iptable 合集
    https://www.zsythink.net/archives/tag/iptables/

    http://www.shikexu.com/archives/419

    iptable 概念
    https://www.zsythink.net/archives/1199


    第十章 防火墙 - 图1

    1.        ![](https://cdn.nlark.com/yuque/0/2021/png/116294/1618832959239-6699f49b-23c9-4895-a0da-f0e112912574.png#clientId=u706f4edf-18d5-4&from=paste&height=530&id=uaa70ef3e&margin=%5Bobject%20Object%5D&originHeight=530&originWidth=576&originalType=url&status=done&style=none&taskId=uba19574a-be51-461a-9b5d-c5f1a16114a&width=576)<br />   <br />         ![](https://cdn.nlark.com/yuque/0/2021/png/116294/1618832972388-21bcbdd3-2ad7-4410-99c3-5c1c9c13308d.png#clientId=u8bbdd235-6299-4&from=paste&height=577&id=u31cdf550&margin=%5Bobject%20Object%5D&originHeight=577&originWidth=237&originalType=url&status=done&style=none&taskId=u6a5eb367-5197-45fb-b63b-3db597e9372&width=237)                                                                  ![](https://cdn.nlark.com/yuque/0/2021/png/116294/1618832996531-d58729d9-b454-47a6-88e3-78ee84ad4e41.png#clientId=uab96dce1-2db9-4&from=paste&height=573&id=u9403679c&margin=%5Bobject%20Object%5D&originHeight=573&originWidth=259&originalType=url&status=done&style=none&taskId=u94d36843-ab8c-4a7d-a9b2-92695a43de0&width=259)

    第十章 防火墙 - 图2

    1.                                                 ![](https://cdn.nlark.com/yuque/0/2021/png/116294/1618833027356-963e6b24-98cb-4d71-9e0c-e314fc17dbd7.png#clientId=ub29aee17-166b-4&from=paste&id=u43005082&margin=%5Bobject%20Object%5D&originHeight=276&originWidth=576&originalType=url&status=done&style=none&taskId=u0896c2ea-ee26-45da-866a-95e633ba314)

    安装相关软件包

    1. yum install  iptables iptables-services -y
    3. systemctl mask firewalld   
    4. systemctl stop firewalld
    5. systemctl disable firewalld
    6. systemctl unmask iptables
    7. systemctl enable --now  iptables
    8. systemctl status iptables.service
    1. [root@riyimei ~]# rpm -qa iptables*
    2. iptables-1.4.21-35.el7.x86_64
    3. iptables-services-1.4.21-35.el7.x86_64
    4. [root@riyimei ~]#

    查看默认规则

    1. [root@riyimei ~]# iptables  -L
    2. Chain INPUT (policy ACCEPT)
    3. target     prot opt source               destination
    4. ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED
    5. ACCEPT     icmp --  anywhere             anywhere
    6. ACCEPT     all  --  anywhere             anywhere
    7. ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh
    8. REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
    10. Chain FORWARD (policy ACCEPT)
    11. target     prot opt source               destination
    12. REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited
    14. Chain OUTPUT (policy ACCEPT)
    15. target     prot opt source               destination
    16. [root@riyimei ~]#

    target列表示操作决定，
    ACCEPT表示允许，
    REJECT或DROP表示拒绝
    prot列表示本规则针对的协议
    opt列表示参数、选项
    source列表示针对的源ip
    destination列表示针对的目的ip
    最后一列表示 相关参数、状态等介绍，相当于备注

    清空所有规则

    1. [root@riyimei ~]# iptables -F && iptables -L
    2. Chain INPUT (policy ACCEPT)
    3. target     prot opt source               destination
    5. Chain FORWARD (policy ACCEPT)
    6. target     prot opt source               destination
    8. Chain OUTPUT (policy ACCEPT)
    9. target     prot opt source               destination
    10. [root@riyimei ~]#

