1. configure
Filter
Table fire wall
(1) view the settings of iptables on the local machine[[Email protected] ~] # Iptables-l-N
Chain input (Policy accept)
Target prot opt source destination chain forward (Policy accept)
Target prot opt source destination chain output (Policy accept)
Target prot opt source destination chain RH-Firewall-1-INPUT (0 references)
Target prot opt source destination
Accept all -- 0.0.0.0/0 0.0.0.0/0
Accept ICMP -- 0.0.0.0/0 0.0.0.0/0 ICMP Type 255
Accept Esp -- 0.0.0.0/0 0.0.0.0/0
Accept ah -- 0.0.0.0/0 0.0.0.0/0
Accept UDP -- 0.0.0.0/0 224.0.0.20.udp DPT: 5353
Accept UDP -- 0.0.0.0/0 0.0.0.0/0 uddpt: 631
Accept all -- 0.0.0.0/0 0.0.0.0/0 state related, established
Accept TCP -- 0.0.0.0/0 0.0.0.0/0 state New tcp dpt: 22
Accept TCP -- 0.0.0.0/0 0.0.0.0/0 state New tcp dpt: 80
Accept TCP -- 0.0.0.0/0 0.0.0.0/0 state New tcp dpt: 25
Reject all -- 0.0.0.0/0 0.0.0.0/0 reject-with ICMP-host-prohibited
We can see that when I installed Linux, I chose to have a firewall and opened ports 22, 80, and 25. if you do not choose to start the firewall when installing Linux, [[email protected] ~] # Iptables-l-N
Chain input (Policy accept)
Target prot opt source destination chain forward (Policy accept)
Target prot opt source destination chain output (Policy accept)
Target prot opt source destination has no rules.
(2) Clear the original rules.Whether or not you have enabled the firewall when installing Linux, if you want to configure your own firewall, clear all the filter rules. [[email protected] ~] # Iptables-F clear the rules of all rule chains in the filter of the preset table
[[Email protected] ~] # Iptables-x clear the rules in the User-Defined chain in the filter of the preset table. Let's take a look at [email protected] ~]. # Iptables-l-N
Chain input (Policy accept)
Target prot opt source destination chain forward (Policy accept)
Target prot opt source destination chain output (Policy accept)
Target prot opt source destination has nothing to do with. It is the same as we didn't start the firewall when installing Linux. (say in advance, these configurations are the same as configuring IP addresses with commands, so restarting them will lose effect.) How to save them. [[email protected] ~] #/Etc/rc. d/init. d/iptables save to write it to the/etc/sysconfig/iptables file. after writing, remember to repeat the firewall to make it work. [[email protected] ~] # Service iptables restart: No configuration is available in the iptables configuration table.
(3) Add a rule.
First, add the input chain. The default rule of the input chain is drop, so we will write the chain that requires accetp ().
To enable remote SSH Login, We need to enable port 22.[[Email protected] ~] # Iptables-A input-p tcp -- dport 22-J accept [[email protected] ~] # Iptables-A output-p tcp -- Sport 22-J accept
(Note: If you set the output to drop, you need to write this rule. Many people are eager to write this rule, so they will never be able to ssh. Check it remotely.
The same applies to other ports. If the Web server is enabled and the output is set to drop, a chain should also be added:[[Email protected] ~] # Iptables-A output-p tcp -- Sport 80-J accept .)
If the Web server is configured, enable port 80.[[Email protected] ~] # Iptables-A input-p tcp -- dport 80-J accept
If the email server is configured, enable port 25,110.[[Email protected] ~] # Iptables-A input-p tcp -- dport 110-J accept
[[Email protected] ~] # Iptables-A input-p tcp -- dport 25-J accept
If the FTP server is configured, enable port 21.[[Email protected] ~] # Iptables-A input-p tcp -- dport 21-J accept [[email protected] ~] # Iptables-A input-p tcp -- dport 20-J accept
If the DNS server is configured, enable port 53.[[Email protected] ~] # Iptables-A input-p tcp -- dport 53-J accept.
2. configure a NAT table
1. View local Nat settings
[[Email protected] rc. d] # iptables-T nat-l
Chain prerouting (Policy accept)
Target prot opt source destination chain postrouting (Policy accept)
Target prot opt source destination
SNAT all -- 192.168.0.0/24 anywhere to: 211.101.46.235chain output (Policy accept)
Target prot opt source destination my Nat has been configured (only the simplest proxy Internet access function is provided, and no firewall rules have been added ). for more information about how to configure Nat, see my other article. Of course, if you have not configured Nat, you do not need to clear the rules because Nat does not have anything by default.
If you want to clear, the command is[[Email protected] ~] # Iptables-F-T Nat [[email protected] ~] # Iptables-X-T Nat [[email protected] ~] # Iptables-z-T Nat
2. Add a NAT ruleIptables-T Nat-A prerouting-D address 1-p tcp-m tcp -- dport 80-j dnat -- to-destination address 2: 81
You must enable the IP forwarding function.
Modify net. ipv4.ip _ forward = 1 in/etc/sysctl. conf. The default value is 0.
You can also Echo 1>/proc/sys/NET/IPv4/ip_forward
