建站
咨詢
售后
建站咨詢
新聞中心
這里有您想知道的互聯(lián)網(wǎng)營銷解決方案
生產(chǎn)環(huán)境中常用的iptables腳本
iptables是用于監(jiān)控進/出服務(wù)器流量的一個工具，iptables使用一個叫做table的結(jié)構(gòu)，而這些tables包含了一系列規(guī)則(set of rules)，我們稱這些規(guī)則為chain，chain會過濾進/出服務(wù)器的數(shù)據(jù)包(data packets)。
創(chuàng)新互聯(lián)長期為近1000家客戶提供的網(wǎng)站建設(shè)服務(wù)，團隊從業(yè)經(jīng)驗10年，關(guān)注不同地域、不同群體，并針對不同對象提供差異化的產(chǎn)品和服務(wù)；打造開放共贏平臺，與合作伙伴共同營造健康的互聯(lián)網(wǎng)生態(tài)環(huán)境。為普寧企業(yè)提供專業(yè)的成都網(wǎng)站建設(shè)、網(wǎng)站制作，普寧網(wǎng)站改版等技術(shù)服務(wù)。擁有十年豐富建站經(jīng)驗和眾多成功案例,為您定制開發(fā)。
創(chuàng)建 iptables.sh 腳本
[root@Jaking ~]# vim iptables.sh
#!/bin/bash
#清空 filter 表和 nat 表
iptables -F
iptables -t nat -F
#關(guān)掉 firewalld
systemctl stop firewalld &>/dev/null
systemctl disable firewalld &>/dev/null
#以下兩行允許某些調(diào)用 localhost 的應(yīng)用訪問
iptables -A INPUT -i lo -j ACCEPT #規(guī)則1
iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT #規(guī)則2
#以下一行允許從其他地方 ping
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT #規(guī)則3
#以下一行允許從其他主機、網(wǎng)絡(luò)設(shè)備發(fā)送 MTU 調(diào)整的報文
#在一些情況下，例如通過 IPSec VPN 隧道時，主機的 MTU 需要動態(tài)減小
iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT #規(guī)則4
#以下兩行分別允許所有來源訪問 TCP 80,443 端口
iptables -A INPUT -p tcp --dport 80 -j ACCEPT #規(guī)則5
iptables -A INPUT -p tcp --dport 443 -j ACCEPT #規(guī)則6
#以下一行允許所有來源訪問 UDP 80,443 端口
iptables -A INPUT -p udp -m multiport --dports 80,443 -j ACCEPT #規(guī)則7
#以下一行允許 192.168.1.63 來源的 IP 訪問 TCP 22 端口(OpenSSH)
iptables -A INPUT -p tcp -s 192.168.1.63 --dport 22 -j ACCEPT #規(guī)則8
#以下一行允許 192.168.1.3(發(fā)起SSH連接的系統(tǒng)對應(yīng)網(wǎng)卡的IP) 來源的 IP 訪問 TCP 22 端口(OpenSSH)
#如果是在遠程終端跑本腳本，最好開啟以下一行以防被踢掉
#另一種更加簡便的方式：iptables -I INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -s 192.168.1.3 --dport 22 -j ACCEPT #規(guī)則9
#以下一行允許 192.168.1.26 來源的 IP 訪問 UDP 161 端口(SNMP)
iptables -A INPUT -p udp -s 192.168.1.26 --dport 161 -j ACCEPT #規(guī)則10
#配置 NAT
#啟用內(nèi)核路由轉(zhuǎn)發(fā)功能
echo 1 > /proc/sys/net/ipv4/ip_forward
echo "net.ipv4.ip_forward = 1" > /etc/sysctl.conf
sysctl -p &>/dev/null
#配置源地址轉(zhuǎn)換 SNAT
#將 192.168.2.0/24 轉(zhuǎn)換成 192.168.1.63
iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -j SNAT --to 192.168.1.63 #規(guī)則11
#配置目的地址轉(zhuǎn)換 DNAT
#將 192.168.1.63 的 80 端口請求轉(zhuǎn)發(fā)到 192.168.2.2 的 80 端口
iptables -t nat -A PREROUTING -d 192.168.1.63 -p tcp --dport 80 -j DNAT --to 192.168.2.2:80 #規(guī)則12
#以下一行禁止所有其他的進入流量
iptables -A INPUT -j DROP #規(guī)則13
#以下一行允許本機響應(yīng)規(guī)則編號為 1-12 的數(shù)據(jù)包發(fā)出
iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT #規(guī)則14
#以下一行禁止本機主動發(fā)出外部連接
iptables -A OUTPUT -j DROP #規(guī)則15
#以下一行禁止本機轉(zhuǎn)發(fā)數(shù)據(jù)包
iptables -A FORWARD -j DROP #規(guī)則16
#固化 iptables
iptables-save > /etc/sysconfig/iptables
[root@Jaking ~]# chmod 755 iptables.sh
測試
[root@Jaking ~]# ./iptables.sh
[root@Jaking ~]#
[root@Jaking ~]#
[root@Jaking ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT all -- localhost localhost
ACCEPT icmp -- anywhere anywhere icmp echo-request
