linux-Firewall iptables

Firewall

Main model firewall (Protect yourself)

Network-based protection wall (to protect a network)

Implementation of hardware firewall software firewall

Iptables

172.40.55.10 (to protect yourself with iptables)

[Email protected] ~]# rpm-q iptables

Iptables-1.4.7-16.el6.x86_64

[Email protected] ~]#

Kernel-state filter (function)

User-configured iptables (management tool)

4 Sheets (function)

Raw do state tracking

Mangle playing Tag

NAT does address or port translation

Filter default table, filtering IP packets (3-link INPUT OUTPUT FORWARD)

5 Chains (direction of IP packet transmission)

INPUT handles IP packets that enter the firewall native

OUTPUT handles IP packets that go out of the firewall native

FORWARD processing IP packets that pass from the firewall native

Postrouting Routing post-processing

Prerouting Route Pre-processing

Management options

View-L

Clear all Rules-f

Set default rules for a chain in a table-p

Add a new rule to a chain in a table

-A new rule at the end of an existing rule

-I new rule added above existing rules

-I number new rule add above specified rule

-D Delete a rule

Match criteria

-s Specifies the source address in the IP packet 172.40.55.10 172.40.55.0/24

-d Specifies the destination address in the IP packet 172.40.55.10 172.40.55.0/24

-P Data Transfer Protocol TCP UDP ICMP

--dport Destination Port

--sport Source Port

-i specifies the network interface to which the IP packet enters

-o Specifies the IP packet out of the network interface

Handling actions

ACCEPT

DROP

REJECT

Writing firewall rules

IPTABLES-T Table name Management Select Necklace name matching condition-J processing action

Iptables-t filter-p INPUT DROP

Iptables-t filter-a input-s 172.40.55.10-j ACCEPT

Iptables-t filter-l INPUT

[Email protected] ~]# iptables-t filter--LINE-NUMBERS-NL INPUT

Chain INPUT (Policy ACCEPT)

Num Target prot opt source destination

1 ACCEPT All--172.40.55.10 0.0.0.0/0

[Email protected] ~]#

Iptables-i input-s 172.40.55.190-p TCP--dport 22-j ACCEPT

Iptables-i INPUT 2-s 172.40.55.103-p tcp--dport 22-j ACCEPT

Iptables-t filter-d INPUT 2

Iptables-f INPUT

Iptables-f

Only allow yourself to ping others are not allowed to ping themselves

Iptables-t filter-p INPUT DROP

Iptables-t filter-p OUTPUT DROP

Iptables-f

Iptables-t filter-a output-p ICMP--help

Iptables-t filter-a output-p ICMP--icmp-type echo-request-j ACCEPT

Iptables-t filter-a input-p ICMP--icmp-type echo-reply-j ACCEPT

++++++++++++++++++++++++++++++

Iptables-t filter-p INPUT ACCEPT

Iptables-t filter-p OUTPUT ACCEPT

Iptables-f

Iptables-t filter-a input-p ICMP--icmp-type echo-request-j REJECT

Iptables-t filter-a output-d 172.40.55.10-p tcp--dport 22-j DROP

SSH [email protected]

++++++++++++++++++++++++++++++++++++++++

[Email protected] ~]# iptables-a input-s 192.168.4.120-j DROP

[Email protected] ~]# iptables-a input-s 10.0.10.0/24-j DROP

[Email protected] ~]# iptables-a forward-s 192.168.0.0/16-i eth1-j DROP

[Email protected] ~]# iptables-a forward-s 172.16.0.0/16-i eth1-j DROP

Iptables-t filter-p INPUT DROP

Iptables-t filter-a input-s 172.40.55.0/24-j ACCEPT

Iptables-t filter-i input-s 172.40.55.10-j DROP

[Email protected] ~]# iptables-a forward-s 192.168.0.0/16-i eth1-j DROP

[Email protected] ~]# iptables-a forward-s 172.16.0.0/16-i eth1-j DROP

[Email protected] ~]# iptables-a input-s 192.168.168.0/24 \

-P TCP--dport 22-j ACCEPT

[[email protected] ~]# iptables-a input-s 220.181.78.0/24-p tcp--dport 22-j ACCEPT

[[email protected] ~]# iptables-a input-p TCP--dport 22-j DROP

[Email protected] ~]# iptables-a INPUT! -S 192.168.168.0/24-p TCP--dport 20:21-j DROP

[[email protected] ~]# iptables-a input-p ICMP--icmp-type \

Echo-request-j DROP

[[email protected] ~]# iptables-a input-p ICMP! --icmp-type \

Echo-request-j ACCEPT

[[email protected] ~]# iptables-a output-p ICMP--icmp-type \

Echo-request-j ACCEPT

[[email protected] ~]# iptables-a output-p ICMP! --icmp-type \

Echo-request-j DROP

Extended Match criteria

linux-Firewall iptables