10.11 Linux网络相关
10.12 firewalld和netfilter
10.13 netfilter5表5链介绍
10.14 iptables语法
扩展(selinux了解即可)
- selinux教程 http://os.51cto.com/art/201209/355490.htm
- selinux pdf电子书 http://pan.baidu.com/s/1jGGdExK
10.11 Linux网络相关
查看网卡信息
[root@axiang ~]# yum provides "/*/ifconfig"
[root@axiang-02 ~]# yum install -y net-tools ^C
[root@axiang-02 ~]# ifconfig -a
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.83.138 netmask 255.255.255.0 broadcast 192.168.83.255
inet6 fe80::20c:29ff:fe18:95e9 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:18:95:e9 txqueuelen 1000 (Ethernet)
RX packets 19800 bytes 23610097 (22.5 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 9223 bytes 889247 (868.4 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1 (Local Loopback)
RX packets 92 bytes 295860 (288.9 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 92 bytes 295860 (288.9 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
- ifconfig -a查看未启动网卡信息
如何启动/关闭网卡
- 注意别把正在远程的网卡down了!
ifdown ens33 && ifup ens33 //慎用风险
**创建虚拟网卡 **
- 复制网卡文件
- 修改IP、名称(ens33:0)
- 删除DNS、网关
- 重启物理网卡
[root@axiang-03 ~]# cd /etc/sysconfig/network-scripts/
[root@axiang-03 network-scripts]# cp ifcfg-ens33 ifcfg-ens33:0
[root@axiang-03 network-scripts]# vim ifcfg-ens33:0
[root@axiang-03 network-scripts]# ifdown ens33 && ifup ens33
成功断开设备 'ens33'。
成功激活的连接(D-Bus 激活路径:/org/freedesktop/NetworkManager/ActiveConnection/3)
[root@axiang-03 network-scripts]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.83.139 netmask 255.255.255.0 broadcast 192.168.83.255
inet6 fe80::20c:29ff:fec0:f76c prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:c0:f7:6c txqueuelen 1000 (Ethernet)
RX packets 7554 bytes 711123 (694.4 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 5411 bytes 681362 (665.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
ens33:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.83.149 netmask 255.255.255.0 broadcast 192.168.83.255
ether 00:0c:29:c0:f7:6c txqueuelen 1000 (Ethernet)
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1 (Local Loopback)
RX packets 92 bytes 7564 (7.3 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 92 bytes 7564 (7.3 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
windows ping一下
-
LVS keepalived会用到虚拟网卡
-
查看网卡连接状态
- mii-tool ens33
- ethtool ens33
[root@axiang ~]# mii-tool ens33
ens33: negotiated 1000baseT-FD flow-control, link ok
[root@axiang ~]# ethtool ens33
Settings for ens33:
Supported ports: [ TP ]
Supported link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Supported pause frame use: No
Supports auto-negotiation: Yes
Advertised link modes: 10baseT/Half 10baseT/Full
100baseT/Half 100baseT/Full
1000baseT/Full
Advertised pause frame use: No
Advertised auto-negotiation: Yes
Speed: 1000Mb/s
Duplex: Full
Port: Twisted Pair
PHYAD: 0
Transceiver: internal
Auto-negotiation: on
MDI-X: off (auto)
Supports Wake-on: d
Wake-on: d
Current message level: 0x00000007 (7)
drv probe link
Link detected: yes //看这里
- 修改主机名
- hostnamectl set-hostname xxx
[root@axiang ~]# hostnamectl set-hostname axiang-007
[root@axiang ~]# hostname
axiang.localdomain
[root@axiang ~]# bash
[root@axiang ~]# exit
exit
[root@axiang ~]# cat /etc/hostname
axiang-007
[root@axiang ~]# hostname
axiang.localdomain
- DNS
- DNS配置文件/etc/resolv.conf
[root@axiang ~]# cat /etc/resolv.conf
# Generated by NetworkManager
nameserver 119.29.29.29
-
更改网卡配置即可更改DNS配置文件,更改后需要重启网卡(ifdown/ifup)后生效,也可编辑‘/etc/resolv.conf’临时更改DNS配置,该办法在重启网卡后会被网卡配置文件中的DNS覆盖!
-
访问自定义域名
- /etc/hosts
[root@axiang-03 ~]# ping www.qq123.com
PING www.qq123.com (202.91.250.93) 56(84) bytes of data.
64 bytes from 202.91.250.93 (202.91.250.93): icmp_seq=1 ttl=128 time=60.9 ms
64 bytes from 202.91.250.93 (202.91.250.93): icmp_seq=2 ttl=128 time=66.1 ms
64 bytes from 202.91.250.93 (202.91.250.93): icmp_seq=3 ttl=128 time=61.3 ms
^C
--- www.qq123.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 60.960/62.821/66.127/2.361 ms
[root@axiang-03 ~]# vim /etc/hosts
[root@axiang-03 ~]# ping www.qq123.com
PING www.qq123.com (192.168.83.149) 56(84) bytes of data.
