1.1 四表应用顺序由上至下raw对连接做追踪mangle对数据包做修改如给数据包打标记nat 修改数据包地址filter对数据包过滤1.2 五链INPUT针对目标地址OUTPUT针对源地址FORWARD穿过防火墙PREROUTING路由前过滤POSTROUTING路由后过滤1.3 四表五链的关系表支持的链rawPREROUTING、OUTPUTmanglePREROUTING、POSTROUTING、INPUT、OUTPUT、FORWARDnatPREROUTING、POSTROUTING、OUTPUTfIlterINPUT、OUTPUT、FORWARD1.4 使用流程image.png1.1 语法iptables[-t 要操作的表]操作命令[要操作的链][规则号码][匹配条件][-j 匹配后的动作]# 小写 大写 大写 小写 大写1.2 常用操作命令-L查看,v详细,n不反解-A追加放置最后一条-I插入默认插入成第一条第一条生效后不会考虑后边规则-D删除-F清空flush-X删除空的自定义链-P设置默认策略-Z计数器归零-N建立自定义链1.3 基本匹配条件-s 192.168.2.0/24源地址-d 192.168.2.1目标地址-p tcp|upd|icmp协议-i eth0input 从eth0接口进入的数据包-o eth0output 从eth0出去的数据包-p tcp --sport 80源端口是80的数据包-p tcp --dport 80目标端口是801.4 基本动作filter表-j ACCEPT接受-j REJECT拒绝-j DROP丢弃-j LOG记录日志DROP和REJECT的区别REJECT直接拒绝链接和客户端断开。更适合可控网络。DROP丢弃——意味着不予回复客户端只能等超时。更适合服务器安全和面对攻击。nat表-j SNAT源地址转换-j DNAT目标地址转换-j MASQUERADE伪装-j REDIRECT端口转换mangle表-j MARK标记1.5 常用命令示例- 设置默认值设置默认值禁止所有穿过防火墙- 禁止80端口访问iptables-IINPUT-ptcp--dport80-jDROP- 查看防火墙规则默认查看nat表查看fileter表查看防火墙规则编号iptables-nL--line-number- 保存规则命令规则保存位置该命令会把防火墙规则保存在/etc/sysconfig/iptables文件中[rootliubei-02 ~]# cat /etc/sysconfig/iptables# Generated by iptables-save v1.4.21 on Tue Jan 10 16:06:09 2023*mangle :PREROUTING ACCEPT[31154:2463094]:INPUT ACCEPT[10892:1355724]:FORWARD ACCEPT[0:0]:OUTPUT ACCEPT[15203:10068473]:POSTROUTING ACCEPT[15203:10068473]COMMIT# Completed on Tue Jan 10 16:06:09 2023# Generated by iptables-save v1.4.21 on Tue Jan 10 16:06:09 2023*raw :PREROUTING ACCEPT[31154:2463094]:OUTPUT ACCEPT[15203:10068473]COMMIT# Completed on Tue Jan 10 16:06:09 2023# Generated by iptables-save v1.4.21 on Tue Jan 10 16:06:09 2023*filter :INPUT ACCEPT[5015:664817]:FORWARD ACCEPT[0:0]:OUTPUT ACCEPT[7751:5368662]-AINPUT-ptcp-mtcp--sport80-jDROP COMMIT# Completed on Tue Jan 10 16:06:09 2023# Generated by iptables-save v1.4.21 on Tue Jan 10 16:06:09 2023*nat :PREROUTING ACCEPT[20546:1128148]:INPUT ACCEPT[235:18006]:OUTPUT ACCEPT[1055:72144]:POSTROUTING ACCEPT[1055:72144]COMMIT# Completed on Tue Jan 10 16:06:09 2023如上可见*mangle表明:INPUT ACCEPT [5015:664817]这种是默认规则-A INPUT -p tcp -m tcp --sport 80 -j DROP这种是我们在每个表下加的规则- 允许sshiptables-IINPUT-ptcp--dport22-jACCEPT- 禁止ping禁止ping其他服务器iptables-tfilter-IINPUT-picmp-micmp --icmp-type echo-reply-jREJECT或iptables-tfilter-IINPUT-picmp-micmp --icmp-type0-jREJECT禁止其他服务器ping本机iptables-tfilter-IINPUT-picmp-micmp --icmp-type echo-request-jREJECT或iptables-tfilter-IINPUT-picmp-micmp --icmp-type8-jREJECT- 删除规则N为规则编号。- 清除规则不包括默认规则- 新建自定义链- 删除空的自定义链- 端口转发访问本机100端口转发至本机80端口iptables-tnat-IPREROUTEING-ptcp--dport100-jREDIRECT --to-port803.1 创建和删除规则查看规则[rootliubei-02 ~]# iptables -LChain INPUT(policy ACCEPT)target prot optsourcedestination Chain FORWARD(policy DROP)target prot optsourcedestination Chain OUTPUT(policy ACCEPT)target prot optsourcedestination如上可见当初没有任何规则。