note80 root_巡狩大明txt下载 80_winsealxp 80电子印章制作工具

内容预览：

192.168.4.119 为本机的ip地址；每条链的规则是由上至下进行匹配note80 root，因此我们必须把范围小的规则放在前面以防被覆盖。

1）清空iptables默认规则，并自定义规则

[[email protected] ~]# systemctl start firewalld.service  #启用防火墙
[[email protected] ~]# iptables -F  #清空默认规则
[[email protected] ~]# iptables -I INPUT -d 192.168.4.119 -p tcp --dport 22 -j ACCEPT  #接受任何主机对本机的ssh连接请求
[[email protected] ~]# iptables -I OUTPUT -s 192.168.4.119 -p tcp --sport 22 -j ACCEPT  #允许本机对任何主机建立ssh连接
[[email protected] ~]# iptables -A INPUT -j REJECT  #最后一条规则设置为拒绝所有入站请求
[[email protected] ~]# iptables -A OUTPUT -j REJECT  #最后一条规则设置为拒绝所有出站流量
[[email protected] ~]# iptables -vnL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
  0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            192.168.4.119        tcp dpt:22
    7  1076 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   0     0 ACCEPT     tcp  --  *      *       192.168.4.119        0.0.0.0/0            tcp spt:22
    8   720 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

2）多端口匹配，开放21，22note80 root，23，80，3306端口

[[email protected] ~]# iptables -I INPUT -d 192.168.4.119 -p tcp -m multiport --dports 21:23,80,3306 -j ACCEPT
[[email protected] ~]# iptables -I INPUT -d 192.168.4.119 -p udp -m multiport --dports 21:23,80,3306 -j ACCEPT
[[email protected] ~]# iptables -I OUTPUT -s 192.168.4.119 -p tcp -m multiport --sports 21:23,80,3306 -j ACCEPT
[[email protected] ~]# iptables -I OUTPUT -s 192.168.4.119 -p udp -m multiport --sports 21:23,80,3306 -j ACCEPT

3）连续地址的匹配，允许192.168.4.1 ~ 192.168.4.100访问80端口

[[email protected] ~]# iptables -I INPUT -d 192.168.4.119 -p tcp --dport 80 -m iprange --src-range 192.168.4.1-192.168.4.100 -j ACCEPT
[[email protected] ~]# iptables -I OUTPUT -s 192.168.4.119 -p tcp --sport 80 -m iprange --dst-range 192.168.4.1-192.168.4.100 -j ACCEPT

4）限定时间访问，只允许周一至周四 9:00~18:00 之间访问80端口

[[email protected] ~]# iptables -I INPUT -d 192.168.4.119 -p tcp --dport 80 -m time --kerneltz --weekdays 1,2,3,4,5 --timestart 9:00 --timestop 18:00 -j ACCEPT
[[email protected] ~]# iptables -I OUTPUT -s 192.168.4.119 -p tcp --sport 80 -m time --kerneltz --weekdays 1,2,3,4,5 --timestart 9:00 --timestop 18:00 -j ACCEPT

5）对报文作字节串匹配，拒绝响应带“vpn”明文字符的信令通过80端口

[[email protected] ~]# iptables -I OUTPUT -s 192.168.4.119 -p tcp --sport 80 -m string --algo kmp --string "vpn" -j REJECT

6）并发连接限制，限制192.168.2.0/24网段中每个ip对3306端口最多只能有2个并发

[[email protected] ~]# iptables -I INPUT -d 192.168.4.119 -s 192.168.2.0/24 -p tcp --dport 3306 -m connlimit --connlimit-upto 2 -j ACCEPT

7）对报文作速度限制，限制同时最多有5个icmp包，每秒1个icmp包

[[email protected] ~]# iptables -I INPUT -d 192.168.4.119 -p icmp --icmp-type 8 -m limit --limit-burst 5 --limit 60/minute -j ACCEPT
[[email protected] ~]# iptables -I OUTPUT -s 192.168.4.119 -p icmp --icmp-type 0 -j ACCEPT

8）对报文状态作匹配，开放会话状态为ESTABLISHED的连接

[[email protected] ~]# iptables -I INPUT -d 192.168.4.119 -m state --state ESTABLISHED -j ACCEPT
[[email protected] ~]# iptables -I OUTPUT -s 192.168.4.119 -m state --state ESTABLISHED -j ACCEPT

9）对ftp服务作会话追踪：

# 加载ftp追踪模块
[[email protected] data]# modprobe nf_conntrack_ftp
[[email protected] data]# lsmod | grep ftp
nf_conntrack_ftp       18638  0 
nf_conntrack          105745  8 nf_nat,nf_nat_ipv4,nf_nat_ipv6,xt_conntrack,nf_nat_masquerade_ipv4,nf_conntrack_ftp,nf_conntrack_ipv4,nf_conntrack_ipv6
# 卸载模块：rmmod nf_conntrack_ftp
# 添加iptables rules
[[email protected] data]# iptables -I INPUT -d 192.168.4.119 -p tcp --dport 21 -m state --state NEW -j ACCEPT
[[email protected] data]# iptables -I INPUT -d 192.168.4.119 -m state --state ESTABLISHED,RELATED -j ACCEPT
[[email protected] data]# iptables -I OUTPUT -s 192.168.4.119 -m state --state ESTABLISHED -j ACCEPT
[[email protected] data]# cat /proc/net/nf_conntrack
ipv4     2 tcp      6 431995 ESTABLISHED src=192.168.4.116 dst=192.168.4.119 sport=57103 dport=21 ...

10）将对80端口的访问重定向到8080端口：

[[email protected] ~]# iptables -t nat -I PREROUTING -d 192.168.4.119 -p tcp --dport 80 -j REDIRECT --to-port 8080
[[email protected] ~]# iptables -I INPUT -d 192.168.4.119 -p tcp --dport 8080 -j ACCEPT
[[email protected] ~]# iptables -I OUTPUT -s 192.168.4.119 -p tcp -m multiport --sports 80,8080 -j ACCEPT

以上就是：iptables应用 的全部内容。

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/sanxing/article-139976-1.html