Analysis of actual use cases of iptables firewall

1. the experimental environment for the location where the proxy server is set up is as follows: 1) Lan CIDR block: 192.168.1.0/24, which contains two servers and one client (1) WEB server: 192.168.1.3/24 (2) FTP server: 192.168.1.2/24 (3) client: 192.168.1.5/242) the firewall with CentOS is installed between the LAN and the Internet. I. position of proxy server setup
The experiment environment is as follows:
1) Lan CIDR block: 192.168.1.0/24, which contains two servers and one client
(1) WEB Server: 192.168.1.3/24
(2) FTP server: 192.168.1.2/24
(3) client: 192.168.1.5/24
2) the LAN and the Internet are connected through a firewall installed with CentOS. the firewall has two NICs.
(1) eth0: 192.168.1.254/24, which is the gateway of the network segment: 192.168.1.0/24
(2) eth1: 192.168.0.254/24, which is simulated as a public IP address
3) there is a client at the other end of the Internet: 192.168.0.5/24
The client and the firewall can be pinged.
4) Nic connection method
FTP server's eth0: VMnet1-(Host-only)
Eth0 of the WEB server: VMnet1-(Host-only)
Firewall's eth0: VMnet1-(Host-only)
Eth1: Bridged of Firewall
Client's eth0: VMnet1-(Host-only)

II. configuration of relevant cases

1. Case 1: Allow all hosts in the network segment 192.168.1.0/24 to access the internet through the firewall (192.168.1.254 ).
Step 2: Prepare for the security of the firewall (192.168.1.254)
# The firewall is an ssh server that allows other clients to log on to the firewall through the SSH service.
Iptables-T filter-a input-p tcp -- dport 22-j ACCEPT
Iptables-t filter-a output-p tcp-m state -- state ESTABLISHED -- sport 22-j ACCEPT #
The firewall is an ssh client that allows it to connect to other SSH servers.
Iptables-t filter-a input-p tcp -- sport 22-j ACCEPT
Iptables-t filter-a output-p tcp -- dport 22-j ACCEPT #
The firewall is a dns client that enables it to resolve domain names
Iptables-t filter-a input-p udp -- sport53-j ACCEPT
Iptables-t filter-a output-p udp -- dport53-j ACCEPT #
The firewall is a web client that allows it to access webpages.
Iptables-t filter-a input-p tcp -- sport80-j ACCEPT
Iptables-t filter-a output-p tcp -- dport80-j ACCEPT # ping all hosts in the Lan (192.168.1.0/24) to the firewall.
Iptables-t filter-a input-p icmp-I eth0-s 192.168.1.0/24-jACCEPT
Iptables-t filter-a output-p icmp-o eth0-d 192.168.1.0/24-jACCEPT # Modify the default rule
Iptables-t filter-P INPUT DROP
Iptables-t filter-P OUTPUT DROP
Iptables-t filter-P FORWARD DROP

Step 2: enable the packet forwarding function on the firewall (that is, write rules on the FORWARD chain of the filter table)
Sed-I's/net. ipv4.ip _ forward = 0/net. ipv4.ip _ forward = 1/'/etc/sysctl. conf & sysctl-p
# For the eth0 Nic of the firewall, all types of packets from the LAN (the source address is 192.168.1.0/24) are forwarded to the public network
Iptables-t filter-a forward-I eth0-s 192.168.1.0/24-j ACCEPT (it is also acceptable if I do not write-ieth0 here)
# For the eth1 Nic of the firewall, all types of data packets (destined for 192.168.1.0/24) from the public network are forwarded to the LAN
Iptables-t filter-a forward-I eth1-d 192.168.1.0/24-j ACCEPT, therefore, rules should be written to the POSTROUTING chain in the nat table of the firewall to send data packets to the Internet)
Modprobe ip_nat (# module for loading the nat table)
Iptables-t nat-a postrouting-s 192.168.1.0/24-j SNAT -- to-source 192.168.0.254

Or
Iptables-t nat-a postrouting-o eth1-s 192.168.1.0/24-j SNAT -- to-source 192.168.0.254 (which interface can be specified)
Iptables-t nat-a postrouting-s 192.168.1.5-j SNAT -- to-source192.168.0.254 (specify to allow only 192.168.1.5 this machine to access the Internet through the firewall)

