10.11 Linux网络相关
修改配置网卡配置文件/etc/sysconfig/network-scripts/ifcfg-xxx（网卡）
ifconfig 查看网卡的ip，
安装网卡的命令：yum install net-tools
ifdown ens33 && ifup ens33 重启网卡（服务器上和终端连接）
systemctl restart network 重启网卡
mii-tool ens33：查看ens33网卡是否连接，lin-ok（连接）
[root@bogon ~]# mii-tool ens33 ens33: negotiated 1000baseT-FD flow-control, link ok
ethtool ens33这个命令也可以查看网卡是否连接，detected yes/no
[root@bogon ~]# ethtool ens33 Settings for ens33: Supported ports: [ TP ] Supported link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Full Supported pause frame use: No Supports auto-negotiation: Yes Supported FEC modes: Not reported Advertised link modes: 10baseT/Half 10baseT/Full 100baseT/Half 100baseT/Full 1000baseT/Full Advertised pause frame use: No Advertised auto-negotiation: Yes Advertised FEC modes: Not reported Speed: 1000Mb/s Duplex: Full Port: Twisted Pair PHYAD: 0 Transceiver: internal Auto-negotiation: on MDI-X: off (auto) Supports Wake-on: d Wake-on: d Current message level: 0x00000007 (7) drv probe link Link detected: yes
更改主机名
命令hostname 临时更改
hostnamectl set-hostname aminglinux-123 永久更改用户名
[root@bogon ~]# hostname bogon [root@bogon ~]# hostname Aing [root@bogon ~]# hostname Aing [root@bogon ~]# hostnamectl set-hostname aminglinux-123 [root@bogon ~]# hostname aminglinux-123 [root@bogon ~]# cat /etc/hostname aminglinux-123
设置DNS
把DNS写到配置文件/etc/resolv.conf
[root@bogon ~]# cat /etc/resolv.conf # Generated by NetworkManager nameserver 202.106.0.20
修改/etc/hosts文件
[root@bogon network-scripts]# cat /etc/hosts 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4 ::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
[root@bogon network-scripts]# vim /etc/hosts [root@bogon network-scripts]# ping -c 2 www.baidu.com PING localhost (127.0.0.1) 56(84) bytes of data. 64 bytes from localhost (127.0.0.1): icmp_seq=1 ttl=64 time=0.104 ms 64 bytes from localhost (127.0.0.1): icmp_seq=2 ttl=64 time=0.039 ms --- localhost ping statistics --- 2 packets transmitted, 2 received, 0% packet loss, time 999ms rtt min/avg/max/mdev = 0.039/0.071/0.104/0.033 ms
一个IP后面可以跟多个域名，可以是几十个甚至上百个
每一行只能一个IP，也就是说一个域名不能对应多个IP
如果有多行中出现相同的域名（对应的IP不一样），会按最前面出现的记录来解析。
LINUX防火墙
SELinux是LInux系统特有的安全机制。
临时关闭SElinux的方法
[root@aminglinux-123 ~]# setenforce 0 setenforce: SELinux is disabled [root@aminglinux-123 ~]#
永久关闭 把SELINUX=enforcing改成SELINUX=disabled 重启生效
getenforce 查看当前SELinux的状态
[root@aminglinux-123 ~]# vim /etc/selinux/config
netfilter
netfilter5表5链介绍
netfilter的5个表：
filter表用于过滤包，系统预设的最常用的表，该表有3个链，分别是 INPUT、OUTPUT以及FORWARD 。
INPUT链作用于进入本机的包
OUTPUT作用于送出本机的包
FORWARD链作用于那些跟本机无关的包。
nat表主要用于网络地址转换，他也有3个链，分别是:
PREROUTING链的作用是在包刚刚到达防火墙时改变它的目的地址(需要的时候可以使用这个链)
OUTPUT链是改变本地产生的包的目的地址
POSTROUTING链的作用是在包即将离开防火墙的时候改变其源地址。
以下3个表几乎不用：
mangle表：主要用来修改数据包
security表：用于实现强制访问控制安全模型。
raw表：其他各种用途。
iptables
Iptables是linux上特有的防火墙机制，其功能非常强大，然而阿铭在日常的管理工作中仅仅用到了一两个应用，这并不代表iptables不重要。作为一个网络管理员，iptables是必要要熟练掌握的。但是作为系统管理员，我们也应该会最基本的iptables操作，认识iptables的基本规则。
CentOS上默认是设有iptables规则的，这个规则虽然很安全，但是对于我们来说没有用，建议你先清除规则，然后把清除后的规则保存一下。
[root@aminglinux-123 ~]# iptables -nvL Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 53713 27M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 7 528 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 56824 4641K INPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0 56824 4641K INPUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0 .0.0/0 56824 4641K INPUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID 56818 4641K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122. 0/24 ctstate RELATED,ESTABLISHED 0 0 ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0 0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 0 0 FORWARD_direct all -- * * 0.0.0.0/0 0.0.0.0 /0 0 0 FORWARD_IN_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FORWARD_IN_ZONES all -- * * 0.0.0.0/0 0.0.0 .0/0 0 0 FORWARD_OUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FORWARD_OUT_ZONES all -- * * 0.0.0.0/0 0.0. 