配置iptables

转载

mob604756e58279 2015-07-02 20:40:00

[root@master ~]# service iptables status
iptables：未运行防火墙。
[root@master ~]# service iptables start
iptables：应用防火墙规则：                                 [确定]


单个IP的命令是
iptables -I INPUT -s 192.168.1.4 -j DROP  --拒绝192.168.1.4的访问


从192.168.1.5 发起ssh

[root@slave1 ~]# ssh root@192.168.1.100
The authenticity of host '192.168.1.100 (192.168.1.100)' can't be established.
RSA key fingerprint is 58:8b:d9:7f:86:3d:6c:9a:0a:69:e9:0b:26:06:eb:a2.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.1.100' (RSA) to the list of known hosts.
root@192.168.1.100's password: 
Last login: Mon May 18 16:47:47 2015 from oem-20140503syk

此时可以 查看192.168.1.100上的ip规则
[root@master ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
DROP       all  --  192.168.1.4          0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  



默认开始防火墙后的情况:

service iptables status可以查看到iptables服务的当前状态
/etc/init.d/iptables stop
/etc/init.d/iptables start


[root@slave1 ~]# service iptables status
iptables：未运行防火墙。


touch /etc/sysconfig/iptables


jrhppt02:/etc/sysconfig# service iptables status
iptables: Firewall modules are not loaded.



/sbin/modprobe iptable_filter --添加模块


没加载模块:

jrhppt02:/proc# lsmod 
Module                  Size  Used by
nfnetlink               4200  0 
bluetooth              99271  0 
rfkill                 19255  1 bluetooth
xenfs                   5705  1 
microcode             112685  0 
xen_netfront           19033  0 
i2c_piix4              12608  0 
i2c_core               31084  1 i2c_piix4
ext4                  374405  1 
jbd2                   93427  1 ext4
mbcache                 8193  1 ext4
xen_blkfront           15495  2 
pata_acpi               3701  0 
ata_generic             3837  0 
ata_piix               24601  0 
dm_mirror              14384  0 
dm_region_hash         12085  1 dm_mirror
dm_log                  9930  2 dm_mirror,dm_region_hash
dm_mod                 84337  2 dm_mirror,dm_log
jrhppt02:/proc# 



jrhppt02:/proc#  modprobe ip_tables
You have mail in /var/spool/mail/root
jrhppt02:/proc# lsmod 
Module                  Size  Used by
ip_tables              17831  0 
nfnetlink               4200  0 
bluetooth              99271  0 
rfkill                 19255  1 bluetooth
xenfs                   5705  1 
microcode             112685  0 
xen_netfront           19033  0 
i2c_piix4              12608  0 
i2c_core               31084  1 i2c_piix4
ext4                  374405  1 
jbd2                   93427  1 ext4
mbcache                 8193  1 ext4
xen_blkfront           15495  2 
pata_acpi               3701  0 
ata_generic             3837  0 
ata_piix               24601  0 
dm_mirror              14384  0 
dm_region_hash         12085  1 dm_mirror
dm_log                  9930  2 dm_mirror,dm_region_hash
dm_mod                 84337  2 dm_mirror,dm_log