超級(jí)實(shí)用的iptables防火墻腳本怎么用
這篇文章給大家分享的是有關(guān)超級(jí)實(shí)用的iptables防火墻腳本怎么用的內(nèi)容。小編覺(jué)得挺實(shí)用的，因此分享給大家做個(gè)參考，一起跟隨小編過(guò)來(lái)看看吧。
創(chuàng)新互聯(lián)服務(wù)緊隨時(shí)代發(fā)展步伐，進(jìn)行技術(shù)革新和技術(shù)進(jìn)步，經(jīng)過(guò)十載的發(fā)展和積累，已經(jīng)匯集了一批資深網(wǎng)站策劃師、設(shè)計(jì)師、專業(yè)的網(wǎng)站實(shí)施團(tuán)隊(duì)以及高素質(zhì)售后服務(wù)人員，并且完全形成了一套成熟的業(yè)務(wù)流程，能夠完全依照客戶要求對(duì)網(wǎng)站進(jìn)行成都網(wǎng)站設(shè)計(jì)、成都網(wǎng)站制作、建設(shè)、維護(hù)、更新和改版，實(shí)現(xiàn)客戶網(wǎng)站對(duì)外宣傳展示的首要目的，并為客戶企業(yè)品牌互聯(lián)網(wǎng)化提供全面的解決方案。
創(chuàng)建 iptables.sh 腳本
[root@Jaking ~]# vim iptables.sh #!/bin/bash #清空 filter 表和 nat 表 iptables -F iptables -t nat -F #關(guān)掉 firewalld systemctl stop firewalld &>/dev/null systemctl disable firewalld &>/dev/null #以下兩行允許某些調(diào)用 localhost 的應(yīng)用訪問(wèn) iptables -A INPUT -i lo -j ACCEPT #規(guī)則1 iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT #規(guī)則2 #以下一行允許從其他地方 ping iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT #規(guī)則3 #以下一行允許從其他主機(jī)、網(wǎng)絡(luò)設(shè)備發(fā)送 MTU 調(diào)整的報(bào)文 #在一些情況下，例如通過(guò) IPSec VPN 隧道時(shí)，主機(jī)的 MTU 需要?jiǎng)討B(tài)減小 iptables -A INPUT -p icmp --icmp-type fragmentation-needed -j ACCEPT #規(guī)則4 #以下兩行分別允許所有來(lái)源訪問(wèn) TCP 80,443 端口 iptables -A INPUT -p tcp --dport 80 -j ACCEPT #規(guī)則5 iptables -A INPUT -p tcp --dport 443 -j ACCEPT #規(guī)則6 #以下一行允許所有來(lái)源訪問(wèn) UDP 80,443 端口 iptables -A INPUT -p udp -m multiport --dports 80,443 -j ACCEPT #規(guī)則7 #以下一行允許 192.168.1.63 來(lái)源的 IP 訪問(wèn) TCP 22 端口(OpenSSH) iptables -A INPUT -p tcp -s 192.168.1.63 --dport 22 -j ACCEPT #規(guī)則8 #以下一行允許 192.168.1.3(發(fā)起SSH連接的系統(tǒng)對(duì)應(yīng)網(wǎng)卡的IP) 來(lái)源的 IP 訪問(wèn) TCP 22 端口(OpenSSH) #如果是在遠(yuǎn)程終端跑本腳本，最好開啟以下一行以防被踢掉 #另一種更加簡(jiǎn)便的方式：iptables -I INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp -s 192.168.1.3 --dport 22 -j ACCEPT #規(guī)則9 #以下一行允許 192.168.1.26 來(lái)源的 IP 訪問(wèn) UDP 161 端口(SNMP) iptables -A INPUT -p udp -s 192.168.1.26 --dport 161 -j ACCEPT #規(guī)則10 #配置 NAT #啟用內(nèi)核路由轉(zhuǎn)發(fā)功能 echo 1 > /proc/sys/net/ipv4/ip_forward echo "net.ipv4.ip_forward = 1" > /etc/sysctl.conf sysctl -p &>/dev/null #配置源地址轉(zhuǎn)換 SNAT #將 192.168.2.0/24 轉(zhuǎn)換成 192.168.1.63 iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -j SNAT --to 192.168.1.63 #規(guī)則11 #配置目的地址轉(zhuǎn)換 DNAT #將 192.168.1.63 的 80 端口請(qǐng)求轉(zhuǎn)發(fā)到 192.168.2.2 的 80 端口 iptables -t nat -A PREROUTING -d 192.168.1.63 -p tcp --dport 80 -j DNAT --to 192.168.2.2:80 #規(guī)則12 #以下一行禁止所有其他的進(jìn)入流量 iptables -A INPUT -j DROP #規(guī)則13 #以下一行允許本機(jī)響應(yīng)規(guī)則編號(hào)為 1-12 的數(shù)據(jù)包發(fā)出 iptables -A OUTPUT -m state --state ESTABLISHED -j ACCEPT #規(guī)則14 #以下一行禁止本機(jī)主動(dòng)發(fā)出外部連接 iptables -A OUTPUT -j DROP #規(guī)則15 #以下一行禁止本機(jī)轉(zhuǎn)發(fā)數(shù)據(jù)包 iptables -A FORWARD -j DROP #規(guī)則16 #固化 iptables iptables-save > /etc/sysconfig/iptables [root@Jaking ~]# chmod 755 iptables.sh
測(cè)試
[root@Jaking ~]# ./iptables.sh [root@Jaking ~]# [root@Jaking ~]# [root@Jaking ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- localhost localhost ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT icmp -- anywhere anywhere icmp fragmentation-needed ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT udp -- anywhere anywhere multiport dports http,https ACCEPT tcp -- 192.168.1.63 anywhere tcp dpt:ssh ACCEPT tcp -- 192.168.1.3 anywhere tcp dpt:ssh ACCEPT udp -- 192.168.1.26 anywhere udp dpt:snmp DROP all -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state ESTABLISHED DROP all -- anywhere anywhere [root@Jaking ~]# iptables -L --line-number Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- anywhere anywhere 2 ACCEPT all -- localhost localhost 3 ACCEPT icmp -- anywhere anywhere icmp echo-request 4 ACCEPT icmp -- anywhere anywhere icmp fragmentation-needed 5 ACCEPT tcp -- anywhere anywhere tcp dpt:http 6 ACCEPT tcp -- anywhere anywhere tcp dpt:https 7 ACCEPT udp -- anywhere anywhere multiport dports http,https 8 ACCEPT tcp -- 192.168.1.63 anywhere tcp dpt:ssh 9 ACCEPT tcp -- 192.168.1.3 anywhere tcp dpt:ssh 10 ACCEPT udp -- 192.168.1.26 anywhere udp dpt:snmp 11 DROP all -- anywhere anywhere Chain FORWARD (policy ACCEPT) num target prot opt source destination 1 DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- anywhere anywhere state ESTABLISHED 2 DROP all -- anywhere anywhere [root@Jaking ~]# iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp -- anywhere 192.168.1.63 tcp dpt:http to:192.168.2.2:80 Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination SNAT all -- 192.168.2.0/24 anywhere to:192.168.1.63 [root@Jaking ~]# iptables -t nat -L --line-number Chain PREROUTING (policy ACCEPT) num target prot opt source destination 1 DNAT tcp -- anywhere 192.168.1.63 tcp dpt:http to:192.168.2.2:80 Chain INPUT (policy ACCEPT) num target prot opt source destination Chain OUTPUT (policy ACCEPT) num target prot opt source destination Chain POSTROUTING (policy ACCEPT) num target prot opt source destination 1 SNAT all -- 192.168.2.0/24 anywhere to:192.168.1.63
