iptables工作常用操作
阿新 • • 發佈：2019-03-02
3.1 forward 不同 target 自己的 quit sysconfig eas systemctl
正確的設置iptables命令匯總
iptables -P INPUT ACCEPT iptables -F iptables -X iptables -Z iptables -I INPUT -p tcp --dport 22 -j ACCEPT iptables -I INPUT -p tcp --dport 8080 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -j DROP
顯示如下，其中lo口的再source列顯示成為了0.0.0.0/0 剛開始以為放行了所有IP呢，實際測試是lo口。正常工作
[root@cenos ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED [root@cenos ~]#
前面添加允許的規則，最後追加一條規則拒絕其它所有的，無論什麽協議的
鏈規則默認是ACCEPT，不推薦改成DROP，後面最後會演示隱患
關於上面的一些問題匯總
剛開始把lo口放行的改成了如下
iptables -A INPUT -s 127.0.0.1/8 -j ACCEPT
這樣的話自己去連自己只能通過127.0.0.1去連接了。經過自己的IPV4連接出現不通的情況。如下測試
[root@linux-node1 ~]# telnet 192.168.56.11 9292 Trying 192.168.56.11... ^C [root@linux-node1 ~]# telnet 127.0.0.1 9292 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is ‘^]‘. ^] telnet> quit Connection closed. [root@linux-node1 ~]#
如果再添加一條命令,也能正常工作了。但是每次針對不同的主機都要修改源地址。覺得麻煩了
iptables -I INPUT -s 192.168.56.11/32 -j ACCEPT
測試如下
[root@linux-node1 ~]# iptables -I INPUT -s 192.168.56.11/32 -j ACCEPT [root@linux-node1 ~]# telnet 192.168.56.11 9292 Trying 192.168.56.11... Connected to 192.168.56.11. Escape character is ‘^]‘. ^C^] telnet> quit Connection closed. [root@linux-node1 ~]#
放行自己出去的包回來命令解釋
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
測試正常添加，ping百度可以返回
[root@linux-node1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@linux-node1 ~]# iptables -I INPUT -p tcp --dport 22 -j ACCEPT [root@linux-node1 ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@linux-node1 ~]# iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@linux-node1 ~]# iptables -A INPUT -j DROP [root@linux-node1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED [root@linux-node1 ~]# ##ping 百度測試下 [root@linux-node1 ~]# ping baidu.com -c 3 PING baidu.com (123.125.115.110) 56(84) bytes of data. 64 bytes from 123.125.115.110 (123.125.115.110): icmp_seq=1 ttl=128 time=37.9 ms 64 bytes from 123.125.115.110 (123.125.115.110): icmp_seq=2 ttl=128 time=35.9 ms 64 bytes from 123.125.115.110 (123.125.115.110): icmp_seq=3 ttl=128 time=35.8 ms --- baidu.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 35.852/36.593/37.967/0.972 ms [root@linux-node1 ~]#
測試錯誤添加方式
註意這個命令要在最終的drop之前
[root@linux-node1 ~]# iptables -F [root@linux-node1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@linux-node1 ~]# iptables -I INPUT -p tcp --dport 22 -j ACCEPT [root@linux-node1 ~]# iptables -A INPUT -j DROP [root@linux-node1 ~]# iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@linux-node1 ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@linux-node1 ~]# ping baidu.com -c 3 ping: baidu.com: Name or service not known [root@linux-node1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED [root@linux-node1 ~]# 所以 註意這個命令要在最終的drop之前
禁止別人ping自己，ACCEPT就允許了
禁止ping [root@data-1-1 ~]# iptables -A INPUT -p icmp --icmp-type 8 -j DROP [root@data-1-1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination DROP icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@data-1-1 ~]# 測試別的機器無法ping通它 [root@linux-node1 ~]# ping 10.0.2.11 -c 3 PING 10.0.2.11 (10.0.2.11) 56(84) bytes of data. --- 10.0.2.11 ping statistics --- 3 packets transmitted, 0 received, 100% packet loss, time 2000ms [root@linux-node1 ~]#
註意iptables -I 和iptables -A是有區別的
-A和-I參數分別為添加到規則末尾和規則最前面
看到有些人使用-P改了默認的鏈的規則。我極其不推薦
比如下面方式、最後把鏈默認的改成了DROP方式
iptables -P INPUT ACCEPT iptables -F iptables -X iptables -Z iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP
我來演示下隱患
後期如果調整iptables時不小心執行了iptables -F時機器就無法連接了
xshell連接不上機器了
就是因為防火墻的INPUT 鏈默認被改成了DROP的規則
我執行iptables -F 清除了所有規則，也就無法連接22端口了
通過控制臺登錄查看下
修復問題
[root@linux-node1 ~]# iptables -P FORWARD ACCEPT [root@linux-node1 ~]# iptables -P INPUT ACCEPT
補充部分2
centos最小化安裝默認沒iptables。當執行下面命令如下提示
[root@linux-node1 ~]# service iptables save The service command supports only basic LSB actions (start, stop, restart, try-restart, reload, force-reload, status). For other actions, please try to use systemctl. [root@linux-node1 ~]# systemctl restart iptables.service Failed to restart iptables.service: Unit not found.
需要安裝iptables-services
yum install iptables-services iptables-services 和 iptables 是不一樣的 安裝了 services才有/etc/sysconfig/iptables
iptables工作常用操作