iptables multiport

SANT; On node1 # Curl-I http: // 10.72.37.177 # Test the web service connected to node3 # Tail/var/log/nginx/access. log # view the access log on node3. the source address of the client is 10.72.37.91 after conversion. As required, node1 can only send ping, shh, and web access requests to node3. Therefore, add the following rules to the FORWARD chain of the filter table on node2: # Iptables-t filter-p forward drop #

installation Close firewall Systemctl Stop Firewalld.service #停止firewall systemctl Disable Firewalld.service #禁止firewall开机启动 Install Iptables Yum Install iptables-services systemctl start iptables.service systemctl enable Iptables.service #设置开机启动 Close SELinux Vi/etc/selinux/config #SELINUX =enforcing #注释掉 #SELINUXTYPE =targeted #注释掉 selinux=disabled #增加 Setenforce 0 #使配置立即生效

introduced by the netfilter extension module is used to expand matching conditions. Additional dedicated options are usually needed for definition) -M state: the connection status detection module. -- State new (new connection), established (confirm connection), related (join connection), invalid (invalid connection) -M multiport: multiple ports -- Source-Port: Source Port Group -- Destination-ports: Target Port Group -- Ports For example, merge the

Iptables is a firewall in Linux that can filter packets in Linux. The following is a brief introduction to the application of iptables.①iptables has five hooks in Linux (hook function)Prerouting: The packet has entered the host, but the stage has not yet been routed.INPUT: The packet goes inside the host.FORWARD: The packet will be forwarded from the host.Postrou

outbound chain Foreard forwarding chainp: Specify the rule, TCP (three-time handshake) UDP (Fast unsecured) ICMP (ping, see if it survives)watch-n1 IPTABLES-NVL--Line-numberAvsftp Service BuildingSMB file system shared in LAN ftp file sharing within the InternetYum Install vsftpd/etc/init.d/vsftpd Start/var/ftp Directory default shared directoryGraphics folder Browserftp:/192.168.1.223cmd FTP tool linked serverftp:/192.168.1.223User name: FTPPassword

original content to save the contents as follows# Generated by Iptables-save v1.3.5 on Sun Dec 12 23:55:59 2010*filter: INPUT DROP [385,263:27,864,079]: FORWARD ACCEPT [0:0]: OUTPUT ACCEPT [4,367,656:3,514,692,346]-A input-i lo-j ACCEPT-A input-m state–state related,established-j ACCEPT-A input-p icmp-j ACCEPT-A input-s 127.0.0.1-j ACCEPT-A input-p tcp-m tcp–dport 80-m state–state new-m recent–set–name Web–rsource-A input-p tcp-m tcp–dport 80-m state

-- dport 80 -- syn-m recent -- name webpool -- set-j ACCEPT# Pass is allowed within the specified range. The above is relatively simple. Next I will analyze more specific configuration methods. CentOS/Redhat/Fedora Run on the server The Code is as follows: Copy code Vi/etc/sysconfig/iptablesDelete original content input the following content to save# Generated by iptables-save v1.3.5 on Sun Dec 12 23:55:59 2010* Filter:

Linux under Iptables configuration detailed -A rh-firewall-1-input-p tcp-m State--state new-m TCP--dport 24000-j ACCEPT-A rh-firewall-1-input-s 121.10.120.24-p tcp-m tcp--dport 18612-j ACCEPT If your iptables basic knowledge is not yet known, it is recommended to take a look first.Start ConfigurationLet's configure a firewall for the filter table.(1) Check the setting of this institution in

content and enter the following content to save# generated by Iptables-save v1.3.5 on Sun Dec 12 23:55:59 2010*filter: INPUT DROP [385,263:27,864,079]: FORWARD ACCEPT [0:0]: OUTPUT ACCEPT [4,367,656:3,514,692,346]-A input-i lo-j ACCEPT-A input-m state–state related,established-j ACCEPT-A input-p icmp-j ACCEPT-A input-s 127.0.0.1-j ACCEPT-A input-p tcp-m tcp–dport 80-m state–state new-m recent–set–name Web–rsource-A input-p tcp-m tcp–dport 80-m state–

With this tutorial, make sure you can use Linux native. If you are using SSH remote, and can not directly operate the machine, then we recommend you cautious, cautious, and then cautious!With Iptables We can configure a dynamic firewall for our Linux servers that can specify and remember the status of the connections established for sending or receiving packets, a set of command packages to set up, maintain, and check the IP packet filtering rules of

Linux command: Compile and install iptablesFirst, compile and install iptables before preparing:Three documents to be backed up before uninstalling iptables : iptables startup script, Iptables-config configuration document, and established Iptables rule document[email protec

Iptables configurationIf your iptables basic knowledge is not yet known, it is recommended to take a look first.Start configurationLet's configure a firewall for the filter table.(1) Check the setting of this institution in Iptables[Email protected] ~]# iptables-l-NChain INPUT (Policy ACCEPT)Target Prot opt source dest