64 bytes from www.qq123.com (192.168.83.149): icmp_seq=1 ttl=64 time=0.061 ms
64 bytes from www.qq123.com (192.168.83.149): icmp_seq=2 ttl=64 time=0.108 ms
^C
--- www.qq123.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.061/0.084/0.108/0.025 ms
- 只在本机生效
10.12 firewalld和netfilter
- selinux
- 临时关闭 setenforce 0
- 永久关闭 vi /etc/selinux/config
- 状态查看 getenforce
[root@axiang ~]# vim /etc/selinux/config 永久关闭需要重启
[root@axiang ~]# setenforce 0 临时停止
[root@axiang ~]# getenforce 查看
Permissive 策略变为记录
[root@axiang ~]# reboot
...
Last login: Sat Jul 15 11:36:05 2017 from 192.168.83.1
[root@axiang ~]# getenforce
Disabled 重启后变为关闭
[root@axiang ~]#
- 注意不要改SELINUXTYPE=targeted!否则启动不了
- 很多服务受限与Selinux,一般会关闭
NetFilter
-
Centos7中默认将原来(centos5/6)的防火墙netfilter升级为了firewalld。都使用iptables工具管理, 现在大量公司仍然使用netfilter。
-
关闭firewalld、开启netfilter
[root@axiang-03 ~]# systemctl stop firewalld
[root@axiang-03 ~]# systemctl disable firewalld
[root@axiang-03 ~]# yum install -y iptables-services
[root@axiang-03 ~]# systemctl enable iptables
[root@axiang-03 ~]# systemctl start iptables
[root@axiang-03 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
37 2588 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0
0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT 25 packets, 2484 bytes)
pkts bytes target prot opt in out source destination
[root@axiang-03 ~]# iptables -F //关闭默认规则方便测试
[root@axiang-03 ~]# service iptables save //保存规则,重启依然有效
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ 确定 ]
- 可以看到保存规则的提示:/etc/sysconfig/iptables也可以查看规则
- iptables是工具。防火墙叫netfilter
- 虽然默认有iptables命令(工具),但并没有安装iptables服务,需要安装
10.13 netfilter 5表及链的介绍
netfilter的5表5链
- filter表,最常用,作用是滤包,有三个链:
- INPUT 进入本机的包
- FORWARD 无关本机的包
- OUTPUT 本机送出的包
[root@axiang-03 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 378 packets, 32227 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 389 packets, 34744 bytes)
pkts bytes target prot opt in out source destination
- nat表,用于网络地址转换
[root@axiang-03 ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
-
managle表用于给数据包做标记
-
raw表可以实现不追踪某些数据包
-
security表在centos6中并没有,用于强制访问控制(MAC)的网络规则
-
数据包流向与netfilter的5个链
- PREROUTING:数据包进入路由表之前
- INPUT:通过路由表后目的地为本机
- FORWARD:通过路由表后,目的地不为本机
- OUTPUT:由本机产生,向外发出
- POSTROUTING:发送到网卡接口之前
10.14 iptables语法
- 查看filter/NAT规则
[root@axiang-03 ~]# iptables -nvL ^C
[root@axiang-03 ~]# iptables -t nat -nvL
- 清空规则,清空计数器,存规则,重启服务,存放位置
[root@axiang-03 ~]# iptables -F
[root@axiang-03 ~]# iptables -Z
[root@axiang-03 ~]# service iptables save
[root@axiang-03 ~]# service iptables restart
[root@axiang-03 ~]# /etc/sysconfig/iptables
-
iptables -Z 常用于监控脚本判断
-
TCP抛包举例,源IP指定网卡接收举例
[root@axiang-03 ~]# iptables -p tcp -A INPUT -s 192.168.83.1 --sport 1234 -d 192.168.83.139 --dport 80 -j DROP
[root@axiang-03 ~]# iptables -I INPUT -s 192.168.83.0/24 -i eth0 -j ACCEPT
-
-I:前排插入规则
-
-A:是在后面加入规则
-
-D:是删除规则
-
根据编号删除规则
[root@axiang-03 ~]# iptables -nvL --line-numbers
Chain INPUT (policy ACCEPT 8 packets, 628 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- eth0 * 192.168.83.0/24 0.0.0.0/0
2 0 0 DROP tcp -- * * 192.168.83.1 192.168.83.139 tcp spt:1234 dpt:80
[root@axiang-03 ~]# iptables -D INPUT 1
[root@axiang-03 ~]# iptables -nvL --line-numbers
Chain INPUT (policy ACCEPT 6 packets, 428 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 DROP tcp -- * * 192.168.83.1 192.168.83.139 tcp spt:1234 dpt:80
- 预设规则为(policy)为ACCEPT,可以通过命令 iptables -P INPUT 修改,但是注意如果进出改为DROP则不能远程,同时本机清空操作-F不会恢复