2017-11-30 7周4次课 linux系统日常管理（四）

最新推荐文章于 2024-09-12 17:24:19 发布

wagskun

最新推荐文章于 2024-09-12 17:24:19 发布

阅读量212

点赞数

文章标签： centos

本文链接：https://blog.csdn.net/wagskun/article/details/78683942

版权

iptables

查看规则

[root@wagskun ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:53
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:53
    0     0 ACCEPT     udp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            udp dpt:67
    0     0 ACCEPT     tcp  --  virbr0 *       0.0.0.0/0            0.0.0.0/0            tcp dpt:67
 7979   14M ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

2. filter表案例

[root@wagskun ~]# cat /usr/local/sbin/iptables.sh
#!/bin/bash
 
ipt="/usr/sbin/iptables"
$ipt -F
$ipt -P INPUT DROP
$ipt -P OUTPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$ipt -A INPUT -s 192.168.179.0/24 -p tcp --dport 22 -j ACCEPT
$ipt -A INPUT -p tcp --dport 80 -j ACCEPT
$ipt -A INPUT -p tcp --dport 21 -j ACCPET

nat表应用

A机器两块网卡ens33(192.168.179.128)ens37(192.168.100.1),ens33可以上外网，ens37仅仅是内网，B机器只有ens37（192.168.100.100）

和A机器可以通信互联

需求1 可以让B机器连接外网

A机器上打开路由转发

[root@wagskun ~]# ifconfig ens37 192.168.100.1/24

[root@node73 ~]# ifdown ens33
[root@node73 ~]# ifconfig ens37 192.168.100.100/24

[root@wagskun ~]# echo "1" > /proc/sys/net/ipv4/ip_forward
[root@wagskun ~]# iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o ens33 -j MASQUERADE

[root@wagskun ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 1 packets, 78 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 4 packets, 304 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 4 packets, 304 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    2   271 RETURN     all  --  *      *       192.168.122.0/24     224.0.0.0/24        
    0     0 RETURN     all  --  *      *       192.168.122.0/24     255.255.255.255     
    0     0 MASQUERADE  tcp  --  *      *       192.168.122.0/24    !192.168.122.0/24     masq ports: 1024-65535
    0     0 MASQUERADE  udp  --  *      *       192.168.122.0/24    !192.168.122.0/24     masq ports: 1024-65535
    0     0 MASQUERADE  all  --  *      *       192.168.122.0/24    !192.168.122.0/24    
    0     0 MASQUERADE  all  --  *      ens33   192.168.100.0/24     0.0.0.0/0

B上设置网关为192.168.100.1

[root@node73 ~]# route add default gw 192.168.100.1

[root@node73 ~]# ping 192.168.179.128
PING 192.168.179.128 (192.168.179.128) 56(84) bytes of data.
64 bytes from 192.168.179.128: icmp_seq=1 ttl=64 time=0.778 ms
64 bytes from 192.168.179.128: icmp_seq=2 ttl=64 time=0.521 ms
64 bytes from 192.168.179.128: icmp_seq=3 ttl=64 time=0.399 ms
64 bytes from 192.168.179.128: icmp_seq=4 ttl=64 time=0.711 ms
64 bytes from 192.168.179.128: icmp_seq=5 ttl=64 time=0.519 ms
64 bytes from 192.168.179.128: icmp_seq=6 ttl=64 time=0.484 ms

需求2 C机器只能和A通信，让C机器可以直接连通B机器

先删除之前的规则

[root@wagskun ~]# iptables -t nat -D POSTROUTING -s 192.168.100.0/24 -o ens33 -j MASQUERADE

[root@wagskun ~]# iptables -t nat -A PREROUTING -d 192.168.179.128 -p tcp --dport 1122 -j DNAT --to 192.168.100.100:22
[root@wagskun ~]# iptables -t nat -A POSTROUTING -s 192.168.100.100 -j SNAT --to 192.168.179.128