    拒绝任何来源ftp请求的规则

    1. [root@riyimei ~]# iptables -t filter -A INPUT -i eth0 -p tcp --dport 21 -j DROP
    2. [root@riyimei ~]# iptables -L
    3. Chain INPUT (policy ACCEPT)
    4. target     prot opt source               destination
    5. DROP       tcp  --  anywhere             anywhere             tcp dpt:ftp
    7. Chain FORWARD (policy ACCEPT)
    8. target     prot opt source               destination
    10. Chain OUTPUT (policy ACCEPT)
    11. target     prot opt source               destination
    18. [root@riyimei ~]# iptables-save
    19. # Generated by iptables-save v1.4.21 on Mon Apr 19 21:08:43 2021
    20. *mangle
    21. :PREROUTING ACCEPT [4069:358430]
    22. :INPUT ACCEPT [4062:358042]
    23. :FORWARD ACCEPT [7:388]
    24. :OUTPUT ACCEPT [2257:243121]
    25. :POSTROUTING ACCEPT [2288:244257]
    26. COMMIT
    27. # Completed on Mon Apr 19 21:08:43 2021
    28. # Generated by iptables-save v1.4.21 on Mon Apr 19 21:08:43 2021
    29. *nat
    30. :PREROUTING ACCEPT [136:12684]
    31. :INPUT ACCEPT [131:12384]
    32. :OUTPUT ACCEPT [38:3168]
    33. :POSTROUTING ACCEPT [38:3168]
    34. COMMIT
    35. # Completed on Mon Apr 19 21:08:43 2021
    36. # Generated by iptables-save v1.4.21 on Mon Apr 19 21:08:43 2021
    37. *filter
    38. :INPUT ACCEPT [54:3144]
    39. :FORWARD ACCEPT [0:0]
    40. :OUTPUT ACCEPT [26:2621]
    41. -A INPUT -i eth0 -p tcp -m tcp --dport 21 -j DROP
    42. COMMIT
    43. # Completed on Mon Apr 19 21:08:43 2021
    44. [root@riyimei ~]#

    在INPUT 插入第一条规则

    1. [root@riyimei ~]# iptables -t filter -I INPUT -i eth0 -p tcp --dport 21 -s 192.168.6.0/24 -j ACCEPT
    2. [root@riyimei ~]# iptables -L -n
    3. Chain INPUT (policy ACCEPT)
    4. target     prot opt source               destination
    5. ACCEPT     tcp  --  192.168.6.0/24       0.0.0.0/0            tcp dpt:21
    6. DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:21
    8. Chain FORWARD (policy ACCEPT)
    9. target     prot opt source               destination
    11. Chain OUTPUT (policy ACCEPT)
    12. target     prot opt source               destination
    13. [root@riyimei ~]#

    只允许 192.168.6.99 访问 192.168.6.95 的ssh 22端口
    切记需要在192.168.6.99 上添加防火墙规则 否则无法再次登记主机

    1. [root@riyimei ~]# iptables -t filter -I INPUT -i eth0 -p tcp --dport 22 -s 192.168.6.99 -j ACCEPT
    2. [root@riyimei ~]# iptables -t filter -I INPUT 2 -i eth0 -p tcp --dport 22 -j DROP
    3. [root@riyimei ~]# iptables -t filter -I INPUT 3 -i eth0 -p tcp --dport 22 -m tos ! --tos 0x10 -j ACCEPT
    1. [root@rancher-server ~]# ssh 192.168.6.95
    2. root@192.168.6.95's password:
    3. Last login: Mon Apr 19 21:25:06 2021 from 192.168.6.99
    4. [root@riyimei ~]# iptables -L -n
    5. Chain INPUT (policy ACCEPT)
    6. target     prot opt source               destination
    7. ACCEPT     tcp  --  192.168.6.99         0.0.0.0/0            tcp dpt:22
    8. DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22
    9. ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 tos match!0x10/0xff
    11. Chain FORWARD (policy ACCEPT)
    12. target     prot opt source               destination
    14. Chain OUTPUT (policy ACCEPT)
    15. target     prot opt source               destination
    17. Chain DOCKER (0 references)
    18. target     prot opt source               destination
    20. Chain DOCKER-ISOLATION (0 references)
    21. target     prot opt source               destination
    22. [root@riyimei ~]#

    image.png
    https://blog.51cto.com/u_13553337/2338639

    仅拒绝ssh 协议 放行scp sftp

    https://blog.csdn.net/qq_40195432/article/details/84934964?utm_medium=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7EBlogCommendFromBaidu%7Edefault-1.control&dist_request_id=&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7EBlogCommendFromBaidu%7Edefault-1.control

