linux中防火牆策略管理工具iptables

阿新 • • 發佈：2020-12-21

防火牆：內網和外網之間過濾流量的服務

1、iptables常用的命令引數

2、檢視已有的防火牆規則鏈

[root@PC1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
INPUT_direct  all   
--  anywhere             anywhere            
INPUT_ZONES_SOURCE  all  --  anywhere             anywhere            
INPUT_ZONES  all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all   
--  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
FORWARD_direct  all  --  anywhere             anywhere            
FORWARD_IN_ZONES_SOURCE  all  --  anywhere             anywhere            
FORWARD_IN_ZONES  all   
--  anywhere             anywhere            
FORWARD_OUT_ZONES_SOURCE  all  --  anywhere             anywhere            
FORWARD_OUT_ZONES  all  --  anywhere             anywhere            
ACCEPT     icmp --  anywhere             anywhere            
REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
OUTPUT_direct  all  --  anywhere             anywhere            

Chain FORWARD_IN_ZONES (1 references)
target     prot opt source               destination         
FWDI_public  all  --  anywhere             anywhere            [goto] 
FWDI_public  all  --  anywhere             anywhere            [goto] 

Chain FORWARD_IN_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (1 references)
target     prot opt source               destination         
FWDO_public  all  --  anywhere             anywhere            [goto] 
FWDO_public  all  --  anywhere             anywhere            [goto] 

Chain FORWARD_OUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain FORWARD_direct (1 references)
target     prot opt source               destination         

Chain FWDI_public (2 references)
target     prot opt source               destination         
FWDI_public_log  all  --  anywhere             anywhere            
FWDI_public_deny  all  --  anywhere             anywhere            
FWDI_public_allow  all  --  anywhere             anywhere            

Chain FWDI_public_allow (1 references)
target     prot opt source               destination         

Chain FWDI_public_deny (1 references)
target     prot opt source               destination         

Chain FWDI_public_log (1 references)
target     prot opt source               destination         

Chain FWDO_public (2 references)
target     prot opt source               destination         
FWDO_public_log  all  --  anywhere             anywhere            
FWDO_public_deny  all  --  anywhere             anywhere            
FWDO_public_allow  all  --  anywhere             anywhere            

Chain FWDO_public_allow (1 references)
target     prot opt source               destination         

Chain FWDO_public_deny (1 references)
target     prot opt source               destination         

Chain FWDO_public_log (1 references)
target     prot opt source               destination         

Chain INPUT_ZONES (1 references)
target     prot opt source               destination         
IN_public  all  --  anywhere             anywhere            [goto] 
IN_public  all  --  anywhere             anywhere            [goto] 

Chain INPUT_ZONES_SOURCE (1 references)
target     prot opt source               destination         

Chain INPUT_direct (1 references)
target     prot opt source               destination         

Chain IN_public (2 references)
target     prot opt source               destination         
IN_public_log  all  --  anywhere             anywhere            
IN_public_deny  all  --  anywhere             anywhere            
IN_public_allow  all  --  anywhere             anywhere            

Chain IN_public_allow (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh ctstate NEW

Chain IN_public_deny (1 references)
target     prot opt source               destination         

Chain IN_public_log (1 references)
target     prot opt source               destination         

Chain OUTPUT_direct (1 references)
target     prot opt source               destination

3、清空已有的防火牆策略規則鏈

[root@PC1 ~]# iptables -F
[root@PC1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination

4、將INPUT規則鏈設定為拒絕

[root@PC1 ~]# iptables -L | head
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
[root@PC1 ~]# iptables -P INPUT DROP  ## （防火牆預設的拒絕動作只能是DROP，而不能填寫REJECT）
[root@PC1 ~]# iptables -L | head
Chain INPUT (policy DROP)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)

5、向INPUT規則鏈中新增允許ICMP流量的策略規則

[root@PC1 ~]# ifconfig | head -n 3     
eno16777728: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.10.10  netmask 255.255.255.0  broadcast 192.168.10.255
        inet6 fe80::20c:29ff:fe66:37f7  prefixlen 64  scopeid 0x20<link>
[root@PC1 ~]# ping -c 3 192.168.10.10
PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data.

--- 192.168.10.10 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 1999ms
## 以上部分為測試，ping命令的服務屬於icmp，當前不能執行ping命令，說明沒有開通icmp流量

[root@PC1 ~]# iptables -L   ## 列出當前的規則鏈
Chain INPUT (policy DROP)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination

[root@PC1 ~]# iptables -I INPUT -p icmp -j ACCEPT   ## 設定允許icmp流量

[root@PC1 ~]# ping -c 3 192.168.10.10
PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data.
64 bytes from 192.168.10.10: icmp_seq=1 ttl=64 time=0.031 ms
64 bytes from 192.168.10.10: icmp_seq=2 ttl=64 time=0.033 ms
64 bytes from 192.168.10.10: icmp_seq=3 ttl=64 time=0.043 ms

--- 192.168.10.10 ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 1999ms
rtt min/avg/max/mdev = 0.031/0.035/0.043/0.008 ms

[root@PC1 ~]# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     icmp --  anywhere             anywhere            

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination

6、刪除icmp流量的允許策略

[root@PC1 ~]# iptables -D INPUT 1
[root@PC1 ~]# ping -c 3 192.168.10.10
PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data.

