iptables练习题
1.仅允许192.168.1.0/24网段访问本机的192.168.1.202的60522,其余禁掉
[[email protected] ~]#iptables -F #清空默认规则 [[email protected] ~]#/etc/init.d/iptables save #保存 [[email protected] ~]#iptables -t filter -I INPUT -s 192.168.1.0/24 -d 192.168.1.202 -p tcp --dport 60522 -j ACCEPT #定义入向流量 [[email protected] ~]#iptables -t filter -I OUTPUT -s 192.168.1.202 -d 192.168.1.0/24 -p tcp --sport 60522 -j ACCEPT #定义出现流量 [[email protected] ~]#iptables -P INPUT DROP #设置默认入向拒绝 [[email protected] ~]#iptables -P OUTPUT DROP #设置默认出向拒绝 [[email protected] ~]#iptables -P FORWARD DROP #设置默认转发拒绝 [[email protected] ~]#/etc/init.d/iptables save #保存 [[email protected] ~]# iptables -nvL #查看规则 Chain INPUT (policy DROP 7 packets, 588 bytes) pkts bytes target prot opt in out source destination 557 37400 ACCEPT tcp -- * * 192.168.1.0/24 192.168.1.202 tcp dpt:60522 Chain FORWARD (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy DROP 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 163 15980 ACCEPT tcp -- * * 192.168.1.202 192.168.1.0/24 tcp spt:60522
2.允许自己ping别人,但是别人无法ping自己
[[email protected] ~]# iptables -A OUTPUT -p icmp --icmp-type 8 -j ACCEPT [[email protected] ~]# iptables -A INPUT -p icmp --icmp-type 0 -j ACCEPT [[email protected] ~]# iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT [[email protected] ~]# iptables -A OUTPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
#站在A主机的角度看,自己ping对端,自己的icmp echo 要能出去,对端回应的icmp relay要可以进来,但入向的icmp echo和出向icmp relay被默认规则拦截了;还有若是上题的规则,对端无法ping通自己,但自己也无法ping通对端
3.动态NAT转发,内网主机B通过主机A访问Internet
主机A配置:
[[email protected] ~]# echo 1 > /proc/sys/net/ipv4/ip_forward [[email protected] ~]# iptables -t nat -A POSTROUTING -s 192.168.2.0/24 -o eth0 -j MASQUERADE [[email protected] ~]# iptables -t nat -nvL Chain PREROUTING (policy ACCEPT 1 packets, 78 bytes) pkts bytes target prot opt in out source destination Chain POSTROUTING (policy ACCEPT 1 packets, 124 bytes) pkts bytes target prot opt in out source destination 0 0 MASQUERADE all -- * eth0 192.168.2.0/24 0.0.0.0/0 Chain OUTPUT (policy ACCEPT 1 packets, 124 bytes) pkts bytes target prot opt in out source destination
主机B配置:
[[email protected] ~]# route del default gw 192.168.1.1 [[email protected] ~]# route add default gw 192.168.2.1 dev eth1 Kernel IP routing table Destination Gateway Genmask Flags Metric Ref Use Iface 192.168.2.0 * 255.255.255.0 U 0 0 0 eth1 192.168.1.0 * 255.255.255.0 U 0 0 0 eth0 link-local * 255.255.0.0 U 1002 0 0 eth0 default 192.168.2.1 0.0.0.0 UG 0 0 0 eth1
测试:
[[email protected] ~]# traceroute www.baidu.com #若没有traceroute命令,请用yum install -y traceroute安装 traceroute to www.baidu.com (115.239.211.112), 30 hops max, 60 byte packets 1 192.168.2.1 (192.168.2.1) 0.355 ms 0.234 ms 0.181 ms 2 * * *
4.NAT端口映射,内网主机是WEB Server,需要将80端口映射出去
[[email protected] ~]#iptables -t nat -A PREROUTING -d 192.168.1.201 -p tcp --dport 80 -j DNAT --to 192.168.2.2:80 #nat端口映射 [[email protected] ~]#iptables -t nat -A POSTROUTING -d 192.168.2.2 -p tcp --dport 80 -j SNAT --to 192.168.2.1 #源NAT,更改访问IP [[email protected] ~]#iptables -A FORWARD -d 192.168.2.2 -p tcp --dport 80 -j ACCEPT #允许转发流量 [[email protected] ~]#iptables -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT #若多端口协议(如FTP),需允许关联包和确认包 [[email protected] ~]# iptables -t filter -A INPUT -d 192.168.1.201 -p tcp --dport 80 -j ACCEPT #允许80流入流量 [[email protected] ~]# iptables -t filter -A OUTPUT -s 192.168.1.201 -p tcp --sport 80 -j ACCEPT #允许80流出流量 [[email protected] ~]#iptables -t filter -I INPUT -s 192.168.1.0/24 -d 192.168.1.201 -p tcp --dport 22 -j ACCEPT #允许SSH入向流量 [[email protected] ~]#iptables -t filter -I OUTPUT -s 192.168.1.201 -d 192.168.1.0/24 -p tcp --sport 22 -j ACCEPT #允许SSH出现流量 [[email protected] ~]#iptables -P INPUT DROP #默认禁掉所有入向流量 [[email protected] ~]#iptables -P OUTPUT DROP #默认禁掉所有出向流量 [[email protected] ~]#iptables -P FORWARD DROP #默认禁掉所有转发流量
转载于:https://blog.51cto.com/szk5043/1755215