iptables multiport

valueExample:-m mac--mac 00:0d:29:24:ec:19B. Common extension matches Category Options Usage Show matches Status Matching -M State--state status value MAC address Matching -M Mac--mac-source MAC address Multi-port matching -M multiport--sport Source Port list -M multiport--dport Target Port list

rule on the previous chain. 5) match extension matching extension In the matching parameters, only the protocol, source address, target address, and network interface can be matched. For more detailed matching (for example, matching the target port), there is nothing to do. There is a-m in the matching parameter, which can provide more detailed matching. For example, to enable a packet sent by an SSH client, you need to use tcp extension. You can specify the Packet target address: Use-m tcp-dp

rules, we can use the state tracking mechanism;~]# iptables-d FORWARD 2Add a rule, both inside and out as long as the response messages are allowed to proceed normally;~]# iptables-i forward-m state–state established-j ACCEPTIn the future, just write the request strategy;Such as: Intranet host open SSH connected to the external network;~]# iptables-r FORWARD 2-s

Iptables and iptables configuration 1. open ports 22, 80, and 9011 on the server: Iptables-a input-p tcp -- dport 9011-j ACCEPTIptables-a output-p tcp -- sport 9011-j ACCEPT Iptables-a input-p tcp -- dport 22-j ACCEPTIptables-a output-p tcp -- sport 22-j ACCEPT Iptables-

Echo "1">/proc/sys/net/ipv4/icmp_echo_ignore_all This is because someone else cannot ping you or ping someone else. Change the value to 1 to disable PING. Change the value to 0 to disable PING. In fact, iptable is the simplest Iptables-a input-p icmp-type 8-s 0/0-j DROP Iptables-a input-p icmp-type 0-s 0/0-j ACCEPT Iptables-a output-p icmp-type 0-s 192.168.29.1-j

#!/bin/bashIptables-fIptables-p INPUT DROPIptables-p OUTPUT ACCEPTIptables-p FORWARD DROP/sbin/iptables-a input-i eth1-m multiport-p tcp--dport 5060,6060,5070,1720,3720,1719,2719,3719,1202,80-j ACCEPT/sbin/iptables-a input-i eth1-m multiport-p UDP--dport 5060,6060,5070,5055,5065-j ACCEPT/sbin/

Iptables-save is used to store the current rules in a file for iptables-restore use. It's very simple to use, with only two parameters:Iptables-save [-c] [-t table]The function of parameter-C is to save the value of the packet and byte counter. This allows us to not lose statistics on packets and bytes after restarting the firewall. The Iptables-save command with

Practical setting of Linux Firewall iptables, linux Firewall iptables One important step to maintain a server is to manage the opening and closing of ports to prevent external malicious attacks from exploiting the ports occupied by these services. First, you can view the iptables information: Sudo iptables-L

iptables -X iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT #load connection-tracking modules modprobe iptable_nat modprobe ip_conntrack_ftp modprobe ip_nat_ftp iptables -A INPUT -f -m limit --limit 100/sec--limit-burst 100 -j ACCEPT

Multiport Module You can use the multiport module to specify multiple ports at a time. When writing a rule, you must specify the "-m" parameter to check the status. -M stat -- state detection package status -M multiport: This module can match a group of source or destination port numbers, up to 15 ports; As follows: -- Source-ports 22, 80 -- Destination-ports 110

1. View the Rules IPTABLES-NVL2. Table Type-T Raw,mangle,nat,filter (default)3. Chain Management(1) New link: iptables-n test(2) Delete empty chain: Iptables-x test(3) Enable and disable: Iptables-p INPUT accept| DROP(4) Renaming: IPTABLES-E test test2(5) Empty:

The root user cannot modify iptables. the root user iptables Requirement: Because the firewall imposes IP and port restrictions, you need to add a rule to allow access to the specified IP address and port. Vi/etc/sysconfig/iptables. After the file is added, wq is saved, prompting that the file cannot be saved only !!! Solution: 1. Check the file permissio