0.0/0 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 186 packets, 18143 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:68 83145 23M OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/ 0 Chain FORWARD_IN_ZONES (1 references) pkts bytes target prot opt in out source destination 0 0 FWDI_public all -- ens33 * 0.0.0.0/0 0.0.0.0/0 [goto] 0 0 FWDI_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto] Chain FORWARD_IN_ZONES_SOURCE (1 references) pkts bytes target prot opt in out source destination Chain FORWARD_OUT_ZONES (1 references) pkts bytes target prot opt in out source destination 0 0 FWDO_public all -- * ens33 0.0.0.0/0 0.0.0.0/0 [goto] 0 0 FWDO_public all -- * + 0.0.0.0/0 0.0.0.0/0 [goto] Chain FORWARD_OUT_ZONES_SOURCE (1 references) pkts bytes target prot opt in out source destination Chain FORWARD_direct (1 references) pkts bytes target prot opt in out source destination Chain FWDI_public (2 references) pkts bytes target prot opt in out source destination 0 0 FWDI_public_log all -- * * 0.0.0.0/0 0.0.0. 0/0 0 0 FWDI_public_deny all -- * * 0.0.0.0/0 0.0.0 .0/0 0 0 FWDI_public_allow all -- * * 0.0.0.0/0 0.0. 0.0/0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 Chain FWDI_public_allow (1 references) pkts bytes target prot opt in out source destination Chain FWDI_public_deny (1 references) pkts bytes target prot opt in out source destination Chain FWDI_public_log (1 references) pkts bytes target prot opt in out source destination Chain FWDO_public (2 references) pkts bytes target prot opt in out source destination 0 0 FWDO_public_log all -- * * 0.0.0.0/0 0.0.0. 0/0 0 0 FWDO_public_deny all -- * * 0.0.0.0/0 0.0.0 .0/0 0 0 FWDO_public_allow all -- * * 0.0.0.0/0 0.0. 0.0/0 Chain FWDO_public_allow (1 references) pkts bytes target prot opt in out source destination Chain FWDO_public_deny (1 references) pkts bytes target prot opt in out source destination Chain FWDO_public_log (1 references) pkts bytes target prot opt in out source destination Chain INPUT_ZONES (1 references) pkts bytes target prot opt in out source destination 1959 160K IN_public all -- ens33 * 0.0.0.0/0 0.0.0.0/0 [goto] 11 2534 IN_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto] Chain INPUT_ZONES_SOURCE (1 references) pkts bytes target prot opt in out source destination Chain INPUT_direct (1 references) pkts bytes target prot opt in out source destination Chain IN_public (2 references) pkts bytes target prot opt in out source destination 56824 4641K IN_public_log all -- * * 0.0.0.0/0 0.0.0.0/ 0 56824 4641K IN_public_deny all -- * * 0.0.0.0/0 0.0.0.0 /0 56824 4641K IN_public_allow all -- * * 0.0.0.0/0 0.0.0. 0/0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 Chain IN_public_allow (1 references) pkts bytes target prot opt in out source destination 6 312 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW Chain IN_public_deny (1 references) pkts bytes target prot opt in out source destination Chain IN_public_log (1 references) pkts bytes target prot opt in out source destination Chain OUTPUT_direct (1 references) pkts bytes target prot opt in out source destination
-nvL 就是查看规则， -F 是把当前规则清除，但这个只是临时的，重启系统或者重启 iptalbes 服务后还会加载已经保存的规则，所以需要使用 /etc/init.d/iptables save 保存一下规则，通过上边的命令输出我们也可以看到，防火墙规则保存在了/etc/sysconfig/iptables 你可以查看一下这个文件。
1）iptalbes的三个表
filter 这个表主要用于过滤包的，是系统预设的表，这个表也是阿铭用的最多的。内建三个链INPUT、OUTPUT以及FORWARD。INPUT作用于进入本机的包；OUTPUT作用于本机送出的包；FORWARD作用于那些跟本机无关的包。
nat 主要用处是网络地址转换，也有三个链。PREROUTING 链的作用是在包刚刚到达防火墙时改变它的目的地址，如果需要的话。OUTPUT链改变本地产生的包的目的地址。POSTROUTING链在包就要离开防火墙之前改变其源地址。该表阿铭用的不多，但有时候会用到。
mangle 这个表主要是用于给数据包打标记，然后根据标记去操作哪些包。这个表几乎不怎么用。除非你想成为一个高级网络工程师，否则你就没有必要花费很多心思在它上面。
iptables 基本语法
A. 查看规则以及清除规则
