a virtual machine:

1. the laptop (Internet users for short) simulates Internet users. in Linux, the intermediate server (GATEWAY) uses the iptables firewall as the Intranet gateway. windows2003 is a server in the Intranet. 4. in the client computer on the Intranet, the gateway eth0 communicates with the laptop through bridging, and eth1 uses the vmm (VMnet1 host-only) method in Windows2003, which also uses the vmm (VMnet1 host-only) method.
Test: ping the gateway from an intranet Client

Can the gateway itself access the Internet?


Lab started: 1. Enable the gateway's kernel packet forwarding function. The packet forwarding function is disabled by default in Linux.
  
  
    
   
   
  1. [Root @ server1 ~] # Echo "1"/proc/sys/net/ipv4/ip_forward # This can be enabled, but it becomes invalid after restart because the file is in the memory.
    2.
In this case, modify the Kernel configuration file vim/etc/sysctl. conf.
  
  
    
   
   
  1. # Controls IP packet forwarding
    2. 
   
   
  2. Net. ipv4.ip _ forward = 1 # Find this line and change 0 to 1
    3. 
  
  

  
  
    
   
   
  1. [Root @ server1 ~] # Sysctl-p # This command can reload these commands into the kernel
    2. 
   
   
  2. Net. ipv4.ip _ forward = 1
    3. 
   
   
  3. Net. ipv4.conf. default. rp_filter = 1
    4. 
   
   
  4. Net. ipv4.conf. default. accept_source_route = 0
    5. 
   
   
  5. Kernel. sysrq = 0
    6. 
   
   
  6. Kernel. core_uses_pid = 1
    7. 
   
   
  7. Net. ipv4.tcp _ syncookies = 1
    8. 
   
   
  8. Kernel. msgmnb = 65536
    9. 
   
   
  9. Kernel. msgmax = 65536
    10. 
   
   
  10. Kernel. shmmax = 4294967295
    11. 
   
   
  11. Kernel. shmall = 268435456
    12. 
  
  

  
  
    
   
   
  1. [Root @ server1 ~] # Cat/proc/sys/net/ipv4/ip_forward # the value of this file is 1.
    2. 
   
   
  2. 1
    3. 
   
   
  3. [Root @ server1 ~] #
    4.
2. Perform SNAT on the gateway so that the Intranet computer can connect to the Internet
   
   
    
    
    
  1. [root@server1 ~]# iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to 192.168.18.110 
    2.

There is also a premise for the client to access the Internet, that is, the FORWARD chain in the iptables filter table is in the ACCEPT state by default, so that the client can access the Internet. If the DROP status is used by default, the client cannot access the Internet.


3. Methods for enabling clients to access the Internet
Method 1: Set the default FORWARD policy to DROP, and then open the service one by one.Only services or software that we know the port (capture packets with tools and analyze the IP addresses and ports) can be opened,This situation will cause the use of thunder and other software (because I do not know the port used for downloading thunder)
1. ping
          
          
    
           
           
  1. iptables -t filter -A FORWARD -p icmp -j ACCEPT 
    2.
2. Check that the target ports on the Intranet client of the webpage are 80 or 53.
          
          
    
           
           
  1. Iptables-t filter-a forward-p tcp-I eth1 -- dport 80-s 192.168.0.0/24-j ACCEPT
    2. 
           
           
  2. Iptables-t filter-a forward-p tcp-I eth1 -- dport 53-s 192.168.0.0/24-j ACCEPT
    3. 
           
           
  3. Iptables-t filter-a forward-p udp-I eth1 -- dport 53-s 192.168.0.0/24-j ACCEPT
    4. 
           
           
  4. You can write one of them.
    5. 
           
           
  5. Iptables-t filter-a forward-p tcp -- dport 80-s 192.168.0.0/24-j ACCEPT
    6. 
           
           
  6. Iptables-t filter-a forward-p tcp -- dport 53-s 192.168.0.0/24-j ACCEPT
    7. 
           
           
  7. Iptables-t filter-a forward-p udp -- dport 53-s 192.168.0.0/24-j ACCEPT
    8.
The source ports returned after resolution are 80, and all the 53 ports are allowed.
          
