Linux Firewall
Release the packets in the link
Linux Firewall
Esatblished Keep Links related create additional links
Iptables-i input-p ICMP--icmp-type 8-j DROP Join this rule outside the network ping different inside and outside can be flat through the outside network
Ping different ICMP Eight rules Dorp out after adding rules
Linux Firewall
Ping before you join the rules
Linux Firewall
NAT Table Application
Linux Firewall
1. Increase the NIC selection LAN segment can add itself equivalent to connect to an intranet switch Sisu network link is not on
Linux Firewall
2. The second machine to add a network card already has a network card do not select the start-Up link!! Must select the same segment
Linux Firewall
3. Configure the IP of the first machine temporarily set IP no configuration file required copy
Linux Firewall
4. Another machine to set the new LAN IP network IP
Linux Firewall
5. Open route open port forwarding default to 0
Linux Firewall
6. Add a rule
Iptables-t nat-a postrouting-s 192.168.100.0/24-o ens33-j Masquerade
Linux Firewall
7.B Machine Setup Gateway Route-n
Linux Firewall
8. Setting up a DNS ping outside the network
Linux Firewall
Demand 2
Want to Telnet 2 machine through 1 machine jump to 2 machine to map 2 machine 22 port to other ports access this port is Access 2 machine 22 port
1. Open a rule before routing forward delete
Linux Firewall
2. Add a rule
1.PREROUTING incoming packet destination IP port 1122 forwarding to destination IP port from 130 to 100
Linux Firewall
2. Come back to the packet IP from 100.100 back to the packet passed snat to source IP from 100 back to the source IP 130
Linux Firewall
3. Add a Gateway 2
Linux Firewall
4. Create a new session-mapped port
Linux Firewall
5. Link Extranet
Linux Firewall
6.W View Users
Linux Firewall
Iptables-i input-m iprange--src-range 61.4.176.0-61.4.191.255-j DROP reject data link for a network segment
iptables Limit syn speed
Principle, the TCP three handshake in each 5s is more than 20 times of the abnormal access.
Iptables-a input-s! 192.168.0.0/255.255.255.0-d 192.168.0.101-p tcp-m TCP--dport 80-m State--state new-m recent--set--name Httpuser- -rsource
Iptables-a input-m Recent--update--seconds 5--hitcount--name httpuser--rsource-j DROP
Where 192.168.0.0/255.255.255.0 is an unrestricted network segment, 192.168.0.101 is a native IP.
This iptables strategy can effectively prevent SYN attacks, but also effectively prevents the robot from spamming.
Firewall for Linux
