netfilter不只是包过滤防火墙(四层) netfilter同样是状态防火墙 [root@uplook ~]# iptables -m icmp -h //从后往前查看 -m指定模块 从下往上看 [root@uplook ~]# iptables -m iprange -h //从后往前查看
[root@uplook ~]# yum -y install vsftpd httpd [root@uplook ~]# service httpd start; service vsftpd start; service sshd start [root@uplook ~]# iptables -F [root@uplook ~]# iptables -A INPUT -j REJECT
-m icmp [root@uplook ~]# iptables -t filter -I INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT //回应 any禁止ping,但可以访问 -m iprange [root@uplook ~]# iptables -t filter -I INPUT -m iprange --src-range 192.168.2.20-192.168.2.100 -j REJECT
-m multiport [root@uplook ~]# iptables -m multiport -h [root@uplook ~]# iptables -t filter -I INPUT -p tcp -m multiport --dports 20,21,22,25,80,110 -j ACCEPT
-m state 跟TCP中的状态没有关系 NEW 新生态 ESTABLISHED 连接态 RELATED 衍生态 ftp INVALID 无效态 [root@uplook ~]# iptables -t filter -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
================================================================== lab1: 使用状态防火墙,放行本机FTP服务[被动模式] [root@uplook ~]# iptables -t filter -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@uplook ~]# iptables -t filter -I INPUT -p tcp --dport 20:21 -j ACCEPT [root@uplook ~]# iptables -t filter -A INPUT -j REJECT [root@uplook ~]# modprobe nf_conntrack_ftp [root@uplook ~]# vim /etc/sysconfig/iptables-config IPTABLES_MODULES="nf_conntrack_ftp" 小结: 该内核模块的作用是在<连接数据端口时>,将第一次握手的数据包状态由原来的 NEW 识别成 RELATED
-m tos //ip协议头部type of service [root@uplook ~]# iptables -F [root@uplook ~]# tcpdump -i eth0 -nn port 22 -vvv //抓取远程主机访问本机ssh数据包,分别于输入密码前和后观察TOS值 [root@uplook ~]# tcpdump -i eth0 -nn port 22 -vvv //抓取远程从本机rsync或scp复制文件,分别于输入密码前和后观察TOS值 小结:都是使用22/tcp,但可以通过IP报文中的TOS值来区分应用 ssh: tos 0x0 0x10 scp: tos 0x0 0x8 rsync: tos 0x0 0x8 [root@uplook ~]# iptables -m tos -h [root@uplook ~]# iptables -t filter -A INPUT -p tcp --dport 22 -m tos ! --tos 0x10 -j ACCEPT //仅拒绝客户端ssh到本机 [root@uplook ~]# iptables -t filter -A INPUT -j REJECT
-m tcp 按TCP标记匹配 Flags are: SYN ACK FIN RST URG PSH ALL NONE [root@uplook ~]# iptables -t filter -A INPUT -p tcp -m tcp --tcp-flags SYN,ACK,FIN,RST SYN --dport 80 -j ACCEPT [root@uplook ~]# iptables -t filter -A INPUT -p tcp --syn --dport 80 -j ACCEPT
--tcp-flags SYN,ACK,FIN,RST SYN 检查四个标记位SYN,ACK,FIN,RST 但只有SYN标记位才匹配 则允许三次握手中的第一次握手,等价于 --syn
-m limit [要命不要脸] [root@uplook ~]# iptables -F 实验:从客户端ping本机,观察序列号 [root@uplook ~]# iptables -t filter -A INPUT -p icmp -m limit --limit 20/minute -j ACCEPT [root@uplook ~]# iptables -t filter -A INPUT -j REJECT 进入本机INPUT链的ICMP,如果匹配第一条则放行,不匹配的将被第二条拒绝,默认前5个不限 16/second 16/minute 16/hour 16/day [root@uplook ~]# iptables -t filter -A INPUT -p tcp --syn --dport 80 -m limit --limit 50/second -j ACCEPT [root@uplook ~]# iptables -t filter -A INPUT -j REJECT
-m connlimit 限同一IP最大连接数 [root@uplook ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@uplook ~]# iptables -A INPUT -p tcp --syn --dport 22 -m connlimit ! --connlimit-above 2 -j ACCEPT //仅允许每个客户端有两个ssh连接
等价于: [root@uplook ~]# iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 2 -j REJECT //超过两个连接拒绝
[root@uplook ~]# iptables -A INPUT -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 100 -j ACCEPT //仅允许每个客户端有100个requests [root@uplook ~]# iptables -A INPUT -j REJECT
-m time [root@uplook ~]# iptables -A INPUT -m time --timestart 12:00 --timestop 13:00 -j ACCEPT [root@uplook ~]# iptables -A INPUT -p tcp --syn --dport 22 -m time --timestart 12:00 --timestop 13:00 -j ACCEPT [root@uplook ~]# iptables -A INPUT -j REJECT