          
    
           
           
  1. Iptables-t filter-a forward-p tcp-I eth0 -- sport 80-d 192.168.0.0/24-j ACCEPT
    2. 
           
           
  2. Iptables-t filter-a forward-p udp-I eth0 -- sport 53-d 192.168.0.0/24-j ACCEPT
    3. 
           
           
  3. Iptables-t filter-a forward-p tcp-I eth0 -- sport 53-d 192.168.0.0/24-j ACCEPT
    4. 
           
           
  4. Or, either of them is enough.
    5. 
           
           
  5. Iptables-t filter-a forward-p tcp -- sport 80-d 192.168.0.0/24-j ACCEPT
    6. 
           
           
  6. Iptables-t filter-a forward-p udp -- sport 53-d 192.168.0.0/24-j ACCEPT
    7. 
           
           
  7. Iptables-t filter-a forward-p tcp -- sport 53-d 192.168.0.0/24-j ACCEPT
    8.
3. Email receiving and receiving
          
          
    
           
           
  1. iptables -t filter -A FORWARD -p tcp --dport 25 -s 192.168.0.0/24 -j ACCEPT 
    2. 
           
           
  2. iptables -t filter -A FORWARD -p tcp --sport 25 -d 192.168.0.0/24 -j ACCEPT 
    3. 
           
           
    4. 
           
           
  4. iptables -t filter -A FORWARD -p tcp --sport 110 -d 192.168.0.0/24 -j ACCEPT 
    5. 
           
           
  5. iptables -t filter -A FORWARD -p tcp --dport 110 -s 192.168.0.0/24 -j ACCEPT 
    6. 
           
           
    7. 
           
           
  7. iptables -t filter -A FORWARD -p tcp --sport 143 -d 192.168.0.0/24 -j ACCEPT 
    8. 
           
           
  8. iptables -t filter -A FORWARD -p tcp --dport 143 -s 192.168.0.0/24 -j ACCEPT 
    9.
You can set other ports in a similar way.
4. When you log on to QQQQ, you can use two cases: udp 8000, tcp 80, and 443. It will automatically detect that port is open and that port is open, so you can use that port to log on to UDP 8000.
          
          
    
           
           
  1. Iptables-t filter-a forward-p udp -- dport 8000-s 192.168.0.0/24-j ACCEPT
    2. 
           
           
  2. Iptables-t filter-a forward-p udp -- sport 8000-d 192.168.0.0/24-j ACCEPT
    3. 
           
           
    4. 
           
           
  4. Tcp 80 (same as port 80 on the webpage, so as long as you can view the webpage, you can access QQ)
    5. 
           
           
  5. Iptables-t filter-a forward-p tcp -- sport 80-d 192.168.0.0/24-j ACCEPT
    6. 
           
           
  6. Iptables-t filter-a forward-p tcp -- dport 80-s 192.168.0.0/24-j ACCEPT
    7. 
           
           
    8. 
           
           
  8. TCP/IP 443
    9. 
           
           
  9. Iptables-t filter-a forward-p tcp -- sport 443-d 192.168.0.0/24-j ACCEPT
    10. 
           
           
  10. Iptables-t filter-a forward-p tcp -- dport 443-s 192.168.0.0/24-j ACCEPT
    11.
The stricter measure is to find the address of the QQ Login server, and then set:
          
          
    
           
           
  1. iptables -t filter -A FORWARD -p tcp --dport 443 -s 192.168.0.0/24 -d 119.147.45.43 -j ACCEPT 
    2. 
           
           
  2. iptables -t filter -A FORWARD -p tcp --sport 443 -s 119.147.45.43 -d 192.168.0.0/24 -j ACCEPT 
    3. 
           
           
    4. 
           
           
  4. iptables -t filter -A FORWARD -p tcp --dport 80 -s 192.168.0.0/24 -d 112.95.240.16 -j ACCEPT 
    5. 
           
           
  5. iptables -t filter -A FORWARD -p tcp --sport 80 -s 112.95.240.16 -d 192.168.0.0/24 -j ACCEPT 
    6.

In this case, a large number of software cannot be used. Only the IP addresses and ports of the software can be used one by one.
Method 2: Set the default FORWARD chain policy to DROP and manually add the IP addresses to access the Internet (you can also add them in batch using scripts ), in this way, clients that have not been configured will not be able to access the Internet. In this case, you can use thunder to download and limit the speed of thunder. This method is recommended.
The above settings are very strict, but a lot of applications are not available, and the thunder software does not know what port to use, connect to that IP address, and we need to use thunder to download something, in this case, we can limit the download speed of thunder by running the following command:A. Allow all outgoing users to go out
               
               
    
                
                
  1. [root@server1 ~]# iptables -t nat -A POSTROUTING -s 192.168.0.0/24 -j SNAT --to 192.168.18.110 
    2. 
                
