The Netfilter/iptables IP packet filtering system is a powerful tool for adding, editing, and removing rules that are followed and composed by firewalls when making packet filtering decisions. These rules are stored in a dedicated packet filtering table, and these tables are integrated into the Linux kernel. In the Packet filter table, the rules are grouped in our so-called chain (chain). []http://blog.hehehehehe.cn/a/7674.htm on the net of drinking small wine
The biggest advantage of netfilter/iptables is that it can configure stateful firewalls, which are an important feature that previous tools such as IPFWADM and IPChains cannot provide. Stateful firewalls can specify and remember the state of the connection established for sending or receiving packets. The firewall can obtain this information from the connection tracking state of the packet. When deciding on new packet filtering, these state information used by the firewall can increase its efficiency and speed. There are four valid states, named established, INVALID, NEW, and related, respectively.
#添加屏蔽IP
#禁止此IP访问服务器
Iptables-i input-s 1.2.3.4-j DROP
Or
Iptables-a input-s 1.2.3.4-j DROP
#禁止服务器访问此IP
Iptables-a output-d 1.2.3.4-j DROP
If you want to seal a network segment:
Iptables-i input-s 1.2.3.0/24-j DROP
#清空屏蔽IP
Iptables-t filter-d input-s 1.2.3.4-j DROP
Iptables-t filter-d output-d 1.2.3.4-j DROP
#一键清空所有规则
Iptables-f
#查看
Iptables-l INPUT
Or
Iptables-l
Or
Iptables-save (This command will save the rule, the next time the power-on automatic execution)
#处理IP碎片数量, prevent attacks, allow 100 per second
Iptables-a forward-f-M limit--limit 100/s--limit-burst 100-j ACCEPT
#设置ICMP包过滤, allow 1 packets per second, limit the trigger condition to 10 packets
Iptables-a forward-p icmp-m limit--limit 1/s--limit-burst 10-j accept[Drink small wine net pick]http://blog.hehehehehe.cn/a/7674.htm
reprinted from [blog.hehehehehe.cn] drink small wine net pick and this article link address: http://blog.hehehehehe.cn/a/7674.htm
Related articles
- Network Judgment Operations Related Classic command line
- User-agent to determine if JS is supported
- ASP leads into Excel
- ASP error code description
- NeoSpeech Chinese male Voice Liang installation package and special file electric Donkey
Access Source #
- ip:218.16.40.154:iptables
- ip:220.249.15.190:iptable Shielded IP
- ip:114.222.44.213:iptables drop Regular
- ip:14.16.12.140:Linux filter Thunder packet
- ip:58.213.46.202: shielded C network segment Iptables
- ip:219.151.40.121: shielded IP mac
- ip:180.168.34.26:iptables shielded IP
Linux uses iptables shielded IP segments
