Measure the test taker's knowledge about the classic applications of the Linux firewall to make the enterprise network more secure.

Article Title: Understanding classic Linux Firewall applications to make enterprise networks more secure. Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

The iptables command is used to filter packets and perform NAT Network Address Translation (Network Address Translation) as seen in man queries. This command has many applications, many applications on the network can be implemented.

Iptables-administration tool for IPv4 packet filtering and NAT

Application 1: allow computers on the regional network to share bandwidth (NAT) with a real IP Address)

Architecture diagram:

Required devices: One Linux server and two network cards

Nic 1: eth0, use real IP address, Nic 2: eth1, use 192.168.1.254

Set: Write the following lines in/etc/rc. d/rc. local:

Echo "1">/proc/sys/net/ipv4/ip_forward

Modprobe ip_tables

Modprobe ip_nat_ftp

Modprobe ip_conntrack

Modprobe ip_conntrack_ftp

Iptables-t nat-a postrouting-o eth0-s 192.168.1.0/24-j MASQUERADE

Application 2: allow computers on the regional network to share bandwidth (NAT) with an ADSL)

This example is very similar to the previous example, but a certain setting must be modified.

Architecture diagram:

Required devices: One Linux server and two network cards

Nic 1: eth0, use real IP address, Nic 2: eth1, use 192.168.1.254

Set: Write the following lines in/etc/rc. d/rc. local:

Echo "1">/proc/sys/net/ipv4/ip_forward

Modprobe ip_tables

Modprobe ip_nat_ftp

Modprobe ip_conntrack

Modprobe ip_conntrack_ftp

Iptables-t nat-a postrouting-o ppp0-s 192.168.1.0/24-j MASQUERADE

Application 3: allow external computers to access a server in the region Network)

This method protects internal servers.

Architecture diagram:

Required devices: One Linux server and two network cards

Nic 1: eth0, use real IP address, Nic 2: eth1, use 192.168.1.254

Set: Write the following lines in/etc/rc. d/rc. local:

Echo "1">/proc/sys/net/ipv4/ip_forward

Modprobe ip_tables

Modprobe ip_nat_ftp

Modprobe ip_conntrack

Modprobe ip_conntrack_ftp

Iptables-t nat-a postrouting-o eth0-s 192.168.1.0/24-j MASQUERADE

Iptables-t nat-a prerouting-I eth0-p tcp-d real IP -- dport 80-j DNAT -- to-destination 192.168.1.13: 80