                
  2. [root@server1 ~]# iptables -t filter -A FORWARD -i eth1 -s 192.168.0.0/24 -j ACCEPT 
    3.
B. The incoming traffic must be limited to a single host (the download speed should be limited on the external network card of the gateway, and the upload speed should be limited on the internal network card)
                
                
    
                 
                 
  1. [root@server1 ~]# iptables -t filter -A FORWARD -i eth0 -d 192.168.0.２ -m limit --limit 10/s --limit-burst 10 -j ACCEPT 
    2.
According to this command, the host is up to 14.6KB/S, adjust the speed according to the actual situation-m limit -- limit 10/s -- limit-burst 10 this option is to speed the host -- limit 10/s: 10/s refers to sending 10 packets per second. Because the MTU value of the NIC is 1500B, it is converted to KB, 1500/1024 = 1.46KB, that is, the size of each packet is 1.46KB ideally, 10 packets per second, that is, 1.46*10 = 14.6KB/S -- limit-burst 10: The maximum peak value is 10 packets.
C. Perform port ing. If you have time to publish an intranet server to the Internet so that users on the internet can access the server, port ing is required. Port 8080 of the Access Gateway is equivalent to port 80 of 192.168.0.2 of the Intranet.
                 
                 
    
                  
                  
  1. [root@server1 ~]# iptables -t nat -A PREROUTING -p tcp -d 192.168.18.110 --dport 8080 -j DNAT --to 192.168.0.2:80 
    2.
Port 3389 of the Access Gateway is equivalent to accessing port 3389 of 192.168.0.2 of the Intranet. In this way, port 3389 is mapped out.
                 
                 
    
                  
                  
  1. [root@server1 ~]# iptables -t nat -A PREROUTING -p tcp -d 192.168.18.110 --dport 3389 -j DNAT --to 192.168.0.2:3389 
    2.
During port ing, the POSTROUTING chain can not be SNAT. iptables can send incoming packets to the Intranet machine, and the Intranet machine also replies data to the Internet machine because: iptables is a state-based firewall. You do not need to manually set the packet forwarding direction. It can also forward our packets. View nat and filter tables
                 
                 
    
                  
                  
  1. [root@server1 ~]# iptables -t nat -nL 
    2. 
                  
                  
  2. Chain PREROUTING (policy ACCEPT) 
    3. 
                  
                  
  3. target prot opt source destination 
    4. 
                  
                  
  4. DNAT tcp -- 0.0.0.0/0 192.168.18.110 tcp dpt:8080 to:192.168.0.2:80 
    5. 
                  
                  
  5. DNAT tcp -- 0.0.0.0/0 192.168.18.110 tcp dpt:3389 to:192.168.0.2:3389 
    6. 
                  
                  
    7. 
                  
                  
  7. Chain POSTROUTING (policy ACCEPT) 
    8. 
                  
                  
  8. target prot opt source destination 
    9. 
                  
                  
  9. SNAT all -- 192.168.0.0/24 0.0.0.0/0 to:192.168.18.110 
    10. 
                  
                  
    11. 
                  
                  
  11. Chain OUTPUT (policy ACCEPT) 
    12. 
                  
                  
  12. target prot opt source destination 
    13. 
                  
                  
  13. [root@server1 ~]# iptables -t filter -nL 
    14. 
                  
                  
  14. Chain INPUT (policy ACCEPT) 
    15. 
                  
                  
  15. target prot opt source destination 
    16. 
                  
                  
    17. 
                  
                  
  17. Chain FORWARD (policy DROP) 
    18. 
                  
                  
  18. target prot opt source destination 
    19. 
                  
                  
  19. ACCEPT all -- 192.168.0.0/24 0.0.0.0/0 
    20. 
                  
                  
  20. ACCEPT all -- 0.0.0.0/0 192.168.0.0/24 
    21. 
                  
                  
    22. 
                  
                  
  22. Chain OUTPUT (policy ACCEPT) 
    23. 
                  
                  
  23. target prot opt source destination 
    24. 
                  
                  
    25. 
                  
                  
  25. Chain RH-Firewall-1-INPUT (0 references) 
    26. 
                  
                  
  26. target prot opt source destination 
    27.
Note: At this time, even if the Default policy of INPUT and OUTPUT chain in the filter is DROP, port ing will not be affected, because the INPUT chain and OUTPUT chain only impose restrictions on entry and exit, this is forwarding, so it will not be affected.
D. publish an intranet FTP server to the Internet. Check the FTP working mode first: Active Mode and Active mode: the client uses a random port over port 1024 (assuming port n ), send a request to port 21 of the server, and the server responds with port 21. Then the server actively connects to the (n + 1) Port of the client with Port 20, then start data transmission. port 20 is used only in this mode.


