Linux note0x02

最新推荐文章于 2024-10-16 22:25:37 发布

ReZerou

最新推荐文章于 2024-10-16 22:25:37 发布

阅读量259

点赞数

分类专栏： linux 文章标签： linux iptables firewalld

本文链接：https://blog.csdn.net/github_35957188/article/details/78888189

版权

6 篇文章 0 订阅

订阅专栏

PreRouting, Input, Output, Forward, PostRouting

iptables -L View existing iptables rule
iptables -F Empty the rules
iptables -P INPUT DROP Default set DROP
iptables -I INPUT -p icmp -j ACCEPT allow ping(icmp)
iptables -I INPUT -s 192.168.10.0/24 -p tcp --dport 22 -j ACCEPT Only allow appoint network segment access 22.
iptables -A INPUT -p tcp --dport 22 -j REJECT Forbidden others host flow
service iptables save Make it effect permanently

区域	默认规则策略
trusted	允许所有的数据包
home	拒绝流入的流量，除非与流出的流量相关；而如果流量与ssh、mdns、ipp-client、
internal	等同于home区域
work	拒绝流入的流量，除非与流出的流量数相关；而如果流量与ssh、ipp-client与dhcpv6-client
public	拒绝流入的流量，除非与流出的流量相关；而如果流量与ssh、dhcpv6-client服务相关，则允许
external	拒绝流入的流量，除非与流出的流量相关；而如果流量与ssh服务相关，则允许流量
dmz	拒绝流入的流量，除非与流出的流量相关；而如果流量与ssh服务相关，则允许流量
block	拒绝流入的流量，除非与流出的流量相关
drop	拒绝流入的流量，除非与流出的流量相关

firewall-cmd --get-default-zone View current using area
firewall-cmd --get-zone-of-interface=eno16728 View eno netCard wroking area
firewall-cmd --permanent --zone=external --change-interface=eno16278 Set area as external and take effect after restarting system.
firewall-cmd --panic-on Meet an emergency, stop all connections.
firewall-cmd --znoe=public --query-service=https View whether could pass https flow, u can also use –add-service=https(protocol name) to add pass power and –remove-service=https(protocol name) to reject it.
firewall-cmd --reload Take permanent effect immediately.
firewall-cmd --zone-=public --add-forward-port=port=888:proto=tcp:toport=22:toaddr=192.168.10.10 Forward access 888 port flow to 22 port.

# Rules
Match /etc/hosts.allow?pass
    :Match /etc/hosts.deny?forbidden
        :pass

Two Principles
- Reject strategy: service name instead protocol
- Reject strategy editting should be first.
hosts.deny sshd:*
hosts.allow sshd:192.168.10.