{"id":190,"date":"2015-11-08T06:51:01","date_gmt":"2015-11-07T22:51:01","guid":{"rendered":"http:\/\/www.lixiaodong.com\/?p=190"},"modified":"2025-03-06T11:04:57","modified_gmt":"2025-03-06T03:04:57","slug":"iptables%e7%9a%84%e4%bd%bf%e7%94%a8","status":"publish","type":"post","link":"https:\/\/www.lixiaodong.com\/?p=190","title":{"rendered":"iptables\u7684\u4f7f\u7528"},"content":{"rendered":"

\"iptables\"<\/a>
\n\u5982\u4e0a\u56fe\u6240\u793a\uff0ciptables\u4f1a\u68c0\u67e5\u8bbe\u5b9a\u7684\u89c4\u5219\uff0c\u5982\u679c\u6ee1\u8db3\u6761\u4ef6\u5219\u6267\u884c\u5bf9\u5e94\u7684action\uff0c\u5982\u679c\u6240\u6709\u89c4\u5219\u90fd\u4e0d\u6ee1\u8db3\uff0c\u5219\u4f1a\u6267\u884c\u9ed8\u8ba4policy\u3002\u53ef\u80fd\u7684policy\u6709\uff1aaccept, drop, reject\u3002
\n\u53ea\u6240\u4ee5\u53ebiptables\uff0c\u662f\u56e0\u4e3a\u5728\u8fd9\u4e2a\u9632\u706b\u5899\u7684\u94fe\u8def\uff08chain\uff09\u91cc\u4f1a\u6d89\u53ca\u5f88\u591atables\uff0c\u5e38\u7528\u7684\u6709filter\uff0cnat\u3002\u5982\u679c\u53ea\u9488\u5bf9\u672c\u673a\u8bbe\u5b9a\u9632\u706b\u5899\uff0c\u4e00\u822c\u53ea\u6d89\u53cafilter\u3002
\n\u901a\u8fc7\u5bf9filter\u8bbe\u7f6e\u4e00\u7cfb\u5217\u89c4\u5219\uff0c\u53ef\u4ee5\u8fbe\u5230\u5bf9\u8fdb\u51fa\u7684\u5305\u8fdb\u884c\u9650\u5236\u7684\u76ee\u7684\uff0c\u6bd4\u5982drop\u6216reject\u6765\u81ea\u67d0\u4e2aip\u7684\u5305\uff0c\u8fd8\u53ef\u4ee5\u518d\u8fdb\u4e00\u6b65\uff0cdrop\u6216reject\u76ee\u6807\u662f\u672c\u673a\u67d0\u4e2a\u7aef\u53e3\u7684\u5305\u3002
\n\uff081\uff09\u67e5\u770b\u73b0\u6709iptables\u8bbe\u7f6e\uff1aiptables -L -n<\/strong>
\n-n\u7684\u610f\u601d\u662f\u4e0d\u8981\u8fdb\u884c\u53cd\u67e5\uff0c\u5982\u679c\u4e0d\u52a0\u5219\u4f1a\u5217\u51fa\u7aef\u53e3\u5bf9\u5e94\u7684\u670d\u52a1
\n\u7ed3\u679c\uff1a
\nChain INPUT (policy ACCEPT)
\ntarget prot opt source destination<\/p>\n

Chain FORWARD (policy ACCEPT)
\ntarget prot opt source destination<\/p>\n

Chain OUTPUT (policy ACCEPT)
\ntarget prot opt source destination
\n\u4e0a\u9762\u663e\u793a\u76ee\u524d\u8fd8\u6ca1\u6709\u8bbe\u5b9a\u89c4\u5219\uff0c3\u6761\u662f\u9ed8\u8ba4policy\uff0c\u5206\u522b\u9488\u5bf9input\uff08\u8fdb\u5165\u672c\u673a\u7684\u5305\uff09\uff0cforward\uff0coutput\uff08\u4ece\u672c\u673a\u51fa\u53bb\u7684\u5305\uff09\u3002\u5982\u679c\u53ea\u9488\u5bf9\u672c\u673a\uff0c\u4e00\u822c\u53ea\u5e38\u7528input\u548coutput\u3002
