RHCSA【六】

iptables

A: 搭建web服务，设置任何人能够通过80端口访问。
B: 禁止所有人ssh远程登录该服务器
C: 禁止某个主机地址ssh远程登录该服务器，允许该主机访问服务器的web服务。服务器地址为192.168.30.133

#在redhat 8的版本上，默认使用的是firewalld，两个软件不能同时生效
[root@localhost ~]# yum install iptables-services.x86_64 -y
[root@localhost ~]# systemctl stop firewalld
[root@localhost ~]# systemctl start iptables

A:

[root@localhost ~]# systemctl restart httpd
[root@localhost ~]# iptables -I INPUT -p tcp --dport 80 -j ACCEPT
[root@localhost ~]# iptables -vnL --line-numbers

[root@localhost ~]# iptables -D INPUT 1

B:

[root@localhost Desktop]# iptables -I INPUT -p tcp --dport 22 -j REJECT
[root@localhost Desktop]# iptables -nvL --line-numbers

[root@localhost Desktop]# iptables -D INPUT 1

C:

#禁止192.168.30.137远程连接 允许192.168.30.137访问192.168.30.133的web服务器
[root@localhost ~]# iptables -I INPUT -p tcp -s 192.168.30.137 --dport 22 -j REJECT
[root@localhost ~]# iptables -I INPUT -p tcp -s 192.168.30.137 --dport 80 -j ACCEPT

firewalld

A:禁止某个ip地址进行ssh访问
B:配置端口转发（在192.168.30.0网段的主机访问该服务器的5423端口将被转发到80端口）
此规则将本机80端口转发到192.168.1.1的8080端口上
A:

#添加富规则
[root@localhost ~]# firewall-cmd --permanent --add-rich-rule ‘rule family=“ipv4” source address=“192.168.30.137” service name=“ssh” reject’
success
[root@localhost ~]# firewall-cmd --reload
success
#删除富规则
[root@localhost ~]# firewall-cmd --permanent --remove-rich-rule=‘rule family=“ipv4” source address=“192.168.30.137” service name=“ssh” reject’
success
[root@localhost ~]# firewall-cmd --reload
success

B:

#首先我们先将http协议添加到我们的防火墙规则中，这样我们就可以使用http协议访问了
[root@localhost ~]# firewall-cmd --add-service=http --permanent
success
[root@localhost ~]# firewall-cmd --reload
success
[root@localhost ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens160
sources:
services: cockpit dhcpv6-client http ssh
ports:
protocols:
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:

[root@localhost ~]# firewall-cmd --add-rich-rule=‘rule family=“ipv4” source address=“192.168.30.0/24” forward-port port=“5423” protocol=“tcp” to-port=“80”’
success

[root@localhost ~]# firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=192.168.1.1
success