网络防火墙
iptables/netfilter
实现内网可以ping外网，外网ping不了内网，根据tcp/ip的请求报文为8，响应报文为0
定义防火墙filter表的forward链由ACCETP改为DROP
第一种方法：
iptables -P FORWARD DROP
#内网到外网的请求报文
iptables -t filter -A FORWARD -s 192.168.31.0/24 -p icmp –icmp-type 8 -j ACCEPT
#外网响应报文
tcpdump -i eth0 icmp
iptables -t filter -A FORWARD -d 192.168.31.0/24 -p icmp –icmp-type 0 -j ACCEPT
第二种方法
iptables -F FORWARD
forward的默认策略plicy仍为DROP
iptables -t filter -A FORWARD -s 192.168.31.0/24 -p icmp –icmp-type 8 -j ACCEPT
iptables -A FORWARD -m state –state ESTABLISHED - j ACCEPT
外网访问内网只能访问特定的服务httpd,ssh
iptables -F
iptables -P FORWARD DROP
systemctl install httpd
systemctl start httpd
‘’‘’‘’‘’‘’‘’‘’‘
iptables -P FORWARD DROP
#从内到外，是第一个包(NEW),就允许
iptables -A FORWARD -s 192.168.31.0/24 -m state –state NEW -j ACCEPT
#从内到外的包能够回来
iptables -A FORWARD -m state –state ESTABLISHED -j ACCEPT
#外网可以访问内网的httpd，ssh
iptables -A FORWARD -d 192.168.31.0/24 -p tcp -m multiport -dports 22,80 -m state –state NEW -j ACCEPT
外网可以访问内网的ftp服务
iptables -F
iptables -P FORWARD DROP
iptables -vnL
modprobe nf_conntrack_ftp
#相关联的端口
iptables -A FORWARD -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp –dport 21 -d 192.168.31.0/24 -m state –state NEW -j ACCEPT
内网只可以访问外网的https，ftp,http
iptables -F
iptables -P FORWARD DROP
#https安装模块
yum install mod_ssl
systemctl start httpd,vsftpd
#防火墙加模块
iptables -F
modprobe nf_conntrack_ftp
iptables -P FORWARD DROP
iptables -A FORWARD -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -p tcp -m multiport –dports 21,80,445 -s 192.168.31.0/24 -m state –state NEW -j ACCEPT
curl -k htts://172.18.0.11
curl htt://172.18.0.11
内网只可以访问外网的https，ftp,http的自定义链
iptables -F
|#自定义链起个名
iptables -N WEB
iptables -A WEB -s 192.168.31.0/24 -p tcp -m multiport –dports 21,80,445,53 -j ACCEPT
iptables -A WEB -s 192.168.31.0/24 -p udp –dport 53 -j ACCEPT
iptables -A FORWARD -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -A FORWARD -j WEB
#修改自定义链，增加mysql3306的访问
iptables -R WEB -s 192.168.31.0/24 -p tcp -m multiport –dports 21,80,445,53,3306 -j ACCEPT
====================================================
firewalld服务
[root@cos7 ~]# rpm -ql firewalld
[root@cos7 ~]# cat /usr/lib/firewalld/services/nfs.xml