iptables small case:
Requirement 1: Only for the filter table, preset the INPUT chain DROP, the other two chains ACCEPT, and then open port 22 for 192.18.133.0/24, open port 80 to all network segments, and open port 21 to all network segments.
vim /usr/local/sbin/iptables.sh //Add the following
#! /bin/bash
ipt="/usr/sbin/iptables"
$ipt -F
$ipt -P INPUT DROP
$ipt -P OUTPUT ACCEPT
$ipt -P FORWARD ACCEPT
$ipt -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
$ipt -A INPUT -s 192.168.133.0/24 -p tcp --dport 22 -j ACCEPT
$ipt -A INPUT -p tcp --dport 80 -j ACCEPT
$ipt -A INPUT -p tcp --dport 21 -j ACCEPT
After completing the writing, execute sh /usr/sbin/iptables.sh
-m state --state RELATED, ESTABLISHED Indicates the state of incoming packets to be detected. Packets that have established a tcp connection and packets related to the connection are allowed to pass! For smoother communication of the following ports such as 22 80 21.
icmp example:
iptables -I INPUT -p icmp --icmp-type 8 -j DROP
Here the --icmp-type option should be used with -p icmp, followed by the type number. This 8 means that other machines can be pinged on the local machine, but other machines cannot ping the local machine.
nat table application:
• Machine A has two network cards ens33 (192.168.133.130) and ens37 (192.168.100.1), ens33 can access the external network, ens37 is only an internal network, and machine B has only ens37 (192.168.100.100), which can communicate with machine A ens37.
• Requirement 1: Allow B machine to connect to the external network
• Open route forwarding echo "1">/proc/sys/net/ipv4/ip_forward on machine A
• Execute iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -o ens33 -j MASQUERADE on A
• Set the gateway on B to 192.168.100.1
• Requirement 2: Machine C can only communicate with machine A, so that machine C can directly connect to port 22 of machine B
• Open route forwarding echo "1">/proc/sys/net/ipv4/ip_forward on A
• Execute iptables -t nat -A PREROUTING -d 192.168.133.130 -p tcp --dport 1122 -j DNAT --to 192.168.100.100:22 on A
• Execute iptables -t nat -A POSTROUTING -s 192.168.100.100 -j SNAT --to 192.168.133.130 on A
• Set the gateway on B to 192.168.100.1
netfilter save and backup:
service iptables save will save the rules to /etc/sysconfig/iptables
Backup iptables rules to my.ipt file:
iptables-save > my.ipt
Restore the rules you just backed up to:
iptables-restore < my.ipt
Linux Firewall - firewalld:
firewalld 9 zones
Open firewalld:
systemctl disable iptables
systemctl stop iptables
systemctl enable firewalld
systemctl start firewalld
firewalld has 9 zones by default
The default zone is public
firewall-cmd --get-zones //View all zones
[root@gavin-123 ~]# firewall-cmd --get-zones
block dmz drop external home internal public trusted work
• firewall-cmd --get-default-zone//View the default zone
[root@learnlinux ~]# firewall-cmd --get-default-zone
public
The operation of firewalld on zone:
firewall-cmd --set-default-zone=work //Set the default zone
[root@learnlinux ~]# firewall-cmd --set-default-zone=work
success
firewall-cmd --get-zone-of-interface=ens33 //Check the specified network card
[root@learnlinux ~]# firewall-cmd --get-zone-of-interface=eth0
no zone
firewall-cmd --zone=public --add-interface=lo //Set the zone to the specified network card
[root@gavin-123 ~]# firewall-cmd --zone=public --add-interface=lo
success
firewall-cmd --zone=dmz --change-interface=lo //Change the zone for the network card
[root@gavin-123 ~]# firewall-cmd --zone=work --change-interface=enp0s3
success
firewall-cmd --zone=dmz --remove-interface=lo //Remove zone for network card
[root@gavin-123 ~]# firewall-cmd --zone=public --remove-interface=lo
success
[root@gavin-123 ~]# firewall-cmd --get-zone-of-interface=lo
no zone
firewall-cmd --get-active-zones //View the zone where all network cards of the system are located
[root@gavin-123 ~]# firewall-cmd --get-active-zones
work
interfaces: enp0s3
public
interfaces: lo
The operation of firewalld on service:
firewall-cmd --get-services View all servies
[root@gavin-123 ~]# firewall-cmd --get-services
RH-Satellite-6 amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https
firewall-cmd --list-services //View which services are in the current zone
[root@gavin-123 ~]# firewall-cmd --list-services
dhcpv6-client http ssh
firewall-cmd --zone=work --list-services //View which services are in the specified zone
[root@gavin-123 ~]# firewall-cmd --zone=work --list-services
dhcpv6-client ftp ipp-client ssh
firewall-cmd --zone=public --add-service=http //Add http to the public zone
[root@gavin-123 ~]# firewall-cmd --zone=public --add-service=ftp
success
firewall-cmd --zone=public --remove-service=http
[root@gavin-123 ~]# firewall-cmd --zone=public --remove-service=http
success
ls /usr/lib/firewalld/zones/ //zone configuration file template
[root@gavin-123 ~]# ls /usr/lib/firewalld/zones/
block.xml drop.xml home.xml public.xml work.xml
dmz.xml external.xml internal.xml trusted.xml
firewall-cmd --zone=public --add-service=http --permanent //Change the configuration file, and then generate the configuration file under the /etc/firewalld/zones directory
[root@gavin-123 ~]# firewall-cmd --zone=public --add-service=ftp --permanent
success
[root@gavin-123 ~]# cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
<service name="ftp"/>
<service name="dhcpv6-client"/>
<service name="http"/>
<service name="ssh"/>
</zone>
Requirement: ftp service custom port 1121, you need to release ftp under the work zone
cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services
vi /etc/firewalld/services/ftp.xml //Change 21 to 1121
cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/
vi /etc/firewalld/zones/work.xml //Add a line
<service name="ftp"/>
firewall-cmd --reload //reload
firewall-cmd --zone=work --list-services