Basic iptables and case configuration

The IPTables table and the link function IPTables have three tables: filter table, nat table, and mangle table 1. the filter table is mainly used for filtering, in IPTables, almost all filtering is done in this table. it is the default table executed in IPTables. There are three chains in the filter table: INPUT chain, FORWARD chain, and OUTPUT chain INPU IPTables table and chain functions.
IPTables has three tables: filter table, nat table, and mangle table.
1. filter table is mainly used for filtering. in IPTables, almost all the filters are completed in this table. it is the default table executed in IPTables.
There are three chains in the filter table: INPUT chain, FORWARD chain, and OUTPUT chain.
INPUT chain: filter data packets whose destination address is local
FORWARD chain: filters all data packets passing through the local machine, that is, the destination address and source address are both local data packets.
OUTPUT chain: filter all data packets generated by the local machine, that is, the source address is the data packet of the local machine.
2. nat table is mainly used for network address translation. for a stream, data packets only pass through this table once. that is to say, if a packet is allowed for conversion, then the data packet that comes after it will not be nat, but will automatically flow with the first converted data packet.
Nat has three main conversion methods: DNAT SNAT MASQUERADE
DNAT: change the destination address of the data packet and redirect an Internet address to a host on the intranet.
SNAT: changes the source address of the data packet so that users in the intranet can connect to the Internet.
MASQUERADE: similar to the SNAT function, it only searches for an address pool on the local machine during NAT. Unlike SNAT, it only uses a fixed address.
Nat also has three links: PREROTING chain POSTROUTING chain OUTPUT chain
PREROUTING chain: you can change the destination address of a packet when it reaches the firewall.
POSTPUT chain: change the source address of the data packet when the data packet is about to leave the firewall
OUTPUT chain: the destination address of the generated data packet can be changed.
3. the mangle table is mainly used to modify data packets. it can modify the tos ttl mark of data packets and so on. This table is rarely used and is not described in detail.
Case configuration
 
The company has three departments
Engineering Department 2.11 -- 2.20
Software Department 2.21-2.30
Manager Office 2.31-2.40
Start time (Monday-Friday 08:20:00)
The engineering department's working time ftp does not allow http qq Thunder to be unrestricted after work
During work hours, the software Department allows http but does not allow illegal sites (sina), images browsing, Thunder attacks, and a maximum of three connections. there is no limit after work.
The manager's office can use http qq, and there is no limit after work
Topology


Note: At the beginning of this experiment, the system has re-compiled the kernel module and added time iprange layer7 and other functions. if the kernel is not re-compiled, add the above functions, some functions cannot be implemented.
1. disable the firewall first. We do not need to use the default firewall rules, and do not need to enable the firewall. after the firewall is disabled, the system will only match the one we set. IptablesRules.
2. before doing a lab, we need to achieve network-wide intercommunication, and control the lab on the basis of communication.
Because our network is intranet and needs to be connected to the Internet, we need to perform SNAT conversion on it.
[Root @ localhost ~] # Iptables-t nat-a postrouting-s 192.168.2.0/24-o eth1-j MASQUERADE
Because we have multiple NIC interfaces on this server, we specify the eth1 interface that is connected to the remote network to allow all traffic to exit from this interface.
3. allow ssh first. we will connect to the system using ssh.
[Root @ localhost ~] # Iptables-a input-s 192.168.101.114-p tcp -- dport 22-j ACCEPT [root @ localhost ~] # Iptables-a output-d 192.168.101.114-p tcp -- sport 22-j ACCEPT
4. now we set each table to the rejected Status. when all the tables are rejected, we can enable each function as required.
[Root @ localhost ~] # Iptables-t filter-P INPUT DROP
[Root @ localhost ~] # Iptables-t filter-P OUTPUT DROP
[Root @ localhost ~] # Iptables-t filter-P FORWARD DROP
We complete the decomposition according to the instance requirements.
(1) start time (Monday-Friday 08:20:00)
The engineering department's working time ftp does not allow http qq Thunder to be unrestricted after work
1. allow FTP
[Root @ localhost ~] # Iptables-t filter-a input-m iprange -- src-range 192.168.2.11-192.168.2.20-m time -- timestart 8:00 -- timestop 20:00 -- weekdays Mon, Tue, Wed, Thu, fri-p tcp -- dport 21-j ACCEPT
[Root @ localhost ~] # Iptables-t filter-a forward-m state -- state ESTABLISHED, RELATED-j ACCEPT // responds to the request
[Root @ localhost ~] # Modprobe ip_nat_ftp // load the ftp module
2. http qq Thunder is not allowed
In the above settings, communication is not allowed, so qq and so on are not allowed, but in order to learn and experiment, I will write the code directly for reference only.
Disable HTTP: [root @ localhost ~] # Iptables-t filter-a forward-m iprange -- src-range 192.168.2.11-192.168.2.20-m time -- timestart 8:00 -- timestop 20:00 -- weekdays Mon, Tue, Wed, Thu, fri-p tcp -- dport 80-j DROP
QQ is prohibited. generally, iptables is difficult to implement. we need to use layer-7 functions, which must be supported by the system during kernel compilation.
[Root @ localhost ~] # Iptables-t filter-a forward-m iprange -- src-range 192.168.2.11-192.168.2.20-m time -- timestart 8:00 -- timestop 20:00 -- weekdays Mon, Tue, Wed, Thu, fri-m layer7 -- l7proto qq-j DROP
Prohibit Thunder
[Root @ localhost ~] # Iptables-t filter-a forward-m iprange -- src-range 192.168.2.11-192.168.2.20-m time -- timestart 8:00 -- timestop 20:00 -- weekdays Mon, Tue, Wed, Thu, fri-m layer7 -- l7proto xunlei-j DROP
3. no restrictions after work
[Root @ localhost ~] # Iptables-t filter-a forward-m iprange -- src-range 192.168.2.11-192.168.2.20-m time -- timestart 20:01 -- timestop 07:59-j ACCEPT
(2) during work hours, the software Department allows http but does not allow illegal sites (sina), images browsing, and Thunder. a maximum of three connections are allowed. there are no restrictions after work.
1. http is allowed during work hours, but sina and images are not allowed
This type of restriction is difficult to implement on iptables, but it may be much easier to implement it using the proxy server squid. The Squid server installation is not stated. we implement it by ourselves. we implement the required implementation directly.
First, configure the content to be implemented on squid.
[Root @ localhost ~] # Vim/etc/squid. conf
Add the following content
Acl soft src 192.168.2.21-192.168.2.30
Acl worktime time MTWHF-
Acl pic urlpath_regex-I \. jpg $
Acl url url_regex-I sina
Http_access allow soft worktime! Pic! Url
Dns_nameservers 222.88.88.88 222.85.85.85
Visible_hostname 192.168.101.129
In addition, you must set a transparent proxy on the squid server and modify it in the configuration file to the following sentence:
Http_port 3128 transparent
 