-m comment [root@uplook ~]# iptables -A INPUT -s 172.16.130.7 -m comment --comment "cloud class" -j REJECT
-m mark [root@uplook ~]# iptables -t filter -A INPUT -m mark --mark 2 -j REJECT
二、动作扩展 TARGET EXTENSIONS filter: -j ACCEPT -j DROP -j REJECT -j LOG
nat: -j SNAT //转换源地址 -j MASQUERADE //转换源地址 -j DNAT //转换目标地址及端口 -j REDIRECT //转换目标端口(重定向)
mangle: -j MARK
-j LOG [root@uplook ~]# grep 'kern.' /etc/rsyslog.conf kern. /var/log/kernel.log [root@uplook ~]# service rsyslog restart
[root@uplook ~]# iptables -j LOG -h [root@uplook ~]# iptables -t filter -A INPUT -p tcp --syn --dport 22 -j LOG --log-prefix " uplook_ssh " [root@uplook ~]# iptables -t filter -A INPUT -p tcp --syn --dport 22 -j ACCEPT [root@uplook ~]# iptables -t filter -A INPUT -j REJECT
-j REJECT 当访问一个未开启的TCP端口时,应该返回一个带有RST标记的数据包 当访问一个开启的TCP端口,但被防火墙REJECT,结果返回port xxx unreachable [root@uplook ~]# iptables -j REJECT -h [root@uplook ~]# iptables -t filter -A INPUT -p tcp --dport 22 -j REJECT --reject-with tcp-reset //返回一个自定义消息类型
-j MARK [root@uplook ~]# iptables -t mangle -L [root@uplook ~]# iptables -j MARK -h [root@uplook ~]# iptables -t mangle -A PREROUTING -s 192.168.2.110 -j MARK --set-mark 1 [root@uplook ~]# iptables -t mangle -A PREROUTING -s 192.168.2.25 -j MARK --set-mark 2 [root@uplook ~]# iptables -t filter -A INPUT -m mark --mark 1 -j ACCEPT //按照标记匹配 [root@uplook ~]# iptables -t filter -A INPUT -m mark --mark 2 -j REJECT
NAT表:
POSTROUTING: SNAT, MASQUERADE PRETROUTING: DNAT, REDIRECT OUTPUT: DNAT,针对本机
让KVM虚拟机访问外部网络(默认): -j SNAT/MASQUERADE [必须开启kernel ip_forward] [root@uplook ~]# iptables -t nat -F [root@uplook ~]# iptables -F [root@uplook ~]# iptables -t nat -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j SNAT --to 外部地址 [root@uplook ~]# iptables -t nat -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE
暴露KVM虚拟机的服务(端口映射): -j DNAT [必须开启kernel ip_forward] [root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.30 -p tcp --dport 80 -j DNAT --to 192.168.122.66:80 [root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.30 -p tcp --dport 8080 -j DNAT --to 192.168.122.77:80 [root@uplook ~]# iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to 192.168.122.66:22
[root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.240 -p tcp --dport 80 -j DNAT --to 192.168.122.66 [root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.240 -p tcp --dport 22 -j DNAT --to 192.168.122.66 [root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.241 -p tcp --dport 80 -j DNAT --to 192.168.122.67 [root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.241 -p tcp --dport 22 -j DNAT --to 192.168.122.67
为接口绑定地址 [root@uplook ~]# ip addr add dev eth0 172.16.30.240/24 [root@uplook ~]# ip addr add dev eth0 172.16.30.241/24 [root@uplook ~]# ip a s eth0 3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 3c:97:0e:54:c5:82 brd ff:ff:ff:ff:ff:ff inet 172.16.30.30/24 brd 172.16.30.255 scope global eth0 inet 172.16.30.240/24 scope global secondary eth0 inet 172.16.30.241/24 scope global secondary eth0 inet6 fe80::3e97:eff:fe54:c582/64 scope link valid_lft forever preferred_lft forever
[root@uplook ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0 IPADDR=172.16.30.30 PREFIX=24 IPADDR1=172.16.30.240 PREFIX1=24 IPADDR2=172.16.30.241 PREFIX2=24 GATEWAY=172.16.30.254
-j REDIRECT //本地端口转发 [root@nat_server ~]# iptables -t nat -A PREROUTING -s 172.16.130.0/24 -p tcp --dport 8888 -j REDIRECT --to-ports 22