Iptables Common configuration examples for Linux (3)

Edit/etc/rc.local, add iptables-t nat-a postrouting-s 192.168.0.0/24-o eth1-j Masquerade, external gateway eth1 for DHCP to obtain IP.

The packet into this machine is input, the packet sent out from this machine is output, but the packet is forward; the firewall is based on these 3 filter points.

For a package, there are: target, drop (drop), Accept, Bounce (REJECT), log (logs) ... And so on, such as Iptables-a input-p icmp-j DROP (-A for the protocol type that is added to the filter point-P, the function of this command is to disable ping), usually rejects all, and then one opens.

Iptables-f Clear All Rules

Iptables-a input-p tcp-d 10.0.0.1–dport 21-j DROP (native address 10.0.0.1, this rule rejects all packets sent to the native TCP 21 port, that is, the FTP service is turned off)

Iptables-a input-p tcp-s 10.0.0.1–dport 21-j DROP (This rule rejects all packets sent to the 10.0.0.1 TCP 21 port)

==================================

(This machine, that is, the server's address is 10.0.0.1)

Iptables-a input-p tcp-d 10.0.0.1–dport 22-j ACCEPT #允许别人访问22端口

Iptables-a output-p tcp–sport 22-m state–state established-j ACCEPT #和自己建立过22端口连接的包才给与回应 to prevent the virus from using 22 ports, not allowing the local 22 port to actively generate packet emit To

Iptables-a input-p tcp–sport 22-m state–state established-j accpet #只接收ssh服务回应自己SSH请求的回应包

Iptables-p INPUT DROP #丢弃所有的input包

Iptables-p OUTPUT DROP #丢弃所有的OUTPUT包

Iptables-p FORWARD DROP #丢弃所有的FORWARD包

Iptables-l-N #查看所有链路信息, if you add "–line-numbers" then show number

Iptables-a input-p tcp-d 10.0.0.1–dport 80-j ACCEPT #允许别人访问80端口

Iptables-a output-p tcp–sport 80-m state–state established-j ACCEPT #和自己建立过80端口连接的包才给与回应 to prevent the virus from using 80 ports, not allowing the local 80 port to actively generate packet emit To

Iptables-a output-p udp-s 10.0.0.1–dport 53-j ACCEPT #允许向DNS服务器发送同步数据包

Iptables-a output-p udp–sport 53-j ACCEPT #对于自己53端口发送的请求包通过 (when you are a DNS server)

Iptables-a input-p udp–dport 53-j ACCEPT #允许别人访问自己的53端口 (when you are a DNS server)

Iptables-a input-p udp–sport 53-j ACCEPT #允许接收DNS服务器的返回包

Iptables-a input-s 127.0.0.1-d 127.0.0.1-j ACCEPT #允许自己通过环回口访问自己的所有服务

Iptables-a output-s 127.0.0.1-d 127.0.0.1-j ACCEPT #允许自己通过环回口访问自己的所有服务

Iptables-i input 1-p tcp–dport 22-j log–log-level 5–log-prefix "iptables:" #为22端口的INPUT包增加日志功能, plug in the 1th rule of input, be sure to No identical receive or discard packets before committing to the log

Vi/etc/syslog.conf #编辑日志配置文件, add Kern.=notice/var/log/firewall.log (log-level 5 for notice, details man syslog)

Service syslog Restart #重启日志服务

Tail/var/log/firewall.log-f #查看日志

Iptables-a forward-s 10.0.0.0/24-j ACCEPT #从局域网发给互联网的包全部转发

Iptables-a forward-d 10.0.0.0/24-j ACCEPT #从互联网发送给局域网的包全部转发

You also need to open/proc/sys/net/ipv4/ip_forward to let the value inside change to 1 (the default is 0), turn on forwarding, this method is temporarily effective

vi/ect/sysctl.conf #打开系统配置文件, edit Net.ipv4.ip_forward = 1, this method is permanently active

Iptables-t nat-l-N #查看iptables的nat表

Service iptables save #永久性的保存规则, equivalent to Iptables-save >/etc/sysconfig/iptables

Source: http://www.ha97.com/3930.html

Iptables Common configuration examples for Linux (3)