    1. ssh： tos 0x0 0x10
    2. scp： tos 0x0 0x8
    3. rsync: tos 0x0 0x8

    iptables -t filter -I INPUT 2 -i eth0 -p tcp —dport 22 -m tos ! —tos 0x8 -j DROP

    1. [root@riyimei ~]# iptables -t filter -I INPUT -i eth0 -p tcp --dport 22 -s 192.168.6.99 -j ACCEPT
    2. [root@riyimei ~]# iptables -t filter -I INPUT 2 -i eth0 -p tcp --dport 22 -m tos ! --tos 0x10 -j DROP
    1. [root@riyimei ~]# iptables -L -n
    2. Chain INPUT (policy ACCEPT)
    3. target     prot opt source               destination
    4. ACCEPT     tcp  --  192.168.6.99         0.0.0.0/0            tcp dpt:22
    5. DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 tos match!0x10/0xff
    7. Chain FORWARD (policy ACCEPT)
    8. target     prot opt source               destination
    10. Chain OUTPUT (policy ACCEPT)
    11. target     prot opt source               destination
    13. Chain DOCKER (0 references)
    14. target     prot opt source               destination
    16. Chain DOCKER-ISOLATION (0 references)
    17. target     prot opt source               destination
    18. [root@riyimei ~]#
    1. [root@riyimei ~]# scp /etc/hosts 192.168.6.100:/tmp/
    2. root@192.168.6.100's password:
    3. hosts                                                                                                          100%  158    19.3KB/s   00:00
    4. [root@riyimei ~]#
    1. [root@riyimei ~]# iptables -t filter -I INPUT -i eth0 -p tcp --dport 22 -m tos ! --tos 0x10 -j ACCEPT
    2. [root@riyimei ~]# iptables -L -n
    3. Chain INPUT (policy ACCEPT)
    4. target     prot opt source               destination
    5. ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 tos match!0x10/0xff
    6. ACCEPT     tcp  --  192.168.6.99         0.0.0.0/0            tcp dpt:22
    7. DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 tos match!0x08/0xff
    9. Chain FORWARD (policy ACCEPT)
    10. target     prot opt source               destination
    12. Chain OUTPUT (policy ACCEPT)
    13. target     prot opt source               destination
    15. Chain DOCKER (0 references)
    16. target     prot opt source               destination
    18. Chain DOCKER-ISOLATION (0 references)
    19. target     prot opt source               destination
    20. [root@riyimei ~]#

    -m state —state NEW -m tcp

    1. -m state
    2. 跟TCP中的状态没有关系
    3. NEW 新生态
    4. ESTABLISHED 连接态（客户端发出请求，服务端回应后）
    5. RELATED 衍生态 （相关联的，有数据端口和传输端口的都符合）
    6. INVALID 无效态
    7. [root@uplook ~]# iptables -t filter -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    9. NEW：表示数据包将要或已经开始建立一个新的链接，或者这个包和一个还没有在两端都有数据发送的链接有关。
    10. ESTABLISHED：数据包完全有效，而且属于一个已建立的链接，这个链接的两端都已经有数据发送
    11. RELATED：说明包正在建立一个新的链接，这个链接是和一个已建立的链接有关的
    12. INVALID：说明这个包没有已知的流或链接与之关联
    1. [root@riyimei ~]# cat /etc/sysconfig/iptables
    2. # sample configuration for iptables service
    3. # you can edit this manually or use system-config-firewall
    4. # please do not ask us to add additional ports/services to this default configuration
    5. *filter
    6. :INPUT ACCEPT [0:0]
    7. :FORWARD ACCEPT [0:0]
    8. :OUTPUT ACCEPT [0:0]
    9. -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    10. -A INPUT -p icmp -j ACCEPT
    11. -A INPUT -i lo -j ACCEPT
    12. -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
    13. -A INPUT -j REJECT --reject-with icmp-host-prohibited
    14. -A FORWARD -j REJECT --reject-with icmp-host-prohibited
    15. COMMIT
    16. [root@riyimei ~]#