(1) 屏蔽某台电脑
场景:路由器或者防火墙屏蔽某个 IP 。
理解:任何以本机为目的地址的数据包都经过 filter 表的 INPUT 链 (-t filter 省略了 )
iptables -A INPUT -s 200.200.200.1 -j DROP |
(2) 屏蔽某台电脑的 telnet 请求
场景:路由器或者防火墙屏蔽某个 IP 的 telnet 数据包,但允许其他数据包通过
理解: -p 指协议,一共有三种, TCP,UDP 和 ICMP , telnet 是基于 TCP 的 ;
--destination-port telnet 服务的端口是 23 (客户端端口是任意的) , 在屏蔽某个服务,需要使用目标端口,目标端口可以使用字符,而不是数字。
iptables -A INPUT -s 200.200.200.1 -p tcp --destination-port telnet -j DROP |
( 3 )区分屏蔽某台电脑的 telnet 请求
场景:允许局域网的 telnet 请求,但不允许 internet 网的请求
理解: -I the input interface –o the output interface
iptables -A INPUT -p tcp --destination-port telnet -i ppp0 -j DROP |
( 4 )不接受任何外部数据,但允许自己发起连接
场景:打算关闭所有端口,不接受任何数据,但自己发起的连接要能正常工作
理解: --syn 主动发起连接的一方会首先发送 —syn 包,因此对外部来的 —syn 包全部 DROP ,而不是说关闭所有端口
iptables -A INPUT -i ppp0 -p tcp --syn -j DROP |
( 5 )不接受任何外部连接(除了 80 端口的 http 连接),但允许自己发起连接
场景:打算关闭所有端口(除了 80 端口),不接受任何数据,但自己发起的连接要能正常工作
理解: --syn 主动发起连接的一方会首先发送 —syn 包,因此对外部来的 —syn 包全部 DROP ,而不是说关闭所有端口
iptables -A INPUT -i ppp0 -p tcp --syn --destination-port ! 80 -j DROP |
( 6 )改变数据包的目标地址
场景: HTTP 服务器在内网,外网来的 HTTP 请求,路由器需要将目标 IP 改为 HTT 服务器的内网地址
理解: –j DNAT 进行目标地址转换的动作
Iptables –t nat –A PREROUTING –d 59.12.33.124 –j DNAT –to-destination 192.168.0.191 |
(7) 改变数据包的源地址
场景:内网访问外网的 HTTP 服务器,路由器需要改变这些数据包的源地址
理解: -j SNAT 进行源地址转换的动作
Iptables –t nat –A POSTROUTING –s 192.168.12.0/24 –j SNAT –to-source 59.12.33.124 |
(8) 绑定 mac 和 IP
场景:路由器限定只有哪些 mac 的 pc 能够上网
理解:默认 -t FILTER
-P FORWARD DROP 改变 FORWARD 链的默认规则, FORWARD 链中的所有规则全部 DROP
-m mac –mac-source 匹配 mac
Iptables –P FORWARD DROP Iptables –A FORWARD –s 192.168.1.122 –m mac –mac-source 11:22:33:44:a1:b3 –j ACCEPT |
( 9 )限定网速
场景:路由器限定网速
理解: –m limit –limit 15/s 速度匹配
Iptables –A FORWARD –s 192.168.0.122 –m limit –limit 15/s –j ACCEPT |
(10)使用初始化
场景:任何使用iptables
理解:FORWARD功能默认是关闭的,需要显示开启;
-F清空链,如果指定表,则清空指定表中的链;如果什么都没有指定,则清空所有默认表的链;
-X删除非内建链(用户自定义链)
echo 1 > /proc/sys/net/ipv4/ip_forward iptables -F iptables -F INPUT iptables -t filter -F iptables -X iptables -X Allowed iptables -t filter -X |
(11)禁用多个服务
场景:路由器禁用多个服务,只开启forward功能
理解:路由器上的这些服务不能用,是目标端口;只开启转发功能。
<!-- [if gte mso 9]><xml> <w:WordDocument> <w:View>Normal</w:View> <w:Zoom>0</w:Zoom> <w:PunctuationKerning/> <w:DrawingGridVerticalSpacing>7.8 磅</w:DrawingGridVerticalSpacing> <w:DisplayHorizontalDrawingGridEvery>0</w:DisplayHorizontalDrawingGridEvery> <w:DisplayVerticalDrawingGridEvery>2</w:DisplayVerticalDrawingGridEvery> <w:ValidateAgainstSchemas/> <w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid> <w:IgnoreMixedContent>false</w:IgnoreMixedContent> <w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText> <w:Compatibility> <w:SpaceForUL/> <w:BalanceSingleByteDoubleByteWidth/> <w:DoNotLeaveBackslashAlone/> <w:ULTrailSpace/> <w:DoNotExpandShiftReturn/> <w:AdjustLineHeightInTable/> <w:BreakWrappedTables/> <w:SnapToGridInCell/> <w:WrapTextWithPunct/> <w:UseAsianBreakRules/> <w:DontGrowAutofit/> <w:UseFELayout/> </w:Compatibility> <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> </w:WordDocument> </xml><![endif]--><!-- [if gte mso 9]><xml> <w:LatentStyles DefLockedState="false" LatentStyleCount="156"> </w:LatentStyles> </xml><![endif]--><!-- [if gte mso 10]> <mce:style><!-- /* Style Definitions */ table.MsoNormalTable {mso-style-name:普通表格; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman"; mso-fareast-font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} table.MsoTableGrid {mso-style-name:网格型; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; border:solid windowtext 1.0pt; mso-border-alt:solid windowtext .5pt; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-border-insideh:.5pt solid windowtext; mso-border-insidev:.5pt solid windowtext; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; text-align:justify; text-justify:inter-ideograph; mso-pagination:none; font-size:10.0pt; font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} --> <!-- [endif]-->
iptables -A INPUT -p tcp --dport 80 -j DROP //HTTP |
(12) 创建新链
场景:用户自定义链
理解:目标-j可以为自定义链,且可以jump到多个自定义链中
