ACCEPT（允许流量通过）
REJECT（拒绝流量通过），响应拒绝信息
LOG（记录日志信息）
DROP（拒绝流量通过），直接将流量丢弃并且不响应
1 2 3 4 5 6 7 8 9 10 11 12 13 14ping -c 4 192.168.10.10 PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data. From 192.168.10.10 icmp_seq=1 Destination Port Unreachable From 192.168.10.10 icmp_seq=2 Destination Port Unreachable From 192.168.10.10 icmp_seq=3 Destination Port Unreachable From 192.168.10.10 icmp_seq=4 Destination Port Unreachable --- 192.168.10.10 ping statistics --- 4 packets transmitted, 0 received, +4 errors, 100% packet loss, time 3002ms ping -c 4 192.168.10.10 PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data. --- 192.168.10.10 ping statistics --- 4 packets transmitted, 0 received, 100% packet loss, time 3000ms
| 参数 | 作用 |
|---|---|
| -P | 设置默认策略 |
| -F | 清空规则链 |
| -L | 查看规则链 |
| -A | 在规则链的末尾加入新规则 |
| -I_num | 在规则链的头部加入新规则 |
| -D_num | 删除某一条规则 |
| -s | 匹配来源地址IP/MASK，加叹号“!”表示除这个IP外 |
| -d | 匹配目标地址 |
| -i网卡名称 | 匹配从这块网卡流入的数据 |
| -o网卡名称 | 匹配从这块网卡流出的数据 |
| -p | 匹配协议，如TCP、UDP、ICMP |
| --dport_num | 匹配目标端口号 |
| --sport_num | 匹配来源端口号 |
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere INPUT_direct all -- anywhere anywhere INPUT_ZONES_SOURCE all -- anywhere anywhere INPUT_ZONES all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere REJECT all -- anywhere anywhere reject-with icmp-host-prohibited ………………省略部分输出信息……………… iptables -F iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ………………省略部分输出信息……………… iptables -P INPUT DROP iptables -L Chain INPUT (policy DROP) target prot opt source destination …………省略部分输出信息……………… iptables -I INPUT -p icmp -j ACCEPT ping -c 4 192.168.10.10 PING 192.168.10.10 (192.168.10.10) 56(84) bytes of data. 64 bytes from 192.168.10.10: icmp_seq=1 ttl=64 time=0.156 ms 64 bytes from 192.168.10.10: icmp_seq=2 ttl=64 time=0.117 ms 64 bytes from 192.168.10.10: icmp_seq=3 ttl=64 time=0.099 ms 64 bytes from 192.168.10.10: icmp_seq=4 ttl=64 time=0.090 ms --- 192.168.10.10 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 2999ms rtt min/avg/max/mdev = 0.090/0.115/0.156/0.027 ms iptables -D INPUT 1 iptables -P INPUT ACCEPT iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ………………省略部分输出信息……………… iptables -I INPUT -s 192.168.10.0/24 -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j REJECT iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 192.168.10.0/24 anywhere tcp dpt:ssh REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable ………………省略部分输出信息……………… ssh 192.168.10.10 The authenticity of host '192.168.10.10 (192.168.10.10)' can't be established. ECDSA key fingerprint is 70:3b:5d:37:96:7b:2e:a5:28:0d:7e:dc:47:6a:fe:5c. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '192.168.10.10' (ECDSA) to the list of known hosts. root@192.168.10.10's password: 此处输入对方主机的root管理员密码 Last login: Sun Feb 12 01:50:25 2017 ssh 192.168.10.10 Connecting to 192.168.10.10:22... Could not connect to '192.168.10.10' (port 22): Connection failed. iptables -I INPUT -p tcp --dport 12345 -j REJECT iptables -I INPUT -p udp --dport 12345 -j REJECT iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable ACCEPT tcp -- 192.168.10.0/24 anywhere tcp dpt:ssh REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable ………………省略部分输出信息……………… iptables -I INPUT -p tcp -s 192.168.10.5 --dport 80 -j REJECT iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination REJECT tcp -- 192.168.10.5 anywhere tcp dpt:http reject-with icmp-port-unreachable REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable ACCEPT tcp -- 192.168.10.0/24 anywhere tcp dpt:ssh REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable ………………省略部分输出信息……………… iptables -A INPUT -p tcp --dport 1000:1024 -j REJECT iptables -A INPUT -p udp --dport 1000:1024 -j REJECT iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination REJECT tcp -- 192.168.10.5 anywhere tcp dpt:http reject-with icmp-port-unreachable REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable ACCEPT tcp -- 192.168.10.0/24 anywhere tcp dpt:ssh REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpts:cadlock2:1024 reject-with icmp-port- unreachable REJECT udp -- anywhere anywhere udp dpts:cadlock2:1024 reject-with icmp-port- unreachable ………………省略部分输出信息……………… service iptables save iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
Copyright ©2010-2022 比特日记 All Rights Reserved.