Linux Security---iptables firewall

The firewall is divided into kernel State and user state:

Iptables is a user-state

The NetFilter is a kernel-state

Iptables Integrated Language method:

IPTABLES-T table name [ options ] link name condition -j Action

Iptables-t raw/mangle/nat/filter-ai/-dfx/-lvn--line-numbers input/output/forward/preroting/postrouting conditions -j Drop/accept/reject/log

PC Settings:

/etc/init.d/iptables Stop # #清空所有规则, including default rules

Iptables-i input-i lo-j ACCEPT

Iptables-a input-m State--state established,related-j ACCEPT

Iptables-p INPUT DROP

Iptables-p Forwrad DROP

/etc/init.d/iptables Save

Server firewall settings: httpd,DNS,DHCP,vsftpd,postfix,dovecot,MySQL ,SMB,ssh

/etc/init.d/iptables stop

Iptables-i input-m multiport-p tcp--dport 20,21,22,25,53,80,110,139,445,50000:510000-j ACCEPT

Iptables-i input-m multiport-p UDP--dports 53,67-j ACCEPT

Iptables-i input-i lo-j ACCEPT

Iptables-a input-m State--state established,related-j ACCEPT

Iptables-p INPUT DROP

Iptables-p Forwrad DROP

/etc/init.d/iptables Save

SNAT Modify the source port share a public network IP so that all hosts in the LAN can access the Internet, can control which network segment of LAN can be Internet, which is not above

Iptables-p INPUT DROP

Iptables-p FORWARD DROP

Iptables-a forward-s/-d Intranet Network segment -j ACCEPT

VI/ETC/SYSCTL.CONF--->net.ipv4-forword=1--->sysctl-p #开启路由功能

Iptables-t nat-a postruting-s 192.168.100.0/24-o eth0-j SNAT--to-source public network IP

Iptables-t nat-a postruting-s 192.168.100.0/24-o eth0-j masqueradel (camouflage)

Intranet host joins the public network DNS in the /etc/resolv.conf

Iptables-a input-m State--state established,related-j ACCEPT

/etc/init.d/iptables Save

DNAT Modify Destination IP, publish intranet server, must combine SNAT to realize

Iptables-t nat-a prerouting-i eth0-d public network ip-p TCP--dport 80-j DNAT--to-destination Intranet Web server ip< /c7> Address:

Iptables-t nat-a prerouting-i eth0-d public network ip-p TCP--dport 123423-j DNAT--to-destination Intranet IP address: the outside connection is a public IP plus port number 123423

Special settings:

To set up a firewall inbound:

Iptables-i input-s 192.168.100.0/24-m State--state new-p TCP--dport 22-j ACCEPT

Iptables-i input-i lo-j ACCEPT

Iptables-i input-m State--state established,related-j ACCEPT

Iptables-i input-s 192.168.100.0/24-p ICMP--icmp-type 8-m limit--limit 1/m--limit-burst 5-j ACCEPT

Iptables-p INPUT DROP

To set up firewall forwarding:

iptables- I forward-p tcp--tcp-flags fin,syn,rst,ack syn-m limit--limit 1/sec-j ACCEPT ## masking SYN_RECV connection

iptables-a Forward-f-M limit--limit 100/sec--limit-burst 100-j ACCEPT   # #限制 IP fragment, only allowed per second Span style= "Color:rgb (0,0,0); Font-family:calibri;background-color:rgb (255,255,255);" >100 fragments, used to prevent DoS attack

iptables-a Forward-p icmp-m limit--limit 1/sec--limit-burst 10-j ACCEPT   # #限制 ping packet per second, Span style= "Color:rgb (0,0,0); Font-family:calibri;background-color:rgb (255,255,255);" >10 Start again

iptables-a Forward-p icmp-m ICMP--icmp-type 8-m limit--limit 1/sec-j ACCEPT  ## limit ICMP Packet response requests per second of

Iptables-a forward-i eth0-o eth1-s 192.168.100.0/24-j ACCEPT # #允许192.168.100.0/24 outbound (from eth0 to eth1 ) Forwarding

iptables-a forward-m State--state established,related-j ACCEPT # #允许内网数据回路

Iptables-p FORWARD DROP

This article is from the "Lp-linux" blog, make sure to keep this source http://linuxlp.blog.51cto.com/11463376/1773937

Linux Security---iptables firewall