Now you can use iptables to publish FTP. First, you can view the active mode:
                   
                   
    
                    
                    
  1. [root@server1 ~]# iptables -t nat -A PREROUTING -p tcp -d 192.168.18.110 --dport 21 -j DNAT --to 192.168.0.2:21 
    2. 
                    
                    
  2. [root@server1 ~]# iptables -t nat -A PREROUTING -p tcp -d 192.168.18.110 --dport 20 -j DNAT --to 192.168.0.2:20 
    3.
If the client is set to passive mode, the server cannot be connected.
Passive Mode)The client sends a request to port 21 of the server with a random port greater than port 1024 (assuming port n), and the server responds with port 21 (including a random port m, for data transmission with the client), then the client connects to the m port of the server with n + 1, and finally transmits data.


Publishing FTP in passive mode, because the server port in passive mode uses random ports and clients for data transmission, we do not know what port to publish, in this case, two modules are required. The ip_nat_ftp and ip_conntrack_ftp modules can be loaded into the kernel to implement FTP passive mode release.
                      
                      
    
                       
                       
  1. [Root @ server1 ~] # Modprobe ip_nat_ftp
    2. 
                       
                       
  2. [Root @ server1 ~] # Modprobe ip_conntrack_ftp
    3. 
                       
                       
  3. [Root @ server1 ~] # Lsmod | grep ftp
    4. 
                       
                       
  4. 2: ip_nat_ftp 7361 0
    5. 
                       
                       
  5. 3: ip_conntrack_ftp 11569 1 ip_nat_ftp
    6. 
                       
                       
  6. 14: ip_nat 20973 2 ip_nat_ftp, iptable_nat
    7. 
                       
                       
  7. 15: ip_conntrack 53281 5 ip_nat_ftp, ip_conntrack_ftp, ip_conntrack_netbios_ns, iptable_nat, ip_nat
    8. 
                       
                       
  8. You only need to release port 21.
    9. 
                       
                       
  9. [Root @ server1 ~] # Iptables-t nat-a prerouting-p tcp-d 192.168.18.110 -- dport 21-j DNAT -- to 192.168.0.2: 21
    10.
In this way, the client can connect to the server in the passive mode (the FTP client can set the passive mode and the active mode). In this case, if the active mode is used to connect to the server, it cannot be connected.
Therefore, the mode in which FTP works depends on the setting of the FTP client, not the server. In most cases, Port 20 is not open on the server, therefore, we can only use the passive mode to connect to the FTP server in the intranet.
Method 3: Set the FORWARD chain to ACCEPT by default, and then restrict the running of some services. In this case, the speed of thunder cannot be limited, because once the FORWARD chain is set to ACCEPT, other policy settings do not work. This method is not recommended. If the Internet access behavior is strict, it is very troublesome to find the port and IP address used by the software.
To restrict QQ logon, you must first find the addresses tcpdump-I eth1 host 192.168.0.2-s 0-w QQ used for qq logon. with this command, pcap can capture packets to know the port and IP address used by a software. pcap download down, with wireshark for analysis (point Statistics-Conversation-IPv4), you can see that QQ uses multiple addresses, the default use of UDP port 8000, write down these addresses, use iptables to limit
                            
                            
    
                             
                             
  1. iptables -t filter -A FORWARD -p udp -s 192.168.0.0/24 -d 112.95.240.16 --dport 8000 -j DROP 
    2. 
                            
                            
                            
                            
    
                             
                             
  1. iptables -t filter -A FORWARD -p udp -s 192.168.0.0/24 -d 112.95.240.16 -m multiport --dport 8000,80,443 -j DROP 
    2.
You need to set multiple ports so that these addresses and these ports are blocked, but webQQ cannot be blocked, because port 80 is used, and the port IP addresses of other software cannot be used.

This article is from the blog of reelcos, please be sure to keep this source http://linux5588.blog.51cto.com/65280/752084


This article is an English version of an article which is originally in the Chinese language on aliyun.com and is provided for information purposes only. This website makes no representation or warranty of any kind, either expressed or implied, as to the accuracy, completeness ownership or reliability of the article or any translations thereof. If you have any concerns or complaints relating to the article, please send an email, providing a detailed description of the concern or complaint, to info-contact@alibabacloud.com. A staff member will contact you within 5 working days. Once verified, infringing content will be removed immediately.

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

  • Sales Support

    1 on 1 presale consultation

    Chat Contact Sales

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

    Open a Ticket

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

    Learn More