iptables笔记

秒速五厘米 2022-11-20 09:34 133阅读 0赞

指定默认规则iptables -P

[root@localhost ~]# iptables -P INPUT ACCEPT
    [root@localhost ~]# iptables -L -n
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination         
    
    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination         
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination

[root@localhost ~]# iptables -P FORWARD DROP
    [root@localhost ~]# iptables -L -n 
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination         
    
    Chain FORWARD (policy DROP)
    target     prot opt source               destination         
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination

添加规则

[root@localhost ~]# iptables -A INPUT -s 192.168.0.2 -d 192.168.0.3 -i any -p 80 -j ACCEPT
    [root@localhost ~]# iptables -L -n --line-number
    Chain INPUT (policy ACCEPT)
    num  target     prot opt source               destination         
    1    ACCEPT     80   --  192.168.0.2          192.168.0.3         
    
    Chain FORWARD (policy DROP)
    num  target     prot opt source               destination         
    
    Chain OUTPUT (policy ACCEPT)
    num  target     prot opt source               destination

修改规则

[root@localhost ~]# iptables -R  INPUT 1 -s 192.168.0.2 -d 192.168.0.3  -i eth0  -p tcp -j ACCEPT
    [root@localhost ~]# iptables -L -n --line-number
    Chain INPUT (policy ACCEPT)
    num  target     prot opt source               destination         
    1    ACCEPT     tcp  --  192.168.0.2          192.168.0.3         
    
    Chain FORWARD (policy DROP)
    num  target     prot opt source               destination         
    
    Chain OUTPUT (policy ACCEPT)
    num  target     prot opt source               destination

扩展端口控制

[root@localhost ~]# iptables -R  INPUT 1 -s 10.0.0.2 -d 10.0.10.62  -p tcp --sport 123 --dport 81 -j ACCEPT
    [root@localhost ~]# iptables -L -n --line-number
    Chain INPUT (policy ACCEPT)
    num  target     prot opt source               destination         
    1    ACCEPT     tcp  --  10.0.0.2             10.0.10.62           tcp spt:123 dpt:81
    
    Chain FORWARD (policy DROP)
    num  target     prot opt source               destination         
    
    Chain OUTPUT (policy ACCEPT)
    num  target     prot opt source               destination

注意： --sport、--dport必须加载-p tcp之后

firewall-cmd

usage: --permanent --direct --add-rule \{ ipv4 | ipv6 | eb \} <table> <chain> <priority> <args>

[root@localhost ~]# firewall-cmd --direct --add-rule ipv4 filter   INPUT 0  -p tcp --dport 8888 -j ACCEPT
    success
    [root@localhost ~]# iptables -L -n | grep 8888
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8888

## Linux下的包过滤软件：iptables剖析 ##

[https://www.shikanon.com/2020/%E8%BF%90%E7%BB%B4/Linux%E4%B8%8B%E7%9A%84%E5%8C%85%E8%BF%87%E6%BB%A4-iptables%E5%85%A8%E9%9D%A2%E5%89%96%E6%9E%90/][https_www.shikanon.com_2020_E8_BF_90_E7_BB_B4_Linux_E4_B8_8B_E7_9A_84_E5_8C_85_E8_BF_87_E6_BB_A4-iptables_E5_85_A8_E9_9D_A2_E5_89_96_E6_9E_90]

[https_www.shikanon.com_2020_E8_BF_90_E7_BB_B4_Linux_E4_B8_8B_E7_9A_84_E5_8C_85_E8_BF_87_E6_BB_A4-iptables_E5_85_A8_E9_9D_A2_E5_89_96_E6_9E_90]: https://www.shikanon.com/2020/%E8%BF%90%E7%BB%B4/Linux%E4%B8%8B%E7%9A%84%E5%8C%85%E8%BF%87%E6%BB%A4-iptables%E5%85%A8%E9%9D%A2%E5%89%96%E6%9E%90/