[root@aminglinux-123 ~]# iptables -t nat -nvL Chain PREROUTING (policy ACCEPT 1999 packets, 162K bytes) pkts bytes target prot opt in out source destination 56652 4601K PREROUTING_direct all -- * * 0.0.0.0/0 0.0. 0.0/0 56652 4601K PREROUTING_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 56652 4601K PREROUTING_ZONES all -- * * 0.0.0.0/0 0.0.0 .0/0 Chain INPUT (policy ACCEPT 1 packets, 52 bytes) pkts bytes target prot opt in out source destination Chain OUTPUT (policy ACCEPT 146 packets, 11067 bytes) pkts bytes target prot opt in out source destination 1642 122K OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/ 0 Chain POSTROUTING (policy ACCEPT 146 packets, 11067 bytes) pkts bytes target prot opt in out source destination 11 627 RETURN all -- * * 192.168.122.0/24 224.0.0.0/24 0 0 RETURN all -- * * 192.168.122.0/24 255.255.255. 255 0 0 MASQUERADE tcp -- * * 192.168.122.0/24 !192.168.122 .0/24 masq ports: 1024-65535 0 0 MASQUERADE udp -- * * 192.168.122.0/24 !192.168.122 .0/24 masq ports: 1024-65535 0 0 MASQUERADE all -- * * 192.168.122.0/24 !192.168.122 .0/24 1631 121K POSTROUTING_direct all -- * * 0.0.0.0/0 0.0 .0.0/0 1631 121K POSTROUTING_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 1631 121K POSTROUTING_ZONES all -- * * 0.0.0.0/0 0.0. 0.0/0 Chain OUTPUT_direct (1 references) pkts bytes target prot opt in out source destination Chain POSTROUTING_ZONES (1 references) pkts bytes target prot opt in out source destination 146 11067 POST_public all -- * ens33 0.0.0.0/0 0.0.0.0/0 [goto] 7 528 POST_public all -- * + 0.0.0.0/0 0.0.0.0/0 [goto] Chain POSTROUTING_ZONES_SOURCE (1 references) pkts bytes target prot opt in out source destination Chain POSTROUTING_direct (1 references) pkts bytes target prot opt in out source destination Chain POST_public (2 references) pkts bytes target prot opt in out source destination 1631 121K POST_public_log all -- * * 0.0.0.0/0 0.0.0. 0/0 1631 121K POST_public_deny all -- * * 0.0.0.0/0 0.0.0 .0/0 1631 121K POST_public_allow all -- * * 0.0.0.0/0 0.0. 0.0/0 Chain POST_public_allow (1 references) pkts bytes target prot opt in out source destination Chain POST_public_deny (1 references) pkts bytes target prot opt in out source destination Chain POST_public_log (1 references) pkts bytes target prot opt in out source destination Chain PREROUTING_ZONES (1 references) pkts bytes target prot opt in out source destination 1999 162K PRE_public all -- ens33 * 0.0.0.0/0 0.0.0.0/0 [goto] 8 1664 PRE_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto] Chain PREROUTING_ZONES_SOURCE (1 references) pkts bytes target prot opt in out source destination Chain PREROUTING_direct (1 references) pkts bytes target prot opt in out source destination Chain PRE_public (2 references) pkts bytes target prot opt in out source destination 56652 4601K PRE_public_log all -- * * 0.0.0.0/0 0.0.0.0 /0 56652 4601K PRE_public_deny all -- * * 0.0.0.0/0 0.0.0. 0/0 56652 4601K PRE_public_allow all -- * * 0.0.0.0/0 0.0.0 .0/0 Chain PRE_public_allow (1 references) pkts bytes target prot opt in out source destination Chain PRE_public_deny (1 references) pkts bytes target prot opt in out source destination Chain PRE_public_log (1 references) pkts bytes target prot opt in out source destination
-t 后面跟表名，-nvL 即查看该表的规则，其中-n表示不针对IP反解析主机名；-L表示列出的意思；而-v表示列出的信息更加详细。如果不加-t ，则打印filter表的
[root@aminglinux-123 ~]# iptables -nvL Chain INPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:53 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:53 0 0 ACCEPT udp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 udp dpt:67 0 0 ACCEPT tcp -- virbr0 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:67 53742 27M ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 7 528 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 56909 4648K INPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0 56909 4648K INPUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 56909 4648K INPUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID 56903 4647K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- * virbr0 0.0.0.0/0 192.168.122.0/24 ctstate RELATED,ESTABLISHED 0 0 ACCEPT all -- virbr0 * 192.168.122.0/24 0.0.0.0/0 