Linux防火墙之-iptables详解(2)

Linux防火墙之-iptables详解

设置防火墙默认拒绝: 设置默认拒绝规则,把 INPUT 链设置为默认拒绝,也就是拒绝所有连接请求.

[root@localhost ~]# iptables -P INPUT DROP
[root@localhost ~]# iptables -L -n --line-numbers
Chain INPUT (policy DROP)       #这里可以看出INPUT链已变成DROP
num  target     prot opt source               destination         
Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

开启防火墙ICMP回显: 在默认规则拒绝的情况下,设置开启ICMP测试,允许主机ping通.

[root@localhost ~]# iptables -I INPUT -p icmp -j ACCEPT
[root@localhost ~]# iptables -L -n --line-numbers
Chain INPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

允许客户SSH远程连接: 在默认拒绝的情况下,设置开启22号端口,允许远程ssh连接到本机.

[root@localhost ~]# iptables -I INPUT -p tcp --dport 22 -j ACCEPT
[root@localhost ~]# iptables -I OUTPUT -p tcp --sport 22 -j ACCEPT
[root@localhost ~]# iptables -L -n --line-numbers
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22
Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp spt:22

删除指定规则: 在默认拒绝的情况下,删除INPUT链,第2条数据,删除ICMP规则.

[root@localhost ~]# iptables -L -n --line-numbers
Chain INPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
[root@localhost ~]# iptables -D INPUT 2
[root@localhost ~]# iptables -L -n --line-numbers
Chain INPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22

指定允许网段访问: 在默认拒绝的情况下,设置只允许192.168.1.0/24网段的主机访问本机的22号端口.

[root@localhost ~]# iptables -I INPUT -s 192.168.1.0/24 -p tcp --dport 22 -j ACCEPT
[root@localhost ~]# iptables -I OUTPUT -s 192.168.1.0/24 -p tcp --sport 22 -j ACCEPT
[root@localhost ~]# iptables -L -n --line-numbers
Chain INPUT (policy DROP)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  192.168.1.0/24       0.0.0.0/0            tcp dpt:22
Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  192.168.1.0/24       0.0.0.0/0            tcp spt:22