ACCEPT icmp -- anywhere anywhere icmp fragmentation-needed
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT udp -- anywhere anywhere multiport dports http,https
ACCEPT tcp -- 192.168.1.63 anywhere tcp dpt:ssh
ACCEPT tcp -- 192.168.1.3 anywhere tcp dpt:ssh
ACCEPT udp -- 192.168.1.26 anywhere udp dpt:snmp
DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
DROP all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state ESTABLISHED
DROP all -- anywhere anywhere
[root@Jaking ~]# iptables -L --line-number
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere
2 ACCEPT all -- localhost localhost
3 ACCEPT icmp -- anywhere anywhere icmp echo-request
4 ACCEPT icmp -- anywhere anywhere icmp fragmentation-needed
5 ACCEPT tcp -- anywhere anywhere tcp dpt:http
6 ACCEPT tcp -- anywhere anywhere tcp dpt:https
7 ACCEPT udp -- anywhere anywhere multiport dports http,https
8 ACCEPT tcp -- 192.168.1.63 anywhere tcp dpt:ssh
9 ACCEPT tcp -- 192.168.1.3 anywhere tcp dpt:ssh
10 ACCEPT udp -- 192.168.1.26 anywhere udp dpt:snmp
11 DROP all -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 DROP all -- anywhere anywhere
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- anywhere anywhere state ESTABLISHED
2 DROP all -- anywhere anywhere
[root@Jaking ~]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
DNAT tcp -- anywhere 192.168.1.63 tcp dpt:http to:192.168.2.2:80
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 192.168.2.0/24 anywhere to:192.168.1.63
[root@Jaking ~]# iptables -t nat -L --line-number
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 DNAT tcp -- anywhere 192.168.1.63 tcp dpt:http to:192.168.2.2:80
Chain INPUT (policy ACCEPT)
num target prot opt source destination
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
num target prot opt source destination
1 SNAT all -- 192.168.2.0/24 anywhere to:192.168.1.63
iptables 的清空和恢復(fù)
[root@Jaking ~]# iptables -F
[root@Jaking ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@Jaking ~]# iptables -t nat -F
[root@Jaking ~]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
[root@Jaking ~]# iptables-restore [root@Jaking ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- localhost localhost ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT icmp -- anywhere anywhere icmp fragmentation-needed ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT udp -- anywhere anywhere multiport dports http,https ACCEPT tcp -- 192.168.1.63 anywhere tcp dpt:ssh ACCEPT tcp -- 192.168.1.3 anywhere tcp dpt:ssh ACCEPT udp -- 192.168.1.26 anywhere udp dpt:snmp DROP all -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state ESTABLISHED DROP all -- anywhere anywhere [root@Jaking ~]# iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp -- anywhere 192.168.1.63 tcp dpt:http to:192.168.2.2:80 Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination SNAT all -- 192.168.2.0/24 anywhere to:192.168.1.63 文章標(biāo)題：生產(chǎn)環(huán)境中常用的iptables腳本
本文來源：http://www.5511xx.com/article/cdgdgpi.html
