iptables中有三张表五条链:
Filter表:INPUT链,OUTPUT链,FORWARD链
NAT表:PREROUTING链,OUTPUT链,POSTROUTING链
Mangele表:PREROUTING链,INPUT,OUTPUT链,FORWARD链,POSTROUTING链
在做此实验时,要将firewalld关掉。
[root@localhost yum.repos.d]# systemctl stop firewalld
[root@localhost yum.repos.d]# systemctl mask firewalld
[root@localhost yum.repos.d]# systemctl disable firewalls
[root@localhost yum.repos.d]# yum install iptables-services
[root@localhost yum.repos.d]# systemctl start iptables
[root@localhost yum.repos.d]# systemctl enable iptables
查看所有策略(做解析)
查看所有策略(不做解析)
查看指定mangle表信息
清空策略
重启服务后,清空的策略依然存在
因为其策略是保存在文件中的,修改文件才能彻底清除策略。
或者使用命令彻底清除策略。
添加自定义链
[root@localhost ~]# iptables -N westos (添加自定义链)
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain westos (0 references) 添加成功
target prot opt source destination
修改自定义链名称
[root@localhost ~]# iptables -E westos WESTOS11 (修改自定义链的名称)
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain WESTOS11 (0 references) 修改名称成功
target prot opt source destination
删除自定义链
[root@localhost ~]# iptables -X WESTOS11
iptables: No chain/target/match by that name.
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
添加策略1(拒绝172.25.55.250访问本机)
[root@localhost ~]# iptables -t filter -A INPUT -s 172.25.55.250 -p tcp --dport 22 -j REJECT
其他主机可以访问
删除策略
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- 172.25.55.250 0.0.0.0/0 tcp dpt:22 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@localhost ~]# iptables -D INPUT 1
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
添加策略2(拒绝所有主机访问本机)
[root@localhost ~]# iptables -A INPUT -j REJECT
修改策略
[root@localhost ~]# iptables -A INPUT -j REJECT
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
[root@localhost ~]# iptables -R INPUT 1 -j ACCEPT
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
添加策略3
!代表除什么之外
[root@localhost ~]# iptables -A INPUT ! -s 172.25.55.250 -p tcp --dport 22 -j REJECT
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- !172.25.55.250 0.0.0.0/0 tcp dpt:22 reject-with icmp-port-unreachable
源地址转换(SNAT)
[root@localhost ~]# iptables -t nat -A POSTROUTING -o ens3 -j SNAT --to-source 172.25.55.10
(注意此处写的网卡名称要与主机一致)
[root@localhost ~]# iptables -nL -t nat (查看nat表信息)
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 0.0.0.0/0 0.0.0.0/0 to:172.25.55.10
[root@localhost ~]# sysctl -a |grep ip_forward
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_use_pmtu = 0
如果内核路由功能未打开,vim /etc/sysctl.conf:net.ipv4.ip_forward = 1
[root@localhost ~]# systemctl restart network
[root@localhost ~]# ssh root@172.25.55.250
root@172.25.55.250's password:
Last login: Wed Dec 19 17:21:57 2018 from 172.25.55.100
[root@foundation55 ~]# w -i
18:00:07 up 3:38, 4 users, load average: 0.43, 0.48, 0.52
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
kiosk :0 :0 14:22 ?xdm? 56:37 0.51s gdm-session-wor
kiosk pts/2 :0 17:01 1:59 0.06s 0.06s bash
kiosk pts/5 :0 17:16 3:35 0.08s 0.01s ssh root@172.25
root pts/0 172.25.55.10 18:00 7.00s 0.07s 0.03s w -i
地址转换
[root@localhost ~]# iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-dest 172.25.55.10
[root@foundation55 ~]# ssh root@172.25.254.100
root@172.25.55.100's password:
[root@localhost ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 172.25.55.10 netmask 255.255.255.0 broadcast 1.1.1.255
inet6 fe80::5054:ff:fe00:1c0b prefixlen 64 scopeid 0x20<link>
ether 52:54:00:00:1c:0b txqueuelen 1000 (Ethernet)
RX packets 30380 bytes 3682966 (3.5 MiB)