规则内的匹配顺序:
自上向下按顺序依次进行检查,找到相匹配的规则即停止。
备份和还原iptables规则设置
我们对iptables命令行中的设置,都是临时设置,只要遇到服务器关机,或者服务重启,所有的设置都会清空且回到默认初始状态。
- iptables-save工具/iptablews-restore工具
- 可结合重定向输出/输入保存到指定文件
格式:iptables-save
iptables-save > 文件(绝对路径,保存规则)
iptables-restore <xxx.bak (导入规则)
配置文件在/etc/sysconfig/iptables
cat 备份文件 > /etc/sysconfig/iptables (文件特殊性不会复写)
[root@localhost ~]# iptables -F
[root@localhost ~]# iptables -A INPUT -p icmp -j ACCEPT
[root@localhost ~]# iptables -A INPUT -s 192.168.179.21 -p tcp -j ACCEPT
[root@localhost ~]# iptables -vnL --line-number
Chain INPUT (policy ACCEPT 54 packets, 3132 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT tcp -- * * 192.168.179.21 0.0.0.0/0
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 28 packets, 2176 bytes)
num pkts bytes target prot opt in out source destination
[root@localhost ~]# iptables-save >/opt/iptables.bak
自定义链:
自定义链添加:iptables -N cunstom
自定义链改名:iptables -E cunstom 名字
iptables -t filter -I 名字 1 -p icmp -j REJECT 给链设规则
创建对应链能调到自定义链上:iptables -t filter -I INPUT -p icmp -j 名字
如何删:iptables -D INPUT 对应序号
iptables -D 名字 1
iptables -X 名字 删对应链名
SNAT
未做转换:
转换后:
MASQUERADE-----地址伪装
适用于外网IP地址非固定的情况。
对于ADSL拨号连接,接口通常为ppp0、ppp1
将SNAT规则改为MASQUERADE即可
DNAT
DNAT策略的典型应用环境
在Internet中发布位于企业局域网内的服务器
实验:
test2:仅主机,加一个网卡
systemctl restart network
ifconfig
vim cd /etc/sysconfig/network-scripts/ifcfg-ens33
改对内网关IPADDR
cp -a ifcfg-ens33 ifcfg-ens36
vim ifcfg-ens36
DEVICE=ens36 对外IPADDR=12.0.0.254
cat 检查
打开转发功能:vim /etc/sysctl.conf
写入:net.ipv4.ip_forward=1
sysctl -p 立即生效
打印出:net.ipv4.ip_forward=1 即生效
systemctl restart network
#中间路由配置完成
test3:ifcfg-ens33
vim /etc/sysconfig/network-script/ifcfg-ens33
修改 IPADDR和GATEWAY
systemctl restart network
仅主机
tail -f /etc/httpd/logs/access.log
test1:vim-ifcfg-ens33
DNS可以删 改网关
systemctl restart network
ping 网关监测
中间路由配置:
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0
[root@localhost ~]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.179.21 netmask 255.255.255.0 broadcast 192.168.179.255
inet6 fe80::20c:29ff:fe7c:cdc3 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:7c:cd:c3 txqueuelen 1000 (Ethernet)
RX packets 8520 bytes 772474 (754.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 8099 bytes 978786 (955.8 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens35: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
ether 00:0c:29:7c:cd:cd txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1 (Local Loopback)
RX packets 106 bytes 9224 (9.0 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 106 bytes 9224 (9.0 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
virbr0: flags=4099<UP,BROADCAST,MULTICAST> mtu 1500
inet 192.168.122.1 netmask 255.255.255.0 broadcast 192.168.122.255
ether 52:54:00:78:ab:ca txqueuelen 1000 (Ethernet)
RX packets 0 bytes 0 (0.0 B)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 0 bytes 0 (0.0 B)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
[root@localhost ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
[root@localhost ~]# cp -a ifcfg-ens33 ifcfg-ens36
cp: cannot stat ‘ifcfg-ens33’: No such file or directory
[root@localhost ~]# cd /etc/sysconfig/
[root@localhost sysconfig]# cd network-scripts/
[root@localhost network-scripts]# ls
ifcfg-ens33 ifdown-ib ifdown-ppp ifdown-tunnel ifup-ib ifup-plusb ifup-Team network-functions
ifcfg-lo ifdown-ippp ifdown-routes ifup ifup-ippp ifup-post ifup-TeamPort network-functions-ipv6
ifdown ifdown-ipv6 ifdown-sit ifup-aliases ifup-ipv6 ifup-ppp ifup-tunnel
ifdown-bnep ifdown-isdn ifdown-Team ifup-bnep ifup-isdn ifup-routes ifup-wireless
ifdown-eth ifdown-post ifdown-TeamPort ifup-eth ifup-plip ifup-sit init.ipv6-global
[root@localhost network-scripts]# cp -a ifcfg-ens33 ifcfg-ens36
[root@localhost network-scripts]# vim ifcfg-ens36
[root@localhost network-scripts]# cat ifcfg-ens36
TYPE=Ethernet
DIVCE=ens36
ONBOOT=yes
BOOTPROTO=static
IPADDR=12.0.0.254
NETMASK=255.255.255.0
GATEWAY=192.168.179.2
#DNS1=8.8.8.8
#DNS2=8.8.4.4
[root@localhost network-scripts]# vim /etc/sysctl.conf
[root@localhost network-scripts]# sysctl -p
net.ipv4.ip_forward = 1
配置destination:
[root@localhost richard]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 12.0.0.100 netmask 255.255.255.0 broadcast 12.0.0.255
inet6 fe80::20c:29ff:fef8:a572 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:f8:a5:72 txqueuelen 1000 (Ethernet)
RX packets 13875 bytes 1201029 (1.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 10735 bytes 1334659 (1.2 MiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
配置source:
SNAT实验:
test2:iptables -t nat -A POSTROUTING -s 192.168.179.0/24 -o ens36 -j SNAT --to 10.0.0.10
iptables -vnL -t nat --line-number
DNAT实验:
iptables -t nat -A PREROUTING -d 11.0.0.11 -i ens36 -p tcp --dport 80 -j NDAT --to 192.168.179.20
iptables -t nat -A POSTROUTING -s 192.168.179.0/24 -o ens36 -j SNAT --to 10.0.0.10
tcpdump抓包工具
wireshark只在windows中使用
tcpdump可以在linux中使用,自带
次数处理
tcpdump tcp -i ens33 -t -s0 -c 100 and dst port 80 and src net 192.168.179.0/24 -w ./target.cap
动态抓包处理:
tcpdump -i ens33 -s0 -w ./ens33.cap
-i ens33:只抓经过接口ens33的包(进出)
-t:不显示时间戳
-s0:抓取数据包时默认抓取长度68字节 ,加上“-s0”后可以抓到完整的数据包
-c 100:只抓取100个数据包
dst port ! 22 :不抓取目标端口是22的数据包
src net 192.168.179.0/24:数据包的源网络地址为192.168.179.0/24. Net:网段,host:主机
-w ./target.cap:保存成cap文件,方便用ethereal(即wireshark)分析。
ip、icmp、arp、rarp和tcp、udp、icmp这些选项都要放到第一个参数位置,用来过滤数据包类型
sz下载