Archive for 2 月, 2011

防火墙一些规则知识

By tort ( 17 2 月, 2011 at 下午 8:53) · Filed under Linux分享

1)跳转内网
-A PREROUTING -d 222.66.99.201 -p tcp -m tcp –dport 8800 -j DNAT –to-destination 192.168.84.46:3389
-A POSTROUTING -d 192.168.84.46 -p tcp -m tcp –dport 3389 -j SNAT –to-source 192.168.84.48
-A PREROUTING -p tcp -d 外网IP –dport 8800 -j DNAT –to $内网IP：3389
iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 8080 -j DNAT –to WINIP:3389
iptables -t nat -A POSTROUTING -o eth1 -j SNAT –to 内网卡的IP
2)端口跳转实例操作
-A PREROUTING -i eth1 -p tcp -m state –state NEW -m tcp –dport 80 -j REDIRECT –to-ports 8080
3)开放端口实例操作
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 6060 -j ACCEPT
-A INPUT -p tcp -m state –state NEW -m tcp –dport 8080 -j ACCEPT
4)连续打开端口
-A RH-Firewall-1-INPUT -m state –state NEW -m tcp -p tcp –dport 7070:7079 -j ACCEPT
将80端口指向到8080端口上的IPTABLES文件
iptables -t nat -A PREROUTING -p tcp -m tcp –dport 80 -j REDIRECT –to-ports 8080
iptables -A INPUT -p tcp -m state –state NEW –dport 80 -j ACCEPT
iptables-save > /etc/sysconfig/iptables
iptables -t nat -A PREROUTING -p tcp -m tcp –dport 443 -j REDIRECT –to-ports 8443
iptables -A INPUT -p tcp -m state –state NEW –dport 443 -j ACCEPT
iptables-save > /etc/sysconfig/iptables
防止同步包洪水（Sync Flood）
# iptables -A FORWARD -p tcp –syn -m limit –limit 1/s -j ACCEPT
也有人写作
#iptables -A INPUT -p tcp –syn -m limit –limit 1/s -j ACCEPT
–limit 1/s
限制syn并发数每秒1次，可以根据自己的需要修改
防止各种端口扫描
# iptables -A FORWARD -p tcp –tcp-flags SYN,ACK,FIN,RST RST -m limit –limit 1/s -j ACCEPT
Ping洪水攻击（Ping of Death）
# iptables -A FORWARD -p icmp –icmp-type echo-request -m limit –limit 1/s -j ACCEPT
iptables 屏蔽单个IP
iptables -I INPUT -s 203.231.1.191 -p tcp –dport 22 -j DROP
iptables -A FORWARD -d 218.241.156.95 -j DROP
iptables-save > /etc/sysconfig/iptables
iptables -A INPUT　–dport 21 -s 219.142.192.187 -j ACCEPT //只允许一个IP访问
# Generated by iptables-save v1.2.8 on Tue Jan 23 14:49:09 2007
*nat
:PREROUTING ACCEPT [133:37589]
:POSTROUTING ACCEPT [26:2387]
:OUTPUT ACCEPT [26:2387]
-A PREROUTING -p tcp -m tcp –dport 80 -j REDIRECT –to-ports 8080
COMMIT
# Completed on Tue Jan 23 14:49:09 2007
# Generated by iptables-save v1.2.8 on Tue Jan 23 14:49:09 2007
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [62834:18310016]
:RH-Firewall-1-INPUT – [0:0]
-A INPUT -j RH-Firewall-1-INPUT
-A INPUT -p tcp -m state –state NEW -m tcp –dport 80 -j ACCEPT
-A FORWARD -j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT -i lo -j ACCEPT
