CentOS服务器iptables配置简单教程

伊蕾娜 發表於 2023-10-3 00:00:00

<p>
iptables是Linux类服务器重要的网络安全防范系统工具，考虑到多数服务器有专门的团队托管，服务器管理员多数时间只能通过SSH进行远程管理，在安全允许的情况下，保证SSH的合法联通，需要做如下的配置。</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_293299">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain">iptables -P INPUT ACCEPT</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">iptables -F</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">iptables -A INPUT -i lo -j ACCEPT</code>
</div>
<div class="line number4 index3 alt1">
<code class="bash plain">iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash plain">iptables -A INPUT -p tcp --dport 22 -j ACCEPT</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash plain">iptables -P INPUT DROP</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash plain">iptables -P FORWARD DROP</code>
</div>
<div class="line number8 index7 alt1">
<code class="bash plain">iptables -P OUTPUT ACCEPT</code>
</div>
<div class="line number9 index8 alt2">
<code class="bash plain">iptables -L -</code><code class="bash functions">v</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
　　这样能够保证SSH的22端口得到合法的通行，最后执行service iptables save，将刚才的配置保存。</p>
<p>
　　通过cat /etc/sysconfig/iptables可以查看iptables配置文件的信息，今后可以通过直接编辑该文件，增删配置条目。</p>
<p>
　　查看运行着的iptables的规则指令为：lsmod | grep ip_tables或iptables -L。</p>
<p>
小编再补充一个知识点：防简单攻击iptables策略</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_85941">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
<div class="line number13 index12 alt2">
13</div>
<div class="line number14 index13 alt1">
14</div>
<div class="line number15 index14 alt2">
15</div>
<div class="line number16 index15 alt1">
16</div>
<div class="line number17 index16 alt2">
17</div>
<div class="line number18 index17 alt1">
18</div>
<div class="line number19 index18 alt2">
19</div>
<div class="line number20 index19 alt1">
20</div>
<div class="line number21 index20 alt2">
21</div>
<div class="line number22 index21 alt1">
22</div>
<div class="line number23 index22 alt2">
23</div>
<div class="line number24 index23 alt1">
24</div>
<div class="line number25 index24 alt2">
25</div>
<div class="line number26 index25 alt1">
26</div>
<div class="line number27 index26 alt2">
27</div>
<div class="line number28 index27 alt1">
28</div>
<div class="line number29 index28 alt2">
29</div>
<div class="line number30 index29 alt1">
30</div>
<div class="line number31 index30 alt2">
31</div>
<div class="line number32 index31 alt1">
32</div>
<div class="line number33 index32 alt2">
33</div>
<div class="line number34 index33 alt1">
34</div>
<div class="line number35 index34 alt2">
35</div>
<div class="line number36 index35 alt1">
36</div>
<div class="line number37 index36 alt2">
37</div>
<div class="line number38 index37 alt1">
38</div>
<div class="line number39 index38 alt2">
39</div>
<div class="line number40 index39 alt1">
40</div>
<div class="line number41 index40 alt2">
41</div>
<div class="line number42 index41 alt1">
42</div>
<div class="line number43 index42 alt2">
43</div>
<div class="line number44 index43 alt1">
44</div>
<div class="line number45 index44 alt2">
45</div>
<div class="line number46 index45 alt1">
46</div>
<div class="line number47 index46 alt2">
47</div>
<div class="line number48 index47 alt1">
48</div>
<div class="line number49 index48 alt2">
49</div>
<div class="line number50 index49 alt1">
50</div>
<div class="line number51 index50 alt2">
51</div>
<div class="line number52 index51 alt1">
52</div>
<div class="line number53 index52 alt2">
53</div>
<div class="line number54 index53 alt1">
54</div>
<div class="line number55 index54 alt2">
55</div>
<div class="line number56 index55 alt1">
56</div>
<div class="line number57 index56 alt2">
57</div>
<div class="line number58 index57 alt1">
58</div>
<div class="line number59 index58 alt2">
59</div>
<div class="line number60 index59 alt1">
60</div>
<div class="line number61 index60 alt2">
61</div>
<div class="line number62 index61 alt1">
62</div>
<div class="line number63 index62 alt2">
63</div>
<div class="line number64 index63 alt1">
64</div>
<div class="line number65 index64 alt2">
65</div>
<div class="line number66 index65 alt1">
66</div>
<div class="line number67 index66 alt2">
67</div>
