iptables防火墙的设置

iptables中有三张表五条链：
Filter表：INPUT链，OUTPUT链，FORWARD链
NAT表：PREROUTING链，OUTPUT链，POSTROUTING链
Mangele表:PREROUTING链，INPUT,OUTPUT链，FORWARD链，POSTROUTING链

在做此实验时，要将firewalld关掉。

[root@localhost yum.repos.d]# systemctl stop firewalld
[root@localhost yum.repos.d]# systemctl mask firewalld
[root@localhost yum.repos.d]# systemctl disable firewalls
[root@localhost yum.repos.d]# yum install iptables-services
[root@localhost yum.repos.d]# systemctl start iptables
[root@localhost yum.repos.d]# systemctl enable iptables

查看所有策略（做解析）

查看所有策略（不做解析）

查看指定mangle表信息

清空策略

重启服务后，清空的策略依然存在

因为其策略是保存在文件中的，修改文件才能彻底清除策略。

或者使用命令彻底清除策略。

添加自定义链

[root@localhost ~]# iptables -N  westos   (添加自定义链）
[root@localhost ~]# iptables -nL
	Chain INPUT (policy ACCEPT)
	target     prot opt source               destination         
	Chain FORWARD (policy ACCEPT)
	target     prot opt source               destination         
	Chain OUTPUT (policy ACCEPT)
	target     prot opt source               destination         
	Chain westos (0 references)       添加成功
	target     prot opt source               destination         

修改自定义链名称

[root@localhost ~]# iptables -E  westos WESTOS11  (修改自定义链的名称)
[root@localhost ~]# iptables -nL
	Chain INPUT (policy ACCEPT)
	target     prot opt source               destination         
	Chain FORWARD (policy ACCEPT)
	target     prot opt source               destination         
	Chain OUTPUT (policy ACCEPT)
	target     prot opt source               destination 
	Chain WESTOS11 (0 references)   修改名称成功
        target     prot opt source               destination        

删除自定义链

[root@localhost ~]# iptables -X WESTOS11
iptables: No chain/target/match by that name.
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

添加策略1（拒绝172.25.55.250访问本机）

[root@localhost ~]# iptables -t filter -A INPUT -s 172.25.55.250 -p tcp --dport 22 -j REJECT 

其他主机可以访问

删除策略

[root@localhost ~]# iptables -nL
	Chain INPUT (policy ACCEPT)
	target     prot opt source               destination         
	REJECT     tcp  --  172.25.55.250        0.0.0.0/0            tcp dpt:22 reject-with icmp-port-unreachable
	Chain FORWARD (policy ACCEPT)
	target     prot opt source               destination         
	Chain OUTPUT (policy ACCEPT)
	target     prot opt source               destination         
[root@localhost ~]# iptables -D INPUT 1
[root@localhost ~]# iptables -nL
	Chain INPUT (policy ACCEPT)
	target     prot opt source               destination         
	Chain FORWARD (policy ACCEPT)
	target     prot opt source               destination         
	Chain OUTPUT (policy ACCEPT)
	target     prot opt source               destination         

添加策略2（拒绝所有主机访问本机）

[root@localhost ~]# iptables -A INPUT -j REJECT 

修改策略

[root@localhost ~]# iptables -A INPUT -j REJECT
[root@localhost ~]# iptables -nL
	Chain INPUT (policy ACCEPT)
	target     prot opt source               destination         
	REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

[root@localhost ~]# iptables -R INPUT 1  -j ACCEPT
[root@localhost ~]# iptables -nL
	Chain INPUT (policy ACCEPT)
	target     prot opt source               destination         
	ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           

添加策略3
！代表除什么之外

[root@localhost ~]# iptables -A INPUT ! -s  172.25.55.250 -p tcp --dport 22 -j REJECT 
[root@localhost ~]# iptables -nL
	Chain INPUT (policy ACCEPT)
	target     prot opt source               destination         
	REJECT     tcp  -- !172.25.55.250        0.0.0.0/0            tcp dpt:22 reject-with icmp-port-unreachable

源地址转换(SNAT)

[root@localhost ~]# iptables -t nat -A POSTROUTING -o ens3 -j SNAT --to-source 172.25.55.10
（注意此处写的网卡名称要与主机一致）
[root@localhost ~]# iptables -nL -t nat   （查看nat表信息）
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination         	
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         	
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         	
Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination         
SNAT       all  --  0.0.0.0/0            0.0.0.0/0            to:172.25.55.10
[root@localhost ~]# sysctl -a |grep ip_forward
net.ipv4.ip_forward = 1
net.ipv4.ip_forward_use_pmtu = 0
如果内核路由功能未打开，vim /etc/sysctl.conf：net.ipv4.ip_forward = 1
[root@localhost ~]# systemctl restart network
[root@localhost ~]# ssh root@172.25.55.250
root@172.25.55.250's password: 
Last login: Wed Dec 19 17:21:57 2018 from 172.25.55.100
[root@foundation55 ~]# w -i
 18:00:07 up  3:38,  4 users,  load average: 0.43, 0.48, 0.52
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
kiosk    :0       :0               14:22   ?xdm?  56:37   0.51s gdm-session-wor
kiosk    pts/2    :0               17:01    1:59   0.06s  0.06s bash
kiosk    pts/5    :0               17:16    3:35   0.08s  0.01s ssh root@172.25
root     pts/0    172.25.55.10    18:00    7.00s  0.07s  0.03s w -i

地址转换

[root@localhost ~]# iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-dest 172.25.55.10
[root@foundation55 ~]# ssh root@172.25.254.100
root@172.25.55.100's password: 
[root@localhost ~]# ifconfig
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.25.55.10  netmask 255.255.255.0  broadcast 1.1.1.255
        inet6 fe80::5054:ff:fe00:1c0b  prefixlen 64  scopeid 0x20<link>
        ether 52:54:00:00:1c:0b  txqueuelen 1000  (Ethernet)
        RX packets 30380  bytes 3682966 (3.5 MiB)