\n\uff082\uff09\u6e05\u9664\u73b0\u6709\u89c4\u5219
\niptables -F
\n\u4f1a\u6e05\u9664\u6389\u6240\u6709\u89c4\u5219\uff0c\u4f46\u9ed8\u8ba4policy\u4e0d\u4f1a\u53d8\u3002
\n\u6e05\u9664\u89c4\u5219\u524d\u8981\u7279\u522b\u6ce8\u610f\uff0c\u5fc5\u987b\u67e5\u6e05\u695a\u76ee\u524d\u7684\u9ed8\u8ba4policy\u3002\u6bd4\u5982\uff0c\u5982\u679cINPUT\u7684\u9ed8\u8ba4policy\u662fdrop\u6216reject\uff0c\u90a3\u4e48\u6e05\u9664\u540e\u5c06\u65e0\u6cd5\u8fdc\u7a0b\u8fde\u63a5\u8fd9\u53f0\u673a\u5668\uff01\u6240\u4ee5\u8fd9\u65f6\u5019\u5fc5\u987b\u5148\u5c06INPUT\u7684\u9ed8\u8ba4policy\u6539\u6210ACCEPT\uff0c\u518d\u505a\u6e05\u9664\u64cd\u4f5c\u3002
\n\uff083\uff09\u8bbe\u5b9a\u9ed8\u8ba4policy
\n\u8bed\u6cd5\uff1aiptables -P [INPUT, OUTPUT, FORWARD] [ACCEPT, DROP]
\n\u4f8b\u5982\uff0c\u5c06INPUT\u9ed8\u8ba4policy\u6539\u6210drop\uff1aiptables -P INPUT DROP
\n\uff084\uff09\u8bbe\u7f6e\u89c4\u5219
\n\u8bed\u6cd5\uff1aiptables -AI [INPUT, OUTPUT, FORWARD] -i [lo, eth0, eth1] -o [lo, eth0, eth1] -p [tcp, udp, icmp, all] -s \u6765\u6e90IP -d \u76ee\u6807ip –dport \u76ee\u6807\u7aef\u53e3 –sport \u6765\u6e90\u7aef\u53e3 -j [ACCEPT, REJECT, DROP]
\n-A\u8868\u793a\u5728\u73b0\u6709\u7684\u89c4\u5219\u540e\u6dfb\u52a0\u4e00\u6761\u65b0\u7684\uff0c\u5047\u5982\u73b0\u5728\u67094\u6761\u89c4\u5219\uff0c\u90a3\u4e48\u65b0\u7684\u4e00\u6761\u5c06\u4f1a\u662f\u7b2c5\u6761
\n-I\u8868\u793a\u63d2\u5165\u4e00\u6761\u89c4\u5219\u5728\u6700\u524d\u9762\uff0c\u5047\u5982\u73b0\u5728\u67094\u6761\u89c4\u5219\uff0c\u90a3\u4e48\u65b0\u7684\u4e00\u6761\u5c06\u4f1a\u662f\u7b2c1\u6761\uff0c\u539f\u6765\u76844\u6761\u53d8\u6210\u73b0\u5728\u7684\u7b2c2-5\u6761
\n\u6765\u6e90ip\u548c\u76ee\u6807ip\u53ef\u4ee5\u662f\u5355\u4e2aip\uff08\u5982192.168.1.1\uff09\uff0c\u4e5f\u53ef\u4ee5\u662f\u5b50\u7f51\uff08\u5982192.168.1.1\/24\uff09
\n\u5982\u679c\u4f7f\u7528–dport \u6216 –sport\uff0c\u5fc5\u987b\u8981\u6709-p\u53c2\u6570\uff0c\u4e14\u5fc5\u987b\u662ftcp\u6216udp\u3002
\n\u4f8b\u5982\uff0creject\u6240\u6709\u6765\u81ea192.168.1.1\u7684TCP\u5305\uff1a iptables -A INPUT -p tcp -s 192.168.1.1 -j REJECT
\n\uff085\uff09\u89c4\u5219\u7684\u987a\u5e8f
\n\u89c4\u5219\u987a\u5e8f\u975e\u5e38\u91cd\u8981\u3002\u56e0\u4e3aiptables\u4f1a\u6309\u7167\u987a\u5e8f\u68c0\u67e5\u89c4\u5219\uff0c\u5982\u679c\u987a\u5e8f\u4e0d\u5f53\uff0c\u4f1a\u9020\u6210\u610f\u5916\u7684\u7ed3\u679c\u3002