添加一条规则iptables-IINPUT-ptcp--dport80-jDROP查看添加结果[rootliubei-02 ~]# iptables -LChain INPUT(policy ACCEPT)target prot optsourcedestination DROP tcp -- anywhere anywhere tcp dpt:http Chain FORWARD(policy DROP)target prot optsourcedestination Chain OUTPUT(policy ACCEPT)target prot optsourcedestination如上可见nat表中多了一条记录保存iptables规则[rootliubei-02 ~]# service iptables saveiptables: Saving firewall rules to /etc/sysconfig/iptables:[确定]如上可见规则保存在/etc/sysconfig/iptables中查看保存文件# Generated by iptables-save v1.4.21 on Tue Jan 10 17:22:38 2023*mangle :PREROUTING ACCEPT[1960:156458]:INPUT ACCEPT[675:88821]:FORWARD ACCEPT[0:0]:OUTPUT ACCEPT[961:649865]:POSTROUTING ACCEPT[961:649865]COMMIT# Completed on Tue Jan 10 17:22:38 2023# Generated by iptables-save v1.4.21 on Tue Jan 10 17:22:38 2023*raw :PREROUTING ACCEPT[1960:156458]:OUTPUT ACCEPT[961:649865]COMMIT# Completed on Tue Jan 10 17:22:38 2023# Generated by iptables-save v1.4.21 on Tue Jan 10 17:22:38 2023*filter :INPUT ACCEPT[312:38483]:FORWARD DROP[0:0]:OUTPUT ACCEPT[457:343983]-AINPUT-ptcp-mtcp--dport80-jDROP COMMIT# Completed on Tue Jan 10 17:22:38 2023# Generated by iptables-save v1.4.21 on Tue Jan 10 17:22:38 2023*nat :PREROUTING ACCEPT[1300:68667]:INPUT ACCEPT[15:1030]:OUTPUT ACCEPT[77:5220]:POSTROUTING ACCEPT[77:5220]COMMIT# Completed on Tue Jan 10 17:22:38 2023如上可见我们创建的规则被保存在文件中。删除一条规则先查看规则的编号[rootliubei-02 ~]# iptables -nL --line-numberChain INPUT(policy ACCEPT)num target prot optsourcedestination1DROP tcp --0.0.0.0/00.0.0.0/0 tcp dpt:80 Chain FORWARD(policy DROP)num target prot optsourcedestination Chain OUTPUT(policy ACCEPT)num target prot optsourcedestination如上可见我们刚才创建的规则是nat表INPUT链中编号为1的规则删除规则[rootliubei-02 ~]# iptables -D INPUT 1默认是nat表因此我们不用写-t nat查看删除结果[rootliubei-02 ~]# iptables -nLChain INPUT(policy ACCEPT)target prot optsourcedestination Chain FORWARD(policy DROP)target prot optsourcedestination Chain OUTPUT(policy ACCEPT)target prot optsourcedestination如上可见之前创建的规则被删除了。3.2 创建新链并应用要求使用新建的MYCHAIN创建允许80端口访问的规则为了演示效果INPUT链拒绝一切请求[rootliubei-02 ~]# iptables -I INPUT -p tcp --dport 80 -j DROP创建MYCHAIN链[rootliubei-02 ~]# iptables -N MYCHAIN目标地址是本机地址且目标端口是80端口的请求全部交给MYCHAIN链处理[rootliubei-02 ~]# iptables -I INPUT -p tcp --dport 80 -d 10.10.239.32 -j MYCHAIN设置MYCHAIN链的端口允许通过。[rootliubei-02 ~]# iptables -I MYCHAIN -p tcp --dport 80 -j ACCEPT测试一下此时80端口可以访问了。查看规则[rootliubei-02 ~]# iptables -LChain INPUT(policy ACCEPT)target prot optsourcedestination MYCHAIN tcp -- anywhere liubei-02 tcp dpt:http DROP tcp -- anywhere anywhere tcp dpt:http Chain FORWARD(policy ACCEPT)target prot optsourcedestination Chain OUTPUT(policy ACCEPT)target prot optsourcedestination Chain MYCHAIN(1references)target prot optsourcedestination ACCEPT tcp -- anywhere anywhere tcp dpt:http如上可见INPUT链中添加了一个拒绝规则添加了一条规则转发的规则多了一个MYCHAIN链下边有一条允许80端口通过规则。3.3 SNAT模式作用内网客户端访问公网环境内网路由公网clientLAN:192.168.1.1--------WAN:10.10.239.32web10.252.96249iptables-tnat-IPOSTROUTING-s10.252.96.0/24-ptcp-jSNAT--to10.10.239.32理解路由后过滤在请求出路由的时候把请求的源地址改成路由本机使得web可以返回给路由。3.3 DNAT模式作用公网访问内网环境内网路由公网web:192.168.1.110LAN:192.168.1.1WAN 10.10.239.3client添加规则iptables-tnat-IPREROUTING-d10.10.239.32-ptcp--dport80-jDNAT--to192.168.1.110理解路由前过滤请求目标是路由地址在进入路由前被修改否则将直接被路由本机接收。如果转发端口不同路由8080端口转发至内网web服务器8080端口iptables-tnat-IPREROUTING-d10.10.239.32-ptcp--dport8080-jDNAT--to192.168.1.110:803.4 FTP服务器防火墙规则iptables-AINPUT-ptcp--dport20-jACCEPT# 开放FTP主动数据端口iptables-AINPUT-ptcp--dport21-jACCEPT# 对外开放FTP控制端口iptables-AINPUT-ptcp--dport50000:60000-jACCEPT# 对外开放FTP数据端口iptables-AINPUT-jREJECT3.5 规则备份与恢复备份iptables-save/etc/iptables-script恢复iptables-restore/etc/iptables-script开机执行将恢复命令写入/etc/rc.local注意/etc/rc.local需要执行权限。