2. Case 2: use a firewall to limit the download speed of 192.168.1.5 on the LAN

Note: based on case 1, write rules to the FORWARD chain of the filter table
# Restrict the download speed, that is, limit the number of packets that enter the firewall from the internet and are forwarded by FORWARD.
Change "iptables-t filter-a forward-I eth1-d 192.168.1.0/24-j ACCEPT":
Iptables-t filter-I forward-I eth1-d 192.168.1.5-m limit -- limit 50/m -- limit-burst 50-j ACCEPT
Note: ifconfigeth1 can check that the MTU value is 1500 bytes = 1500/1024 = 1.5KB (that is, the size of each data packet), then the maximum download speed within 1 minute is: 50 * 1.5KB = 75KB
For (I = 5; I <10; I ++ ){
Iptables-t filter-I forward-I eth1-d 192.168.1. $ I-m limit -- limit 50/m -- limit-burst 50-j ACCEPT (restrict IP segments in a LAN)
}

3. Case 3: the client on the public network (192.168.0.5) uses the firewall to connect to the host 192.168.1.5 on the LAN. Step 2: Prepare for the connection, as in case 1.
Step 2: enable the packet forwarding function on the firewall (that is, write rules on the FORWARD chain of the filter table)
Sed-I's/net. ipv4.ip _ forward = 0/net. ipv4.ip _ forward = 1/'/etc/sysctl. conf & sysctl-p
Iptables-t filter-a forward-I eth0-s 192.168.1.0/24-j ACCEPT

Iptables-t filter-a forward-I eth1-d 192.168.1.0/24-j ACCEPT step 3rd: Address Conversion
Iptables-t nat-a prerouting-I eth1-d 192.168.0.254-p tcp -- dport 3389-j DNAT -- to-destination 192.168.1.5: 3389
Iptables-t nat-a postrouting-o eth1-s 192.168.1.5-p tcp -- sport 3389-j SNAT -- to-source 192.168.0.254: 3389 Step 1: Test

Windows xp (192.168.0.5)-> run-> mstsc-> 192.168.0.2544, Case 4: Release the WEB server in the Lan to the Internet through the firewall Step 4: prepare for work, same as the preparations for case 1
Step 2: enable the packet forwarding function on the firewall (that is, write rules on the FORWARD chain of the filter table)
Sed-I's/net. ipv4.ip _ forward = 0/net. ipv4.ip _ forward = 1/'/etc/sysctl. conf & sysctl-p
Iptables-t filter-a forward-I eth0-s 192.168.1.0/24-j ACCEPT
Iptables-t filter-a forward-I eth1-d 192.168.1.0/24-j ACCEPT
Step 2: Address Conversion
Iptables-t nat-a prerouting-I eth1-d 192.168.0.254-p tcp -- dport 80-j DNAT -- to-destination 192.168.1.3: 80
Iptables-t nat-a postrouting-o eth1-s 192.168.1.3-p tcp -- sport 80-j SNAT -- to-source 192.168.0.254: 80 step 4th: test
Windows xp (192.168.0.5)-> run-> http: // 192.168.0.254

4. Case 5: Release the FTP server in the LAN through the firewall to the public network Step 4: prepare for the work, as in Case 1: enable the packet forwarding function on the firewall (that is, write rules on the FORWARD chain of the filter table)
Sed-I's/net. ipv4.ip _ forward = 0/net. ipv4.ip _ forward = 1/'/etc/sysctl. conf & sysctl-p
Iptables-t filter-a forward-I eth0-s 192.168.1.0/24-j ACCEPT
Iptables-t filter-a forward-I eth1-d 192.168.1.0/24-j ACCEPT
Step 2: Address Conversion
(1) FTP server: Active mode
Iptables-t nat-a prerouting-I eth1-d 192.168.0.254-p tcp -- dport 20-j DNAT -- to-destination 192.168.1.2: 20
Iptables-t nat-a postrouting-o eth1-s 192.168.1.2-p tcp -- sport 20-j SNAT -- to-source 192.168.0.254: 20
Iptables-t nat-a prerouting-I eth1-d 192.168.0.254-p tcp -- dport 21-j DNAT -- to-destination 192.168.1.2: 21
Iptables-t nat-a postrouting-o eth1-s 192.168.1.2-p tcp -- sport 21-j SNAT -- to-source 192.168.0.254: 21

