IPTABLES firewall configuration rules learning

1. only machines with 192.168.0.x and 192.168.0.y can connect to your pop3 server. But not for other users in the same network segment. #! /Bin/bashforiinnetfiltermangledoiptables-t $ I-Fiptables-t $ i-Xdoneip192.168.0iptables-tfilter-AINPUT-p

1. only machines with 192.168.0.x and 192.168.0.y can connect to your pop3 server. But not for other users in the same network segment.

#! /Bin/bash

For I in net filter mangle

Do

Iptables-T $ I-F

Iptables-t $ I-X

Done

Ip = "192.168.0"

Iptables-t filter-a input-p tcp-s $ ip.1 -- dport 110-jACCEPT

Iptables-t filter-a input-p tcp-s $ ip.2 -- dport 110-jACCEPT

Iptables-t filter-a input-p tcp-s $ ip.0/24 -- dport 110-jREJECT

2. set the default policy to INPUT and OUTPUT to reject all requests. However, you are allowed to access your own IP addresses (192.168.0.11 and 127.0.0.1.

#! /Bin/bash

For I in net filter mangle

Do

Iptables-t $ I-F

Iptables-t $ I-X

Done

Iptables-a input-s 192.168.0.11-j ACCEPT

Iptables-a input-s 127.0.0.1-j ACCEPT

Iptables-a output-d 192.168.0.11-j ACCEPT

Iptables-a output-d 127.0.0.1-j ACCEPT

Iptables-P INPUT REJECT DROP

Iptables-P OUTPUT REJECT DROP

# Iptables-a input-j REJECT

# Iptables-a output-j REJECT

3. only two persons are allowed, that is, two hosts can telnet you. for example, one of them is 192.168.0.123.

#! /Bin/bash

For I in net filter mangle

Do

Iptables-t $ I-F

Iptables-t $ I-X

Done

Ip = "192.168.0"

Iptables-a input-s ip.123 -- dport 23-j ACCEPT

Iptables-a input-s ip.124 -- dport 23-j ACCEPT

Iptables-a input-p tcp -- dport 23-j REJECT

4. allow two people to ping you once per second

#! /Bin/bash

Iptables-F

Iptables-t nat-F

Iptables-X

Iptables-t nat-X

Iptables-a input-s 192.68.0.1-p icmp -- icmp-type 8-m limit -- limit 1/s

Iptables-a input-s 192.68.0.2-p icmp -- icmp-type 8-m limit -- limit 1/s

5. allow you to access anyone

#! /Bin/bash

Iptables-F

Iptables-t nat-F

Iptables-X

Iptables-t nat-X

Iptables-a output -- tcp-flags SYN, ack syn-j ACCEPT

Iptables-a input -- tcp-flags -- syn

6. Test01 users can use their own ip addresses for testing purposes, but cannot access any other ip addresses.

#! /Bin/bash

Iptables-F

Iptables-t nat-F

Iptables-X

Iptables-t nat-X

Iptables-a output-p icmp -- icmp-type 8-j ACCEPT

Iptables-P OUTPUT REJECT

7. Test02 users can access any address

#! /Bin/bash

Iptables-F

Iptables-t nat-F

Iptables-X

Iptables-t nat-X

Iptables-a input-s Test02 (dns client)-j ACCEPT

Iptables-P INPUT REJECT DROP

8. define a customRulesTo log all the actions to access port 23.

#! /Bin/bash

Iptables-F

Iptables-t nat-F

Iptables-X

Iptables-t nat-X

Iptables-a forward -- dport 23-j LOG -- log-level debug (kern.info/var/log/iptables)