iptables 的清空和恢復(fù)
[root@Jaking ~]# iptables -F [root@Jaking ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@Jaking ~]# iptables -t nat -F [root@Jaking ~]# iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination [root@Jaking ~]# iptables-restore < /etc/sysconfig/iptables [root@Jaking ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT all -- localhost localhost ACCEPT icmp -- anywhere anywhere icmp echo-request ACCEPT icmp -- anywhere anywhere icmp fragmentation-needed ACCEPT tcp -- anywhere anywhere tcp dpt:http ACCEPT tcp -- anywhere anywhere tcp dpt:https ACCEPT udp -- anywhere anywhere multiport dports http,https ACCEPT tcp -- 192.168.1.63 anywhere tcp dpt:ssh ACCEPT tcp -- 192.168.1.3 anywhere tcp dpt:ssh ACCEPT udp -- 192.168.1.26 anywhere udp dpt:snmp DROP all -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere state ESTABLISHED DROP all -- anywhere anywhere [root@Jaking ~]# iptables -t nat -L Chain PREROUTING (policy ACCEPT) target prot opt source destination DNAT tcp -- anywhere 192.168.1.63 tcp dpt:http to:192.168.2.2:80 Chain INPUT (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain POSTROUTING (policy ACCEPT) target prot opt source destination SNAT all -- 192.168.2.0/24 anywhere to:192.168.1.63
感謝各位的閱讀！關(guān)于“超級(jí)實(shí)用的iptables防火墻腳本怎么用”這篇文章就分享到這里了，希望以上內(nèi)容可以對(duì)大家有一定的幫助，讓大家可以學(xué)到更多知識(shí)，如果覺(jué)得文章不錯(cuò)，可以把它分享出去讓更多的人看到吧！
標(biāo)題名稱：超級(jí)實(shí)用的iptables防火墻腳本怎么用
網(wǎng)頁(yè)鏈接：http://www.aaarwkj.com/article10/gdipdo.html
成都網(wǎng)站建設(shè)公司_創(chuàng)新互聯(lián)，為您提供定制開發(fā)、外貿(mào)建站、商城網(wǎng)站、移動(dòng)網(wǎng)站建設(shè)、用戶體驗(yàn)、建站公司
聲明：本網(wǎng)站發(fā)布的內(nèi)容（圖片、視頻和文字）以用戶投稿、用戶轉(zhuǎn)載內(nèi)容為主，如果涉及侵權(quán)請(qǐng)盡快告知，我們將會(huì)在第一時(shí)間刪除。文章觀點(diǎn)不代表本網(wǎng)站立場(chǎng)，如需處理請(qǐng)聯(lián)系客服。電話：028-86922220；郵箱：631063699@qq.com。內(nèi)容未經(jīng)允許不得轉(zhuǎn)載，或轉(zhuǎn)載時(shí)需注明來(lái)源： 創(chuàng)新互聯(lián)
- 怎樣進(jìn)行關(guān)鍵詞優(yōu)化來(lái)提高搜索引擎排名呢 2021-11-26
- seo人員如何區(qū)分關(guān)鍵詞優(yōu)化和整站優(yōu)化？ 2015-01-23
- 品牌關(guān)鍵詞優(yōu)化的作用是什么？ 2015-07-18
- 關(guān)鍵詞優(yōu)化的意義是什么？ 2022-05-26
- SEO關(guān)鍵詞優(yōu)化解決方案 2023-04-06
- 整站優(yōu)化與關(guān)鍵詞優(yōu)化有哪些區(qū)別 2022-07-29
- 網(wǎng)站關(guān)鍵詞優(yōu)化策略布局 2014-06-24
- 關(guān)鍵詞優(yōu)化為什么是企業(yè)網(wǎng)站建設(shè)的核心 2021-01-02
- 如何把網(wǎng)站關(guān)鍵詞優(yōu)化到百度首頁(yè)? 2015-08-11
- 關(guān)鍵詞優(yōu)化之如何布局長(zhǎng)尾詞？ 2023-05-01
- 分享網(wǎng)站關(guān)鍵詞優(yōu)化的成功經(jīng)驗(yàn) 2013-08-19
- 網(wǎng)站長(zhǎng)尾關(guān)鍵詞優(yōu)化的技 2023-04-07