(2) FTP server: passive mode
First, to implement the passive mode and control the port used for data transmission on the FTP server, configure the FTP server:/etc/vsftpd. conf and add the following content to the file:
Pasv_enable = yes # enable passive mode
Pasv_min_port = 4040 # port range used by the passive mode vsftpd server
Pasvanderbilt max_port = 4080
Secondly, the firewall must load the relevant modules to the kernel.
Modprobe ip_nat
Modprobe ip_conntrack
Modprobe ip_nat_ftp
Modprobe ip_conntrack_ftp
Finally, configure the firewall
Iptables-t nat-a prerouting-I eth1-d 192.168.0.254-p tcp -- dport 21-j DNAT -- to-destination 192.168.1.2: 21
Iptables-t nat-a postrouting-o eth1-s 192.168.1.2-p tcp -- sport 21-j SNAT -- to-source 192.168.0.254: 21
Iptables-t nat-a prerouting-I eth1-d 192.168.0.254-p tcp -- dport 4040: 4080-j DNAT -- to-destination192.168.1.2: 4040-4080
Iptables-t nat-a postrouting-o eth1-s 192.168.1.2-p tcp -- sport 4040: 4080-j SNAT -- to-source 192.168.0.254: 4040-4080

Note: In fact, the FTP server works in active or passive mode, which is entirely determined by the FTP client! Therefore, there is no need to configure the above three statements in the vsftpd. conf file. The three statements are only used to better control the data transmission port in passive mode on the FTP server.Step 2: Test

Windows xp (192.168.0.5)-> cmd-> ftp192.168.0.2545,

Case 5: Use the firewall to restrict the use of the Apsara client software on the host 192.168.1.5 in the Lan Step 1: Download the data packet analysis tool (wireshark)
The iptables tool acts as a network-layer firewall. Therefore, in terms of software restrictions, you can only start with the Port corresponding to the protocol (TCP and UDP, restrict the ports corresponding to these protocols to restrict the use of software. However, some protocols iptables cannot be restricted, for example: point-to-Point Protocol
Http://www.wireshark.org
Http://www.wireshark.org/download/win32/wireshark-win32-1.2.7.exe

Step 2: Because the firewall acts as a gateway, we can use it on the Gateway. TcpdumpPacket capture. this tool can capture TCP data packets.
First, run the tcpdump command on the firewall.
Tcpdump-I eth0 host 192.168.1.5-s 0-w feixing. pcap
Parameter analysis:
(1)-I eth0: it refers to packet capture on the interface that acts as the gateway of the firewall (because when users in the LAN access the Internet, data packets must pass through the Gateway)
(2) host + IP: captures packets containing the address 192.168.2.5.
(3)-s 0: indicates that the length of the data packet is not limited.
(4)-w: indicates that the captured data packet is written to a file.
Then, use the Apsara client program on the host 192.168.1.5 of the LAN, log on to the Apsara stack server, and then cut off the tcpdump command (ctrl + c) of the firewall Step 4: Use
Wireshark software analyzes captured data packets

Step 2: When the computer (192.168.1.5) in the Lan uses feit.com, the transmitted data packets must be converted through the FORWARD in the filter table on the firewall, therefore, we write rules on the FORWARD chain to restrict the use of the Apsara stack client on this server.
# Prevent the client from sending the relevant Apsara stack data packets to the Apsara stack server
Iptables-t filter-I forward-I eth0-s 192.168.1.5-d221.176.31.69-p tcp-m multiport -- dport 80, 8080, 443-j DROP
Iptables-t filter-I forward-I eth0-s 192.168.1.5-d221.176.31.45-p tcp-m multiport -- dport 80, 8080, 443-j DROP
Iptables-t filter-I forward-I eth0-s 192.168.1.5-d221.130.45.212-p tcp-m multiport -- dport 80, 8080, 443-j DROP
Iptables-t filter-I forward-I eth0-s 192.168.1.5-d221.130.45.201-p tcp-m multiport -- dport 80, 8080, 443-j DROP
Iptables-t filter-I forward-I eth0-s 192.168.1.5-d221.130.45.198-p tcp-m multiport -- dport 80, 8080, 443-j DROP
Iptables-t filter-I forward-I eth0-s 192.168.1.5-d221.130.44.small-p tcp-m multiport -- dport 80, 8080, 443-j DROP
Iptables-t filter-I forward-I eth0-s 192.168.1.5-d218.61.204.91-p tcp-m multiport -- dport 80, 8080, 443-j DROP
Iptables-t filter-I forward-I eth0-s 192.168.1.5-d199.7.52.190-p tcp-m multiport -- dport 80, 8080, 443-j DROP