--- 192.168.10.10 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2000ms

[root@PC1 ~]# iptables -L
Chain INPUT (policy DROP)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination

7、將預設的允許規則設定為允許

[root@PC1 ~]# iptables -P INPUT ACCEPT
[root@PC1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination

8、將INPUT規則鏈設定為只允許指定網段的主機訪問本機的22埠，拒絕其他所有主機的流量

[root@PC1 ~]# iptables -I INPUT -s 192.168.20.0/24 -p tcp --dport 22 -j ACCEPT
[root@PC1 ~]# iptables -A INPUT -p tcp --dport 22 -j REJECT
[root@PC1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  192.168.20.0/24      anywhere             tcp dpt:ssh
REJECT     tcp  --  anywhere             anywhere             tcp dpt:ssh reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination

[root@PC2 ~]# ifconfig | head -n 3
eno16777728: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.10.20  netmask 255.255.255.0  broadcast 192.168.10.255
        inet6 fe80::20c:29ff:fe25:bb3e  prefixlen 64  scopeid 0x20<link>
[root@PC2 ~]# ssh 192.168.10.10
ssh: connect to host 192.168.10.10 port 22: Connection refused

9、向INPUT規則鏈中新增拒絕所有人訪問本機12345埠的策略規則

[root@PC1 ~]# iptables -I INPUT -p tcp --dport 12345 -j REJECT
[root@PC1 ~]# iptables -I INPUT -p udp --dport 12345 -j REJECT
[root@PC1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     udp  --  anywhere             anywhere             udp dpt:italk reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             tcp dpt:italk reject-with icmp-port-unreachable
ACCEPT     tcp  --  192.168.20.0/24      anywhere             tcp dpt:ssh
REJECT     tcp  --  anywhere             anywhere             tcp dpt:ssh reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination

10、向INPUT規則鏈中新增拒絕192.168.10.5主機訪問本機80埠（web服務）的策略規則

[root@PC1 ~]# iptables -I INPUT -p tcp -s 192.168.10.5 --dport 80 -j REJECT
[root@PC1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     tcp  --  192.168.10.5         anywhere             tcp dpt:http reject-with icmp-port-unreachable
REJECT     udp  --  anywhere             anywhere             udp dpt:italk reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             tcp dpt:italk reject-with icmp-port-unreachable
ACCEPT     tcp  --  192.168.20.0/24      anywhere             tcp dpt:ssh
REJECT     tcp  --  anywhere             anywhere             tcp dpt:ssh reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination

11、向INPUT規則鏈中新增拒絕所有主機訪問本機1000~1024埠的策略規則

[root@PC1 ~]# iptables -I INPUT -p tcp --dport 1000:1024 -j REJECT
[root@PC1 ~]# iptables -I INPUT -p udp --dport 1000:1024 -j REJECT
[root@PC1 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
REJECT     udp  --  anywhere             anywhere             udp dpts:cadlock2:1024 reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             tcp dpts:cadlock2:1024 reject-with icmp-port-unreachable
REJECT     tcp  --  192.168.10.5         anywhere             tcp dpt:http reject-with icmp-port-unreachable
REJECT     udp  --  anywhere             anywhere             udp dpt:italk reject-with icmp-port-unreachable
REJECT     tcp  --  anywhere             anywhere             tcp dpt:italk reject-with icmp-port-unreachable
ACCEPT     tcp  --  192.168.20.0/24      anywhere             tcp dpt:ssh
REJECT     tcp  --  anywhere             anywhere             tcp dpt:ssh reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_IN_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES (0 references)
target     prot opt source               destination         

Chain FORWARD_OUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain FORWARD_direct (0 references)
target     prot opt source               destination         

Chain FWDI_public (0 references)
target     prot opt source               destination         

Chain FWDI_public_allow (0 references)
target     prot opt source               destination         

Chain FWDI_public_deny (0 references)
target     prot opt source               destination         

Chain FWDI_public_log (0 references)
target     prot opt source               destination         

Chain FWDO_public (0 references)
target     prot opt source               destination         

Chain FWDO_public_allow (0 references)
target     prot opt source               destination         

Chain FWDO_public_deny (0 references)
target     prot opt source               destination         

Chain FWDO_public_log (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES (0 references)
target     prot opt source               destination         

Chain INPUT_ZONES_SOURCE (0 references)
target     prot opt source               destination         

Chain INPUT_direct (0 references)
target     prot opt source               destination         

Chain IN_public (0 references)
target     prot opt source               destination         

Chain IN_public_allow (0 references)
target     prot opt source               destination         

