Linux系统iptables内外网安全策略。

规划

• 内部PC1位于内网区域，地址段为： 192.168.1.0/24，pc1地址为：192.168.1.1/24，网关地址为：192.168.1.254/24

• 服务器S1位于服务器区域，地址段为： 192.168.2.0/24，pc1地址为：192.168.2.1/24，网关地址为：192.168.2.254/24

• PC2位于互联网区域，模拟外部互联网，地址段为：10.0.0.0/8，pc2地址为：10.0.0.1/8

• Linux防火墙的三块网卡为别连接不同的网络区域，地址分别为 ：ens160 192.168.1.254/24；ens224 10.0.0.100/8；ens35 192.168.2.254/24

目的

• 内部网络中的pc1采用SNAT访问外部互联网，但是无法ping到内部网关。

• 内部网络服务器s1通过DNAT发布服务到互联网。

• 互联网主机pc2能够访问DMZ区域的服务器，但是不能够进行ping和ssh连接。目的

步骤

1. 虚拟机中创建4台Rocky8的主机，分别对应：内网机、外网机、带路由功能的防火墙及服务器

2.配置网卡配置

2.1配置内网机网卡配置

[root@localhost network-scripts]# vim ifcfg-ens160
[root@localhost network-scripts]# cat ifcfg-ens160
TYPE=Ethernet
BOOTPROTO=static
NAME=ens33
DEVICE=ens160
ONBOOT=yes
IPADDR=192.168.1.1
PREFIX=24
GATEWAY=192.168.1.254
[root@localhost network-scripts]# systemctl restart network
[root@localhost network-scripts]# ifconfig -a
ens160: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.1.1  netmask 255.255.255.0  broadcast 192.168.1.255
        ether 00:0c:29:ff:37:36  txqueuelen 1000  (Ethernet)
        RX packets 89  bytes 22544 (22.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

2.2配置外网机网卡配置

[root@localhost network-scripts]# vim ifcfg-ens160
[root@localhost network-scripts]# cat ifcfg-ens160
TYPE=Ethernet
BOOTPROTO=dhcp
NAME=ens160
UUID=f80b8365-bd9d-41fd-93f5-d3e21887de09
DEVICE=ens160
ONBOOT=yes
IPADDR=10.0.0.1
PREFIX=8
GATEWAY=10.0.0.100
[root@localhost network-scripts]# systemctl restart network
[root@localhost network-scripts]# ifconfig -a
ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:4b:68:1d brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    inet 10.0.0.1/8 brd 10.255.255.255 scope global noprefixroute ens160
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe4b:681d/64 scope link 
       valid_lft forever preferred_lft forever

2.3防火墙网卡设置

root@localhost network-scripts]# ip a

2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:69:1f:de brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    inet 192.168.1.254/24 brd 192.168.1.255 scope global noprefixroute ens160
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe69:1fde/64 scope link 
       valid_lft forever preferred_lft forever
3: ens224: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:69:1f:e8 brd ff:ff:ff:ff:ff:ff
    altname enp19s0
    inet 192.168.2.254/24 brd 192.168.2.255 scope global noprefixroute ens224
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe69:1fe8/64 scope link 
       valid_lft forever preferred_lft forever
4: ens256: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 00:0c:29:69:1f:f2 brd ff:ff:ff:ff:ff:ff
    altname enp27s0
    inet 10.0.0.100/8 brd 10.255.255.255 scope global noprefixroute ens256
       valid_lft forever preferred_lft forever
    inet6 fe80::20c:29ff:fe69:1ff2/64 scope link 
       valid_lft forever preferred_lft forever

2.4服务器网卡设置

[root@localhost network-scripts]# cat ifcfg-ens160
TYPE=Ethernet
BOOTPROTO=dhcp
NAME=ens160
DEVICE=ens160
ONBOOT=yes
IPADDR=192.168.2.1
PEFIX=24
GATEWAY=192.168.2.254

3.局域网设置

4.防火墙设置

关闭防火墙及selinux

[root@localhost network-scripts]# systemctl disable --now firewalld
[root@localhost network-scripts]# setenforce 0

打开路由功能

[root@localhost network-scripts]# echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
[root@localhost network-scripts]# sysctl -p
net.ipv4.ip_forward = 1

网络连接测试

内网连接

[root@localhost network-scripts]# ping 192.168.1.1
PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.032 ms
64 bytes from 192.168.1.1: icmp_seq=2 ttl=64 time=3.45 ms
^C
--- 192.168.1.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1041ms
rtt min/avg/max/mdev = 0.032/1.739/3.446/1.707 ms
[root@localhost network-scripts]# ping 192.168.1.254
PING 192.168.1.254 (192.168.1.254) 56(84) bytes of data.
64 bytes from 192.168.1.254: icmp_seq=1 ttl=64 time=1.51 ms
64 bytes from 192.168.1.254: icmp_seq=2 ttl=64 time=0.751 ms
64 bytes from 192.168.1.254: icmp_seq=3 ttl=64 time=0.913 ms
^C
--- 192.168.1.254 ping statistics ---

外网连接

[root@localhost network-scripts]# ping 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
64 bytes from 10.0.0.1: icmp_seq=1 ttl=64 time=0.520 ms
64 bytes from 10.0.0.1: icmp_seq=2 ttl=64 time=0.087 ms
64 bytes from 10.0.0.1: icmp_seq=3 ttl=64 time=0.067 ms
64 bytes from 10.0.0.1: icmp_seq=4 ttl=64 time=0.065 ms
^C
--- 10.0.0.1 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3065ms
rtt min/avg/max/mdev = 0.065/0.184/0.520/0.194 ms

服务器连接测试

[root@localhost network-scripts]# ping 192.168.2.1
PING 192.168.2.1 (192.168.2.1) 56(84) bytes of data.
64 bytes from 192.168.2.1: icmp_seq=1 ttl=64 time=0.288 ms
64 bytes from 192.168.2.1: icmp_seq=2 ttl=64 time=0.090 ms
^C
--- 192.168.2.1 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1019ms
rtt min/avg/max/mdev = 0.090/0.189/0.288/0.099 ms
[root@localhost network-scripts]# ping 192.168.2.254
PING 192.168.2.254 (192.168.2.254) 56(84) bytes of data.
64 bytes from 192.168.2.254: icmp_seq=1 ttl=64 time=1.18 ms
64 bytes from 192.168.2.254: icmp_seq=2 ttl=64 time=0.903 ms
64 bytes from 192.168.2.254: icmp_seq=3 ttl=64 time=0.933 ms
^C
--- 192.168.2.254 ping statistics ---

iptables配置及测试

[root@localhost network-scripts]# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -j SNAT --to-source 10.0.0.100
[root@localhost network-scripts]# iptables -A INPUT -s 192.168.1.1 -p icmp --icmp-type echo-request -j DROP

[root@localhost ~]# iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o ens256 -j MASQUERADE