iptables

R1chArd_TvT

已于 2023-03-30 21:22:10 修改

阅读量358

点赞数 1

分类专栏：笔记文章标签：服务器运维网络

于 2023-03-30 19:25:01 首次发布

本文链接：https://blog.csdn.net/Richard_Sniper/article/details/129861875

版权

笔记专栏收录该内容

113 篇文章 0 订阅

订阅专栏

规则内的匹配顺序：

自上向下按顺序依次进行检查，找到相匹配的规则即停止。

备份和还原iptables规则设置

我们对iptables命令行中的设置，都是临时设置，只要遇到服务器关机，或者服务重启，所有的设置都会清空且回到默认初始状态。

iptables-save工具/iptablews-restore工具
可结合重定向输出/输入保存到指定文件

格式：iptables-save

iptables-save > 文件（绝对路径，保存规则）

iptables-restore <xxx.bak (导入规则)

配置文件在/etc/sysconfig/iptables

cat 备份文件 > /etc/sysconfig/iptables (文件特殊性不会复写)

[root@localhost ~]# iptables -F
[root@localhost ~]# iptables -A INPUT -p icmp -j ACCEPT
[root@localhost ~]# iptables -A INPUT -s 192.168.179.21 -p tcp -j ACCEPT
[root@localhost ~]# iptables -vnL --line-number
Chain INPUT (policy ACCEPT 54 packets, 3132 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
2        0     0 ACCEPT     tcp  --  *      *       192.168.179.21       0.0.0.0/0           

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num   pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 28 packets, 2176 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
[root@localhost ~]# iptables-save >/opt/iptables.bak

自定义链：

自定义链添加：iptables -N cunstom

自定义链改名:iptables -E cunstom 名字

iptables -t filter -I 名字 1 -p icmp -j REJECT 给链设规则

创建对应链能调到自定义链上：iptables -t filter -I INPUT -p icmp -j 名字

如何删：iptables -D INPUT 对应序号

iptables -D 名字 1

iptables -X 名字删对应链名

SNAT

未做转换：

转换后：

MASQUERADE-----地址伪装

适用于外网IP地址非固定的情况。

对于ADSL拨号连接，接口通常为ppp0、ppp1

将SNAT规则改为MASQUERADE即可

DNAT

DNAT策略的典型应用环境

在Internet中发布位于企业局域网内的服务器

实验：

test2:仅主机，加一个网卡

systemctl restart network

ifconfig

vim cd /etc/sysconfig/network-scripts/ifcfg-ens33

改对内网关IPADDR

cp -a ifcfg-ens33 ifcfg-ens36

vim ifcfg-ens36

DEVICE=ens36 对外IPADDR=12.0.0.254

cat 检查

打开转发功能：vim /etc/sysctl.conf

写入：net.ipv4.ip_forward=1

sysctl -p 立即生效

打印出：net.ipv4.ip_forward=1 即生效

systemctl restart network

#中间路由配置完成

test3:ifcfg-ens33

vim /etc/sysconfig/network-script/ifcfg-ens33

修改 IPADDR和GATEWAY

systemctl restart network

仅主机

tail -f /etc/httpd/logs/access.log

test1:vim-ifcfg-ens33

DNS可以删改网关

systemctl restart network

ping 网关监测

中间路由配置：

[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# setenforce 0
[root@localhost ~]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.179.21  netmask 255.255.255.0  broadcast 192.168.179.255
        inet6 fe80::20c:29ff:fe7c:cdc3  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:7c:cd:c3  txqueuelen 1000  (Ethernet)
        RX packets 8520  bytes 772474 (754.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 8099  bytes 978786 (955.8 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens35: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        ether 00:0c:29:7c:cd:cd  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 106  bytes 9224 (9.0 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 106  bytes 9224 (9.0 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

virbr0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500
        inet 192.168.122.1  netmask 255.255.255.0  broadcast 192.168.122.255
        ether 52:54:00:78:ab:ca  txqueuelen 1000  (Ethernet)
        RX packets 0  bytes 0 (0.0 B)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 0  bytes 0 (0.0 B)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

[root@localhost ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33 
[root@localhost ~]# cp -a ifcfg-ens33 ifcfg-ens36
cp: cannot stat ‘ifcfg-ens33’: No such file or directory
[root@localhost ~]# cd /etc/sysconfig/
[root@localhost sysconfig]# cd network-scripts/
[root@localhost network-scripts]# ls
ifcfg-ens33  ifdown-ib    ifdown-ppp       ifdown-tunnel  ifup-ib    ifup-plusb   ifup-Team         network-functions
ifcfg-lo     ifdown-ippp  ifdown-routes    ifup           ifup-ippp  ifup-post    ifup-TeamPort     network-functions-ipv6
ifdown       ifdown-ipv6  ifdown-sit       ifup-aliases   ifup-ipv6  ifup-ppp     ifup-tunnel
ifdown-bnep  ifdown-isdn  ifdown-Team      ifup-bnep      ifup-isdn  ifup-routes  ifup-wireless
ifdown-eth   ifdown-post  ifdown-TeamPort  ifup-eth       ifup-plip  ifup-sit     init.ipv6-global
[root@localhost network-scripts]# cp -a ifcfg-ens33 ifcfg-ens36
[root@localhost network-scripts]# vim ifcfg-ens36
[root@localhost network-scripts]# cat ifcfg-ens36
TYPE=Ethernet
DIVCE=ens36
ONBOOT=yes
BOOTPROTO=static
IPADDR=12.0.0.254
NETMASK=255.255.255.0
GATEWAY=192.168.179.2
#DNS1=8.8.8.8
#DNS2=8.8.4.4

[root@localhost network-scripts]# vim /etc/sysctl.conf
[root@localhost network-scripts]# sysctl -p
net.ipv4.ip_forward = 1

配置destination：

[root@localhost richard]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 12.0.0.100  netmask 255.255.255.0  broadcast 12.0.0.255
        inet6 fe80::20c:29ff:fef8:a572  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:f8:a5:72  txqueuelen 1000  (Ethernet)
        RX packets 13875  bytes 1201029 (1.1 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 10735  bytes 1334659 (1.2 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

配置source：

SNAT实验：

test2:iptables -t nat -A POSTROUTING -s 192.168.179.0/24 -o ens36 -j SNAT --to 10.0.0.10

iptables -vnL -t nat --line-number