Chain IN_public_deny (0 references)
target     prot opt source               destination         

Chain IN_public_log (0 references)
target     prot opt source               destination         

Chain OUTPUT_direct (0 references)
target     prot opt source               destination

12、儲存所有的設定，使其開機後依然生效

[root@PC1 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

linux中防火牆策略管理工具iptables

防火牆：內網和外網之間過濾流量的服務 1、iptables常用的命令引數 2、檢視已有的防火牆規則鏈

linux中防火牆策略管理工具firewalld

firewalld擁有命令列介面（CLI）和圖形使用者介面（GUI） firewalld中有區域的概念，區域就是防火牆配置策略的模板。

Linux系統防火牆模組SELinux及其安全策略管理工具iptables/firewalld命令教程

為什麼要介紹Linux系統的防火牆安全模組呢？一個很直接的原因就是很多小夥伴搭建好扶牆服務之後，卻無法正常上網，回頭檢查各項操作都沒有問題，這時候卻被搞得焦頭爛額、一頭霧水。其實，一般都是由於Linux系統防火

Linux--firewalld防火牆字元管理工具

一、firewalld防火牆維護和狀態查詢命令 1.1firewalld防火牆維護命令防火牆程序操作

linux系統中防火牆管理工具iptables

1、iptables是什麼防火牆：內網與公網之間、主機之間的保護屏障，依據防火牆策略對流量進行過濾。

node.js中npm包管理工具用法分析

本文例項講述了node.js中npm包管理工具用法。分享給大家供大家參考，具體如下：

第十四章 Linux中rwx許可權管理

許可權管理許可權的基本管理什麼是許可權許可權就是系統對我們使用者所做的操作的一種限制為什麼要有許可權給系統操作使用者的許可權做一個拓展和規定許可權的分類 [root@lxy ~]# ll-rw-r--r--. 1 root root2

Linux中lvm磁碟管理以及lvm擴容

目錄LVM簡介LVM基本術語lvm 建立擴容當前分割槽1、首先建立一塊新的分割槽：2、建立PV，擴容VG，LV

Linux中防火牆的四表五鏈以及三次握手四次揮手

三次握手四次揮手三次握手 1.第一次握手：建立連線時，客戶端傳送syn包（syn=j）到伺服器，並進入SYN_SENT狀態，等待伺服器確認；SYN：同步序列編號（Synchronize Sequence Numbers）。

NVM Linux Windows nodejs 版本管理工具

nodejs 版本管理工具 nodejs 歷史版本 nvm 在 Windows 安裝直達：下載 setup.zip 解壓直接安裝

『學了就忘』Linux系統管理 — 84、Linux中程序的管理

目錄1、Linux系統中的訊號2、殺掉程序的命令（1）kill命令（2）killall命令（3）pkill命令

Linux剪貼簿的管理工具

Clipman是面向基於XFCE的XFCE使用者的輕量級剪貼簿外掛選項：XFCE：您的輕量，快速，全功能的Linux桌面XFCE：您的輕量，快速，全功能的Linux桌面就Linux而言，自定義是最重要的。不僅如此，自定義選項還很棒，可能會

Linux 多版本軟體管理工具update-alternatives

Linux 多版本軟體管理工具update-alternatives 簡介 update-alternatives 命令用於處理linux系統中軟體版本的切換（可以管理任意軟體的多個版本，比如Python、JDK等），在各個linux發行版中均提供了該命令，命令引數

linux系統程序檢視管理工具

init----sysv init；upstart；systemd，所以在不同的Linux發行版上看到的程序數量是不同的

Linux中的防火牆netfilter/iptables簡介

一、Linux防火牆基礎 1.1 ptables的表、鏈結構 1.1.1 Linux包過濾防火牆概述 Inetfilter 位於Linux核心中的包過濾功能體系稱為Linux防火牆的\"核心態\"iptables

Linux中的防火牆netfilter iptables 簡介

一、Linux防火牆基礎 1.1 ptables的表、鏈結構 1.1.1 Linux包過濾防火牆概述 netfilter 位於Linux核心中的包過濾功能體系

Linux中Iptables防火牆的使用

Linux中Iptables防火牆的使用 Iptables的使用 Iptables動作 Iptables基本的條件匹配 -s源地址、-d目標地址

Linux中的防火牆

firewalld 一、防火牆安全概述 firewalld支援命令列也支援GUI設定，相對於iptables，firewalld配置更加的方便。在底層的命令都是iptables，

第十二章 Linux中使用者管理命令

使用者管理使用者的基本概述 # 什麼是使用者？能正常登陸系統的就是使用者linux是支援多使用者同時登陸的系統中有很多程序需要不同的使用者進行管理[root@lxy ~]# id#顯示當前登入的使用者資訊uid=0(root) gid=0(

Linux中使用者和組管理

一、使用者分類 1、管理員和普通使用者 1️⃣：管理員 ——使用者ID：0

linux中防火牆策略管理工具iptables

相關推薦