<!-- [if gte mso 9]><xml> <w:WordDocument> <w:View>Normal</w:View> <w:Zoom>0</w:Zoom> <w:PunctuationKerning/> <w:DrawingGridVerticalSpacing>7.8 磅</w:DrawingGridVerticalSpacing> <w:DisplayHorizontalDrawingGridEvery>0</w:DisplayHorizontalDrawingGridEvery> <w:DisplayVerticalDrawingGridEvery>2</w:DisplayVerticalDrawingGridEvery> <w:ValidateAgainstSchemas/> <w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid> <w:IgnoreMixedContent>false</w:IgnoreMixedContent> <w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText> <w:Compatibility> <w:SpaceForUL/> <w:BalanceSingleByteDoubleByteWidth/> <w:DoNotLeaveBackslashAlone/> <w:ULTrailSpace/> <w:DoNotExpandShiftReturn/> <w:AdjustLineHeightInTable/> <w:BreakWrappedTables/> <w:SnapToGridInCell/> <w:WrapTextWithPunct/> <w:UseAsianBreakRules/> <w:DontGrowAutofit/> <w:UseFELayout/> </w:Compatibility> <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> </w:WordDocument> </xml><![endif]--><!-- [if gte mso 9]><xml> <w:LatentStyles DefLockedState="false" LatentStyleCount="156"> </w:LatentStyles> </xml><![endif]--><!-- [if gte mso 10]> <mce:style><!-- /* Style Definitions */ table.MsoNormalTable {mso-style-name:普通表格; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman"; mso-fareast-font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} table.MsoTableGrid {mso-style-name:网格型; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; border:solid windowtext 1.0pt; mso-border-alt:solid windowtext .5pt; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-border-insideh:.5pt solid windowtext; mso-border-insidev:.5pt solid windowtext; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; text-align:justify; text-justify:inter-ideograph; mso-pagination:none; font-size:10.0pt; font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} --> <!-- [endif]-->
iptables -t filter -N firewall_input_in iptables -t filter -A INPUT -j firewall_input_in |
(13)DSCP: Different Service Code Point
场景:路由器设置不同数据包的优先级
理解:SSH, TELNET需要及时响应,而SMTP则可以不用那么及时
<!-- [if gte mso 9]><xml> <w:WordDocument> <w:View>Normal</w:View> <w:Zoom>0</w:Zoom> <w:PunctuationKerning/> <w:DrawingGridVerticalSpacing>7.8 磅</w:DrawingGridVerticalSpacing> <w:DisplayHorizontalDrawingGridEvery>0</w:DisplayHorizontalDrawingGridEvery> <w:DisplayVerticalDrawingGridEvery>2</w:DisplayVerticalDrawingGridEvery> <w:ValidateAgainstSchemas/> <w:SaveIfXMLInvalid>false</w:SaveIfXMLInvalid> <w:IgnoreMixedContent>false</w:IgnoreMixedContent> <w:AlwaysShowPlaceholderText>false</w:AlwaysShowPlaceholderText> <w:Compatibility> <w:SpaceForUL/> <w:BalanceSingleByteDoubleByteWidth/> <w:DoNotLeaveBackslashAlone/> <w:ULTrailSpace/> <w:DoNotExpandShiftReturn/> <w:AdjustLineHeightInTable/> <w:BreakWrappedTables/> <w:SnapToGridInCell/> <w:WrapTextWithPunct/> <w:UseAsianBreakRules/> <w:DontGrowAutofit/> <w:UseFELayout/> </w:Compatibility> <w:BrowserLevel>MicrosoftInternetExplorer4</w:BrowserLevel> </w:WordDocument> </xml><![endif]--><!-- [if gte mso 9]><xml> <w:LatentStyles DefLockedState="false" LatentStyleCount="156"> </w:LatentStyles> </xml><![endif]--><!-- [if gte mso 10]> <style> /* Style Definitions */ table.MsoNormalTable {mso-style-name:普通表格; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; mso-style-noshow:yes; mso-style-parent:""; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; mso-pagination:widow-orphan; font-size:10.0pt; font-family:"Times New Roman"; mso-fareast-font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} table.MsoTableGrid {mso-style-name:网格型; mso-tstyle-rowband-size:0; mso-tstyle-colband-size:0; border:solid windowtext 1.0pt; mso-border-alt:solid windowtext .5pt; mso-padding-alt:0cm 5.4pt 0cm 5.4pt; mso-border-insideh:.5pt solid windowtext; mso-border-insidev:.5pt solid windowtext; mso-para-margin:0cm; mso-para-margin-bottom:.0001pt; text-align:justify; text-justify:inter-ideograph; mso-pagination:none; font-size:10.0pt; font-family:"Times New Roman"; mso-ansi-language:#0400; mso-fareast-language:#0400; mso-bidi-language:#0400;} </style> <![endif]-->
iptables -t mangle -A FORWARD -p tcp --dport 80 -j DSCP --set-dscp 1 |
数据包状态
数据包中的 mark
完整的 firewall 脚本例子