Iptables settings in the CentOS system gateway server

Environment: Hardware: IBMX336 server software: CentOS5.5 + iptables-1.3.5 a configuration NetWork: intranet: Eth0: 192.168.0.253/24 Internet: Eth1: 112.95.145.157/24Eth0: vi/etc/sysconfig/network-scripts/ifcfg-eth0 Add: BOOTPR environment: Hardware: IBM X336 server
Software: CentOS 5.5 + Iptables-1.3.5
1. configure NetWork:
Intranet: Eth0: 192.168.0.253/24
Internet: Eth1: 112.95.145.157/24
Eth0: Vi /Etc/sysconfig/network-scripts/ifcfg-eth0
Added:
BOOTPROTO = static
IPADDR = 192.168.0.253
BROADCASK = 192.168.0.255
NETMASK = 255.255.255.0
NETWORK = 192.168.0.0
ONBOOT = yes
Eth1: Vi /Etc/sysconfig/network-scripts/ifcfg-eth1
Added:
BOOTPROTO = static
IPADDR = 112.95.145.157
NETMASK = 255.255.255.0
BROADCASK = 112.95.145.255
NETWORK = 112.95.145.0
ONBOOT = yes
Set Gateway:
Vi/etc/syscofig/network
Added:
NETWORKING = yes
NETWORKING_IPV4 = yes
GATEWAY = 112.95.145.1
HOSTNAME = GateWay
Set DNS:
Vi/etc/resolv. conf
Added:
Nameserver 210.21.196.6
Nameserver 221.5.55.88
Restart NETWORK: service network restart
After the network is successfully started, Ping the Gateway and external address to verify that the configuration is correct.
II. Iptables configuration
Iptables has been installed with the system. Check and confirm:
Rpm-qa iptables
In this example: iptables-1.3.5-5.3.e15_4.1
1. enable the IP forwarding function:
Echo 1>/proc/sys/net/ipv4/ip_forward
2. create nat camouflage
Iptables-t nat-a postrouting-o eth1-j MASQUERADE
Iptables-t nat-a postrouting-s 192.168.0.0/22-o eth1-jMASQUERADE (only create A specific subnet)
Nat)
3. create forwarding
Iptables-a forward-I eth0-j ACCEPT
Iptables-a forward-s 192.168.0.0/22-m state -- stateESTABLISHED, RELATED-j ACCEPT (specific subnet
)
4. Save The iptables configuration.
Service iptables save
The simplest gateway is configured. Various forwarding rules can be added according to the actual situation.
Find a client: set IP address: 192.168.0.2/24 GATEWAY: 192.168.0.253
DNS: 210.21.196.6 221.5.88.88
Verify that the external network can be accessed normally.
Three limits specific MAC IP address access
1 restrict external access to a specific MAC address:
Iptables-a forward-m mac -- mac-source xx: xx-jDROP
Unseal:
Iptables-d forward-m mac -- mac-source xx: xx-jDROP
Restrict all communications:
Iptables-a input-m mac -- mac-source xx: xx-jDROP
Unseal:
Iptables-a input-m mac -- mac-source xx: xx-jDROP
2 Restrict external access from a specific IP address:
Iptables-A FORWARD -S 192.168.0.x -JDROP
Unseal:
Iptables-D FORWARD -S 192.168.0.x -JDROP
Restrict all communications:
Iptables-A INPUT -S 192.168.0.x -J DROP
Unseal:
Iptables-D INPUT -S 192.168.0.x -J DROP
3 View all rules:
Iptables -L
Or: cat/etc/sysconfig/iptables
SSH external logon security settings.
SSH default port: 22 can be logged on as ROOT. The changes are as follows:
1. modify port
Vi/etc/ssh/sshd_config
Find line # Port 22 and add
Port 27481 (You can replace it with any port that does not conflict with the existing port)
2. modify the ROOT logon restriction.
Vi/etc/ssh/sshd_config
Find # PermitRootLogin yes to add
PermitRootLogin no
3. save and exit. Restart SSH
Service sshd restart
4. use the ssh software to test whether the configuration takes effect.