iptables multiport

Environment: redhat9 loaded the string time and other modules, the loading method reference http://bbs.chinaunix.net/forum/viewtopic.php? T = 525493Connect etho to the Internet-ppp0Eth1 connected to intranet-192.168.0.0/24[Color = Blue]#! /Bin/sh#Modprobe ipt_masqueradeModprobe ip_conntrack_ftpModprobe ip_nat_ftpIptables-FIptables-T nat-FIptables-xIptables-T nat-x########################### Input key ########### ########################Iptables-P inpu

connection. For example, ftp and ftp will first establish an ftp-control connection to transmit commands, what actually transfers data is a connection called ftp-data, and the connection to transmit data is RELATED to the connection to transmit control signals. Therefore, "RELATED" is used for similar special services. Under normal circumstances, for each protocol: TCP, UDP, and ICMP, The Status policy can be configured separately, but a simple and efficient method is as follows: #

The following example of their own Web server, the system's default policy is input for drop,output, forward chain for the Accept,drop set to be more relaxed, because we know that the packet is more secure; In order to verify the universality of the script, my Special The kernel and iptables versions of the server are viewed, as shown in the following commands: 12345678910 uname -a linux ud50041 2.6.9-34.elsmp #1 SMP Fri Feb

packets while in a connected state Iptables-a output-s 192.168.1.1-p TCP sport 80-m state–-state established-j Allow host to send external Web packets while in a connected state Iptables-p Intup DROP Reject all other incoming packets Iptables-p OUTPUT DROP Reject all other packets out of the way These rules can be used on the Web server, only allow custom

number of syn packets followed by-m limit -- limit n/s to limit the number of SYN packets per second. Extension options: -M multiport -- sports The port numbers are separated by commas (,), not necessarily consecutive. -M mulitport -- dports -M multiport -- ports -M -- the state can be establishednewrelated invalid. To allow external access to an internal server such as a Web server:

On-line Linux servers are basically configured to iptables to enhance security. *filter: INPUT DROP [0:0]: FORWARD ACCEPT [0:0]: OUTPUT DROP [0:0]-A input-m state--state related,established-j ACCEPT-A input-i lo-j ACCEPT-A input-i eth0-j ACCEPT-A input-s 10.0.0.0/8-j ACCEPT #这里设置允许内网IP通信-A input-p tcp-m multiport--sports 443-j ACCEPT-A input-p tcp-m multiport--d

1. Show the status of the firewallRun the following command with root privileges: # iptables-l-n-v Parameter description: -L: Lists the rules. -V: Displays detailed information. This option displays the interface name, rule options, and the TOS mask, as well as the packet and byte count. -N: Displays the IP address and port in digital form, without using DNS resolution. If you want the output to show the line number

-j ACCEPT# Prevent various port scans and limit SYN and ack syn to no more than 200 per second, so as not to exhaust the bandwidth of the server/Sbin/iptables-a input-p tcp-m tcp -- tcp-flags SYN, RST, ack syn-m limit -- limit/sec -- limit-burst-j ACCEPT# Open access to a specified host, such as the IP address of the host for Intrusion Detection#/Sbin/iptables-a input-s 122.70.x.x-j ACCEPT# Loop data must b

lists all the rules in the table-Z: Clears the counter of the rule#iptables[-ttable]{-a|-d}chainrule-specification-a:append, attach a rule rule-specification: Match conditions -j processing mechanism matching criteria: (Universal matching) -s Match Source address, can IP, also can network address: can use! The operator takes the inverse,! 172.168.0.0/16 equivalent to NBSP;--SRC, or --source-d Match Destination address, can IP, also can network ad