Linux iptables firewall configuration example

This article will introduce an iptables firewall script instance in linux and share it with you. if you need it, give it a reference. The iptables firewall configuration instance in linux is as follows: Sample Code: iptables-Fiptables-Xiptables-F-tmangleiptables-tmangle-Xiptables-F-tnatiptables-t

This article introducesIptablesA firewall script instance to share with you. if you need it, please give it a reference.

In linux, the iptables firewall configuration instance is as follows:
 

Sample code:

Iptables-F
Iptables-X
Iptables-F-t mangle
Iptables-t mangle-X
Iptables-F-t nat
Iptables-t nat-X

First, empty the three tables and empty the self-built rules.
 

Sample code:

Iptables-P INPUT DROP
Iptables-P OUTPUT DROP
Iptables-P FORWARD ACCEPT

Set the default policy of INPUT and OUTPUT to DROP and FORWARD to ACCEPT.

Sample code:

Iptables-a input-I lo-j ACCEPT
Iptables-a output-o lo-j ACCEPT

Open the "loop" first to avoid unnecessary troubles.

Sample code:

Iptables-a input-I eth +-p icmp -- icmp-type 8-j ACCEPT
Iptables-a output-o eth +-p icmp -- icmp-type 0-j ACCEPT

Enable the ping function on all NICs for easy maintenance and detection.

Sample code:

Iptables-a input-I eth0-s 192.168.100.250-d 192.168.100.1-ptcp -- dport 22-j
ACCEPT
Iptables-a output-o eth0-d 192.168.100.250-s 192.168.100.1-ptcp -- sport 22
-J ACCEPT

Open port 22 to allow remote management. (Many additional conditions are set: the IP address of the management machine must be 250 and must be entered from the eth0 NIC)
 

Sample code:

Iptables-a input-I eth0-s 192.168.100.0/24-p tcp -- dport3128-m state -- state
NEW, ESTABLISHED-j ACCEPT
Iptables-a output-o eth0-d 192.168.100.0/24-p tcp -- sport 3128-m state
-- State ESTABLISHED-j ACCEPT
Iptables-a input-I eth1-s 192.168.168.0/24-p tcp -- dport 3128-m state -- state
NEW, ESTABLISHED-j ACCEPT
Iptables-a output-o eth1-d 192.168.168.0/24-p tcp -- sport 3128-m state
-- State ESTABLISHED-j ACCEPT
Iptables-a input-I eth2-p tcp -- dport 32768: 61000-m state -- state
ESTABLISHED-j ACCEPT
Iptables-a output-o eth2-p tcp -- sport 32768: 61000-m state -- state
NEW, ESTABLISHED-j ACCEPT
Iptables-a output-o eth2-p udp -- dport 53-j ACCEPT
Iptables-a input-I eth2-p udp -- sport 53-j ACCEPT

Explanation of the above rules:
 

Sample code:

Iptables-a input-I eth0-s 192.168.100.0/24-p tcp -- dport3128-m state -- state NEW, ESTABLISHED-j ACCEPT

Allow machines in the 192.168.100.0/24 network segment to send data packets from the eth0 Nic. If the data packet is tcp and the destination port is 3128 (because REDIRECT has changed 80 to 3128. Nat table PREROUTING
It is before the INPUT of the filter table. ), And the data packet status must be NEW or ESTABLISHED (NEW represents the "first hold" of the tcp three-segment handshake, in other words, allow the client machine to send a link to the server
Apply. ESTABLISHED indicates that a link has been ESTABLISHED through a handshake.
 

Sample code:

Iptables-a output-o eth2-p tcp -- sport 32768: 61000-m state -- state NEW, ESTABLISHED-j ACCEPT

Let's take a look at this sentence. Now the data packet has entered the linux server firewall. Squid needs to be accessed in place of you. Therefore, the server becomes the role of the client, so it needs to use private ports from 32768 to 61000.
. (Some friends said it should be 1024 to 65535. In fact, the private ports defined in CentOS linux are 32768 to 61000. you can query them through cat/proc/sys/net/ipv4/ip_local_port_range.
Take a look .)

Statement again: squid accesses other servers as a client, so the source port here is 32768: 61000, not 3128!
 

Sample code:

Iptables-a input-I eth2-p tcp -- dport 32768: 61000-m state -- state ESTABLISHED-j ACCEPT

Of course, data goes back.
 

Sample code:

Iptables-a output-o eth0-d 192.168.100.0/24-p tcp -- sport3128-m state -- state ESTABLISHED-j ACCEPT

Data packets must be forwarded to the intranet Nic through the server. Note that squid helps you access the website you want to access. Therefore, in the intranet, your machine is a client role, while squid is a server role. This is similar to the external access
The process is different. So here, the source port is 3128 instead of 32768: 61000.
 

Sample code:

Iptables-a output-o eth2-p udp -- dport 53-j ACCEPT
Iptables-a input-I eth2-p udp -- sport 53-j ACCEPT

Above, configure dns access to allow.
 

Sample code:

Iptables-a input-I eth +-p tcp -- dport 80-j LOG -- log-prefix "iptables_80_alert"
-- Log-level info
Iptables-a input-I eth +-p tcp -- dport 21-j LOG -- log-prefix "iptables_21_alert"
-- Log-level info
Iptables-a input-I eth +-p tcp -- dport 22-j LOG -- log-prefix "iptables_22_alert"
-- Log-level info
Iptables-a input-I eth +-p tcp -- dport 25-j LOG -- log-prefix "iptables_25_alert"
-- Log-level info
Iptables-a input-I eth +-p icmp -- icmp-type 8-j LOG -- log-prefix
"Iptables_icmp8_alert" -- log-level info

Recording logs helps you analyze the cause of attacks or errors.