\n\u6bd4\u5982: \u6211\u768480\u7aef\u53e3\u53ea\u60f3\u63a5\u6536\u6765\u81ea192.168.1.1\u7684tcp\u5305\uff0c\u4e0d\u63a5\u6536192.168.1.1\/24\u5b50\u7f51\u91cc\u7684\u5176\u5b83\u673a\u5668\u7684tcp\u5305\uff0c\u6765\u81ea\u5176\u4f59\u673a\u5668\u7684\u8bf7\u6c42\u90fd\u63a5\u6536\u3002
\n\u5047\u5982INPUT\u7684\u9ed8\u8ba4\u89c4\u5219\u662fACCEPT\u3002
\n\u6b63\u786e\u7684\u89c4\u5219\u987a\u5e8f\u662f\uff1a
\niptables -A INPUT -p tcp -s 192.168.1.1 -j ACCEPT
\niptables -A INPUT -p tcp -s 192.168.1.1\/24 -j REJECT
\n\u5982\u679c\u5c06\u4ee5\u4e0a2\u6761\u89c4\u5219\u98a0\u5012\uff0c\u5047\u8bbe192.168.1.1\u7ed9\u6211\u768480\u7aef\u53e3\u53d11\u4e2atcp\u5305\uff0c\u7531\u4e8e\u6ee1\u8db3\u98a0\u5012\u540e\u7684\u7b2c1\u6761\u89c4\u5219\uff0c\u5b83\u88abreject\u6389\uff0c\u8ddf\u671f\u671b\u4e0d\u7b26\u3002
\n\uff086\uff09\u4fdd\u5b58
\n\u5982\u679c\u4e0d\u4fdd\u5b58\uff0c\u673a\u5668\u91cd\u542f\u540e\u89c4\u5219\u4f1a\u6d88\u5931\u3002
\n\u5728ubuntu\u4e0b\u4f7f\u7528iptables-persistent\u6765\u4fdd\u5b58\u3002
\n\u5b89\u88c5\uff1asudo apt-get install iptables-persistent
\n\u7f16\u8f91\u5b8c\u89c4\u5219\u540e\u4fdd\u5b58\u89c4\u5219\uff1asudo dpkg-reconfigure iptables-persistent<\/p>\n","protected":false},"excerpt":{"rendered":"

\u5982\u4e0a\u56fe\u6240\u793a\uff0ciptables\u4f1a\u68c0\u67e5\u8bbe\u5b9a\u7684\u89c4\u5219\uff0c\u5982\u679c\u6ee1\u8db3\u6761\u4ef6\u5219\u6267\u884c\u5bf9\u5e94\u7684actio … \u7ee7\u7eed\u9605\u8bfb →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[31],"tags":[],"class_list":["post-190","post","type-post","status-publish","format-standard","hentry","category-linux-2"],"_links":{"self":[{"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=\/wp\/v2\/posts\/190","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=190"}],"version-history":[{"count":8,"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=\/wp\/v2\/posts\/190\/revisions"}],"predecessor-version":[{"id":217,"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=\/wp\/v2\/posts\/190\/revisions\/217"}],"wp:attachment":[{"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=190"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=190"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lixiaodong.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=190"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}