0 0 ACCEPT all -- virbr0 virbr0 0.0.0.0/0 0.0.0.0/0 0 0 REJECT all -- * virbr0 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 REJECT all -- virbr0 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable 0 0 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate RELATED,ESTABLISHED 0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0 0 0 FORWARD_direct all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FORWARD_IN_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FORWARD_IN_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FORWARD_OUT_ZONES_SOURCE all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FORWARD_OUT_ZONES all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 ctstate INVALID 0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT 209 packets, 32823 bytes) pkts bytes target prot opt in out source destination 0 0 ACCEPT udp -- * virbr0 0.0.0.0/0 0.0.0.0/0 udp dpt:68 83168 23M OUTPUT_direct all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FORWARD_IN_ZONES (1 references) pkts bytes target prot opt in out source destination 0 0 FWDI_public all -- ens33 * 0.0.0.0/0 0.0.0.0/0 [goto] 0 0 FWDI_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto] Chain FORWARD_IN_ZONES_SOURCE (1 references) pkts bytes target prot opt in out source destination Chain FORWARD_OUT_ZONES (1 references) pkts bytes target prot opt in out source destination 0 0 FWDO_public all -- * ens33 0.0.0.0/0 0.0.0.0/0 [goto] 0 0 FWDO_public all -- * + 0.0.0.0/0 0.0.0.0/0 [goto] Chain FORWARD_OUT_ZONES_SOURCE (1 references) pkts bytes target prot opt in out source destination Chain FORWARD_direct (1 references) pkts bytes target prot opt in out source destination Chain FWDI_public (2 references) pkts bytes target prot opt in out source destination 0 0 FWDI_public_log all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FWDI_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FWDI_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 Chain FWDI_public_allow (1 references) pkts bytes target prot opt in out source destination Chain FWDI_public_deny (1 references) pkts bytes target prot opt in out source destination Chain FWDI_public_log (1 references) pkts bytes target prot opt in out source destination Chain FWDO_public (2 references) pkts bytes target prot opt in out source destination 0 0 FWDO_public_log all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FWDO_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 FWDO_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0 Chain FWDO_public_allow (1 references) pkts bytes target prot opt in out source destination Chain FWDO_public_deny (1 references) pkts bytes target prot opt in out source destination Chain FWDO_public_log (1 references) pkts bytes target prot opt in out source destination Chain INPUT_ZONES (1 references) pkts bytes target prot opt in out source destination 2044 167K IN_public all -- ens33 * 0.0.0.0/0 0.0.0.0/0 [goto] 11 2534 IN_public all -- + * 0.0.0.0/0 0.0.0.0/0 [goto] Chain INPUT_ZONES_SOURCE (1 references) pkts bytes target prot opt in out source destination Chain INPUT_direct (1 references) pkts bytes target prot opt in out source destination Chain IN_public (2 references) pkts bytes target prot opt in out source destination 56909 4648K IN_public_log all -- * * 0.0.0.0/0 0.0.0.0/0 56909 4648K IN_public_deny all -- * * 0.0.0.0/0 0.0.0.0/0 56909 4648K IN_public_allow all -- * * 0.0.0.0/0 0.0.0.0/0 0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 Chain IN_public_allow (1 references) pkts bytes target prot opt in out source destination 6 312 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ctstate NEW Chain IN_public_deny (1 references) pkts bytes target prot opt in out source destination Chain IN_public_log (1 references) pkts bytes target prot opt in out source destination Chain OUTPUT_direct (1 references) pkts bytes target prot opt in out source destination