-A RH-Firewall-1-INPUT -p icmp -m icmp any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -m state –state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 8080 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m state –state NEW -m tcp –dport 22 -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT –reject-with icmp-host-prohibited
COMMIT
# Completed on Tue Jan 23 14:49:09 2007
# 只允许211.93.113.33地址的用户访问 ftp 服务器（21 端口）：
-A INPUT -s 192.168.0.0/255.255.255.0 -i eth0 -p tcp -m tcp –dport 21 -j ACCEPT
-A INPUT -s 211.93.113.33 i eth1 -p tcp -m tcp –dport 21 -j ACCEPT
-A INPUT -p tcp -m tcp –dport 21 -j ACCEPT
封杀QQGAME：iptables -I FORWARD -m string –algo bm –string “qqgame” -j DROP
封杀QQ宠物：iptables -I FORWARD -m string –algo bm –string “qqpet” -j DROP
1)针对所有端口的完全封锁; iptables -I INPUT -s 65.55.44.100 -j DROP; (封锁65.55.44.100对本机所有端口的访问)
iptables -I OUTPUT -d 65.55.44.100 -j DROP; (封锁本机对65.55.44.100所有端口的访问)
2)针对特定协议及端口的完全封锁;iptables -I INPUT -p TCP –dport 25 -j DROP; (封锁25端口的INPUT,本机将不能接收邮件)
iptables -I OUTPUT -p TCP –dport 25 -j DROP; (封锁25端口的OUTPUT,本机将不能发送邮件)
iptables -I INPUT -s 65.55.44.100 -p TCP –dport 25 -j DROP; (封锁65.55.44.100对本机25端口的访问)
3)针对特定协议的部分封锁; #禁止所有TCP连接,只允许某些IP可以通过TCP访问本机:
iptables -I INPUT -p TCP -j DROP; (禁止所有通过TCP协议进入本机的连线)
iptables -I INPUT -s 137.189.3.8 -p TCP -j ACCEPT; (允许137.189.3.8通过TCP协议进入本机)
iptables -I INPUT -s ! 137.189.3.8 -p TCP -j DROP; (只允许137.189.3.8进入,等效于上两句,但只能开放一个IP)
#开放所有TCP连接,但禁止某 些IP可以通过TCP访问本机:
iptables -I INPUT -p TCP -j ACCEPT; (允许所有通过TCP协议进入本机的连线)
iptables -I INPUT -s 137.189.3.8 -p TCP -j DROP; (禁止137.189.3.8通过TCP协议进入本机)
iptables -I INPUT -s ! 137.189.3.8 -p TCP -j ACCEPT; (等效于前两句,但只能禁止一个IP)
4)针对特定协议及端口的部分封锁; #开放TCP连接80端口,但禁止某些IP通过TCP访问80端口:
iptables -I INPUT -p TCP –dport 80 -j ACCEPT; (允许所有IP对本机80端口的访问)
iptables -I INPUT -s 210.245.191.162 -p TCP –dport 80 -j DROP; (禁止210.245.191.162对80端口的访问)
iptables -I INPUT -s ! 210.245.191.162 -p TCP –dport 80 -j ACCEPT; (等效于前两句,但只能禁止一个IP)
#禁止TCP连接80端口,只开放某些IP通过TCP访问80端口:
iptables -I INPUT -p TCP –dport 80 -j DROP; (禁止所有IP对本机80端口的访问)
iptables -I INPUT -s 210.245.191.162 -p TCP –dport 80 -j ACCEPT; (允许210.245.191.162对80端口的访问)
iptables -I INPUT -s ! 210.245.191.162 -p TCP –dport 80 -j DROP; (等效于前两句,但只能开放一个IP进入)
#禁止本机通过TCP的80端口浏览外部网站,只允许访问203.194.162.10网站:
iptables -I OUTPUT -p tcp –dport 80 -j DROP; (封锁80端口的OUTPUT,本机将不能浏缆外部网站)
iptables -I OUTPUT -p tcp -d 203.194.162.10 –dport 80 -j ACCEPT; (允许本机访问203.194.162.10的80端口)
iptables -I OUTPUT -p tcp -d ! 203.194.162.10 –dport 80 -j DROP; (等效于前两句,但只能允许访问一个IP)
sysctl -w net.ipv4.icmp_echo_ignore_all=1(禁ping)
开启转发和映射
echo “1” > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A PREROUTING -p tcp –dport 2222 -j DNAT –to-destination 192.168.1.156:22
记得把要转发的机器的网关指定到转发机器
手动加网关
route add default gw xxx.xxx.xxx.xXX

评论