Shulou(Shulou.com)06/01 Report--

1. Iptables Foundation:

1. Learn about iptables Firewall.

(1) iptables table: according to the different functions, it is divided into raw (status tracking), mangle (tagging), nat (address modification) and filter (filtering).

(2) iptables rule chain: according to different timing chains, it is divided into INPUT (inbound), OUTPUT (outbound), FORWARD (forwarding), PREROUTING (before routing) and POSTROUTING (after routing).

Store rules in the chain:

Filter: INPUT/FORWARD/OUTPUT

Nat: PREROUTING/POSTROUTING/OUTPUT

Mangle: PREROUTING/INPUT/FORWARD/OUTPUT/POSTROUTING

Raw: PREROUTING/OUTPUT

2. Iptables matching process: determine the matching order according to the direction of the data flow

Inbound data flow: PREROUTING-- > INPUT

Battle data flow: OUTPUT-- > POSTROUTING

Forwarding data flow: PREROUTING-- > FORWARD-- > POSTROUTING

(1) the matching order of tables:

Raw-- > mangle-- > nat-- > filter

(2) the matching order of the chain: the matching order is determined according to the direction of the data stream.

(3) the matching order of rules in the chain: from top to bottom, matching stops not matching using the default rule.

Second, write iptables rules:

Syntax: iptables-t table name option chain name condition-j action

1. Note when writing iptables syntax:

(1) omit the table name, indicating the filter table, and omitting the chain name, indicating all the chains in the table.

(2) unless the default rule is set, the matching rule must be set.

(3) options, chain names, actions must be uppercase, other lowercase

2. Actions: to deal with matching conditions, common ones are:

ACCEPT: allow; DROP: discard; REJECT: reject; LOG: log

3. Options:

Add, delete, change and check the rules of the chain.

(1) add: the end of-A chain is added, and the position of-I chain is added.

(2) Delete:-D deletes a rule and-F clears all rules in the chain

(3) View:-L-n view rules,-L-n-V displays more detailed information, and-L-n-- line-number displays rule serial numbers.

(4) set the default rule:-P chain name DROP or ACCEPT

4. Matching conditions:

(1) General matching conditions:

-P Protocol # # Common ICMP/UDP/TCP

-s source address,-d destination address # # identifiable address

-I inbound interface,-o outbound interface # # pay attention to the data flow, such as INPUT can only use-I

(2) implied matching conditions:

Port:-p protocol-- dport destination port or-- sport source port

ICMP type:-p icmp--icmp-type 8 request or 0 return or 3 network unreachable

TCP identity:-p tcp--tcp-flags range tag (syn,ack,fin,rst)

(3) display matching conditions:

Multi-port:-m multiport-p tcp or udp-- dports port 1, port 2, port: Port

Ip address range:-m-- iprange-- src-range ip1-ip2

Mac address:-m mac-- source-mac MAC address

Status:-m state-- state NEW,ESTABLISHED,RELATED (NEW new, ESTABLISHED established connection, RELATED and established task related)

Third, the actual combat of setting up the firewall of enterprise server:

/ etc/init.d/iptables stop # # emptying rules, including default

Iptables-An INPUT-I lo-j ACCEPT # # allow all local access

Iptables-An INPUT-p tcp-m-multiport-- dports 80 443 ACCEPT # # Open all local ports

Iptables-An INPUT-m state-- state RELATED,ESTABLISHED-j ACCEPT # # this machine can access other hosts

Iptables-p INPUT DROP # # set the default rules for INPUT

Iptables-p FORWARD DROP # # forbid forwarding

/ etc/init.d/iptables save # # Save rules

Chkconfig iptables on # # Boot

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.