iptables上如何封IP

一、封单个IP

1、封锁单个ip:  iptables -I INPUT -s IP -j DROP

[root@node1 ~]# iptables -I INPUT -s 192.168.1.11 -j DROP
[root@node1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  192.168.1.11         anywhere

2、解封单个ip：iptables -D INPUT -s IP -d IP -j ACCEPT

[root@node1 ~]# iptables -D INPUT -s 192.168.1.11 -j DROP  # 解封IP: 192.168.1.11
[root@node1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

二、封IP段

1、封IP段： 从123.0.0.1到123.255.255.254的命令

[root@node1 ~]# iptables -I INPUT -s 123.0.0.0/8 -j DROP
[root@node1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

DROP       all  --  123.0.0.0/8          anywhere

2、封IP段： 从123.45.0.1到123.45.255.254的命令

[root@node1 ~]# iptables -I INPUT -s 123.45.0.0/16 -j DROP
[root@node1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  123.45.0.0/16        anywhere
DROP       all  --  123.0.0.0/8          anywhere

3、封IP段：从123.45.6.1到123.45.6.254的命令是

[root@node1 ~]# iptables -I INPUT -s 123.45.6.0/24 -j DROP
[root@node1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       all  --  123.45.6.0/24        anywhere
DROP       all  --  123.45.0.0/16        anywhere
DROP       all  --  123.0.0.0/8          anywhere

三、全部清理

[root@node1 ~]# iptables -F

四、查询

[root@node1 ~]# iptables -L INPUT
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
[root@node1 ~]#