On iptables, Port conversion is performed for Intranet traffic. all traffic on port 80 is forwarded to port 3128 of the squid server.
[Root @ localhost ~] # Iptables-t nat-r prerouting 1-m iprange -- src-range 192.168.2.21-192.168.2.30-m time -- timestart 8:00 -- timestop 20:00 -- weekdays Mon, Tue, Wed, Thu, fri-p tcp -- dport 80-j REDIRECT -- to-ports 3128
When we connect to the Internet, we use domain names for external connection. therefore, to enable intranet users to resolve to the domain name, we need to use the DNS server, so we need to perform nat on iptables, using DNS, you can directly go out through nat so that you can perform DNS resolution. The nat of all data packets is allowed in the first step, so this step is not required. write it only to understand some of the principles. it does not match data packets.
[Root @ localhost ~] # Iptables-t nat-a postrouting-m iprange -- src-range 192.168.2.21-192.168.2.30-m time -- timestart 8:00 -- timestop 20:00 -- weekdays Mon, Tue, Wed, Thu, fri-o eth1-p udp -- dport 53-j MASQUERADE
Now you have resolved the DNS, and you will find that you still cannot resolve the DNS, because after performing NAT on the DNS, your iptables does not allow you to access port 53. Therefore, all traffic destined for Port 53 will still fall, that is, the target network will not be reached. We can switch the DNS traffic of port 53 so that it can pass through.
[Root @ localhost ~] # Iptables-t filter-a forward-m iprange -- src-range 192.168.2.21-192.168.2.30-m time -- timestart 8:00 -- timestop 20:00 -- weekdays Mon, Tue, Wed, Thu, fri-p udp -- dport 53-j ACCEPT
After this step, you should be able to resolve the domain name, but you will find that you still cannot connect to the Internet, because when our data packets are sent out, it first needs to access port 3128 of the server, but iptables is set to block all traffic, so when we do not specify to allow it to pass, data packets are blocked. we can define rules to allow them to pass data packets. in this case, we use the INPUT and OUTPUT chains in the filter table. data packets directly enter port 3128, if no forwarding is performed, we cannot use the FORWARD chain.
[Root @ localhost ~] # Iptables-t filter-a input-p tcp -- dport 3128-j ACCEPT
[Root @ localhost ~] # Iptables-t filter-a output-m state -- state ESTABLISHED-j ACCEPT
Another step is to be done, because what we do now is to allow intranet users to access squid. However, if squid does not contain cache, squid uses its own port 80 to communicate with the internet. data from the Internet is sent to squid, and the squid server sends the data to the client, but now squid is not allowed to send and receive packets from port 80, so we need to define the rules that allow them to send and receive packets.
[Root @ localhost ~] # Iptables-t filter-a output-p tcp -- dport 80-s 192.168.101.129-j ACCEPT // because it is sent locally, use the Internet ip address of the squid server
[Root @ localhost ~] # Iptables-t filter-a input-m state -- state ESTABLISHED-j ACCEPT

2. Thunder is not allowed. a maximum of three connections are allowed.
If Thunder is not used, we still need to use iptables layer7 for implementation.
[Root @ localhost ~] # Iptables-t filter-a forward-m iprange -- src-range 192.168.2.21-192.168.2.30-m time -- timestart 8:00 -- timestop 20:00 -- weekdays Mon, Tue, Wed, Thu, fri-m layer7 -- l7proto xunlei-j DROP
Set connections
When setting the number of connections, iptables is always set incorrectly. I don't know what's going on. please help me to explain it, so I wrote the following rule on the squid proxy server:
Acl connlimit maxconn 3
Http_access deny connlimit
But I don't know if it is because of the caching function. I can't open the webpage until I open three webpages.
3. no restrictions after work
[Root @ localhost ~] # Iptables-t filter-a forward-m iprange -- src-range 192.168.2.21-192.168.2.30-m time -- timestart 20:01 -- timestop 07:59-j ACCEPT
(3) the manager's office can use http qq, and there is no limit after work. that is to say, if you do not need to set up the manager's office, you can use one command.
[Root @ localhost ~] # Iptables-a forward-m iprange -- src-range 192.168.2.31-192.168.2.40-j ACCEPT