iptables实现网络防火墙

测试环境,建立3个虚拟机器:
A机器使用bridged模式:hostname是demo,ip地址是 192.168.0.106
B机器2个网卡:hostname是rhel64-64bit,bridged的网卡地址:192.168.0.101
                                                                  host-only的网卡地址:192.168.220.131
c机器使用host-only模式:hostname是yaya,ip地址是192.168.220.130

      

A机器,访问196.168.220网段时候网关是B机器的bridged网卡地址:
[root@demo instance]# route add -net 192.168.220.0/24 gw 192.168.0.101
[root@demo instance]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.0.0     0.0.0.0         255.255.255.0   U     0      0        0 eth0
192.168.220.0   192.168.0.101   255.255.255.0   UG    0      0        0 eth0
0.0.0.0         192.168.0.1     0.0.0.0         UG    0      0        0 eth0


B机器上开启转发功能:
[root@rhel64-64bit rules.d]# cat /etc/sysctl.conf|grep forward
# Controls IP packet forwarding
net.ipv4.ip_forward = 1


C机器上,默认网关改为B机器的host-only网卡地址:
[root@yaya init.d]# route add default gw 192.168.220.131
[root@yaya init.d]# route -n
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
192.168.220.0   0.0.0.0         255.255.255.0   U     1      0        0 eth1
0.0.0.0         192.168.220.131 0.0.0.0         UG    0      0        0 eth1

那么A与C便可以通信了:
[root@demo instance]# ping 192.168.220.130
PING 192.168.220.130 (192.168.220.130) 56(84) bytes of data.
64 bytes from 192.168.220.130: icmp_seq=1 ttl=63 time=2.42 ms
64 bytes from 192.168.220.130: icmp_seq=2 ttl=63 time=0.634 ms

[root@yaya init.d]# ping 192.168.0.106
PING 192.168.0.106 (192.168.0.106) 56(84) bytes of data.
64 bytes from 192.168.0.106: icmp_seq=1 ttl=63 time=0.585 ms
64 bytes from 192.168.0.106: icmp_seq=2 ttl=63 time=0.648 ms

1.修改B的filter的forward链规则以测试B作为A与C两个网段之间的防火墙作用:  

 iptables  -A FORWARD -j REJECT

此时A与C不能再次通信:
[root@demo instance]# ping 192.168.220.130
PING 192.168.220.130 (192.168.220.130) 56(84) bytes of data.
From 192.168.0.101 icmp_seq=1 Destination Port Unreachable
From 192.168.0.101 icmp_seq=2 Destination Port Unreachable

[root@yaya init.d]# ping 192.168.0.106
PING 192.168.0.106 (192.168.0.106) 56(84) bytes of data.
From 192.168.220.131 icmp_seq=1 Destination Port Unreachable
From 192.168.220.131 icmp_seq=2 Destination Port Unreachable

2.B机器再加入如下规则:iptables -I FORWARD -s 192.168.0.0/24 -p icmp -j ACCEPT

                                       iptables -I FORWARD -m state --state ESTABLISHED -j ACCPT

B机器forward的规则如下:
[root@rhel64-64bit rules.d]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state ESTABLISHED 
    0     0 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           
    4   336 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachabl


此时A可以与C通信,
[root@demo instance]# ping 192.168.220.130
PING 192.168.220.130 (192.168.220.130) 56(84) bytes of data.
64 bytes from 192.168.220.130: icmp_seq=1 ttl=63 time=0.843 ms
64 bytes from 192.168.220.130: icmp_seq=2 ttl=63 time=0.655 ms

C却不能ping通A:
[root@yaya init.d]# ping 192.168.0.106
PING 192.168.0.106 (192.168.0.106) 56(84) bytes of data.
From 192.168.220.131 icmp_seq=1 Destination Port Unreachable
From 192.168.220.131 icmp_seq=2 Destination Port Unreachable

3.B中再次加入:

iptables -I FORWARD 3 -s 192.168.220.0/24 -p icmp -j ACCEPT

B机器规则如下:
[root@rhel64-64bit rules.d]# iptables -nvL
Chain INPUT (policy ACCEPT 2 packets, 458 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   13  1092 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           state ESTABLISHED 
    2   168 ACCEPT     icmp --  *      *       192.168.0.0/24       0.0.0.0/0           
    1    84 ACCEPT     icmp --  *      *       192.168.220.0/24     0.0.0.0/0           
    6   504 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable 

此时A与C可互相通信。

 

 

评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值