<div class="line number68 index67 alt1">
68</div>
<div class="line number69 index68 alt2">
69</div>
<div class="line number70 index69 alt1">
70</div>
<div class="line number71 index70 alt2">
71</div>
<div class="line number72 index71 alt1">
72</div>
<div class="line number73 index72 alt2">
73</div>
<div class="line number74 index73 alt1">
74</div>
<div class="line number75 index74 alt2">
75</div>
<div class="line number76 index75 alt1">
76</div>
<div class="line number77 index76 alt2">
77</div>
<div class="line number78 index77 alt1">
78</div>
<div class="line number79 index78 alt2">
79</div>
<div class="line number80 index79 alt1">
80</div>
<div class="line number81 index80 alt2">
81</div>
<div class="line number82 index81 alt1">
82</div>
<div class="line number83 index82 alt2">
83</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash preprocessor bold">#!/bin/sh</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">IPTABLES=</code><code class="bash plain">/sbin/iptables</code>
</div>
<div class="line number3 index2 alt2">
</div>
<div class="line number4 index3 alt1">
</div>
<div class="line number5 index4 alt2">
</div>
<div class="line number6 index5 alt1">
<code class="bash comments"># clear</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash plain">$IPTABLES -F</code>
</div>
<div class="line number8 index7 alt1">
</div>
<div class="line number9 index8 alt2">
<code class="bash comments"># if pkg type is allow, then accept</code>
</div>
<div class="line number10 index9 alt1">
<code class="bash comments">#$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT</code>
</div>
<div class="line number11 index10 alt2">
</div>
<div class="line number12 index11 alt1">
</div>
<div class="line number13 index12 alt2">
</div>
<div class="line number14 index13 alt1">
<code class="bash comments"># 如果同时在80端口的连接数大于10，就Drop掉这个ip</code>
</div>
<div class="line number15 index14 alt2">
</div>
<div class="line number16 index15 alt1">
<code class="bash functions">netstat</code> <code class="bash plain">-an | </code><code class="bash functions">grep</code> <code class="bash plain">:80 | </code><code class="bash functions">awk</code> <code class="bash plain">-F: </code><code class="bash string">'{ print $8 }'</code> <code class="bash plain">| </code><code class="bash functions">sort</code> <code class="bash plain">| </code><code class="bash functions">uniq</code> <code class="bash plain">-c | </code><code class="bash functions">awk</code> <code class="bash plain">-F\ </code><code class="bash string">'$1>10 && $2!="" { print $2 }'</code> <code class="bash plain">>> </code><code class="bash plain">/etc/fw</code><code class="bash plain">.list</code>
</div>
<div class="line number17 index16 alt2">
<code class="bash functions">less</code> <code class="bash plain">/etc/fw</code><code class="bash plain">.list | </code><code class="bash functions">sort</code> <code class="bash plain">| </code><code class="bash functions">uniq</code> <code class="bash plain">-c | </code><code class="bash functions">awk</code> <code class="bash plain">-F\ </code><code class="bash string">'$2!="" { print $2 }'</code> <code class="bash plain">> </code><code class="bash plain">/etc/fw</code><code class="bash plain">.list2</code>
</div>
<div class="line number18 index17 alt1">
<code class="bash functions">less</code> <code class="bash plain">/etc/fw</code><code class="bash plain">.list2 > </code><code class="bash plain">/etc/fw</code><code class="bash plain">.list</code>
</div>
<div class="line number19 index18 alt2">
<code class="bash keyword">while</code> <code class="bash functions">read</code> <code class="bash plain">line</code>
</div>
<div class="line number20 index19 alt1">
</div>
<div class="line number21 index20 alt2">
<code class="bash spaces">    </code><code class="bash keyword">do</code>
</div>
<div class="line number22 index21 alt1">
<code class="bash spaces">    </code><code class="bash plain">t=`</code><code class="bash functions">echo</code> <code class="bash string">"$line"</code><code class="bash plain">`</code>
</div>
<div class="line number23 index22 alt2">
<code class="bash spaces">    </code><code class="bash plain">$IPTABLES -A INPUT -p tcp -s $t -j DROP</code>
</div>
<div class="line number24 index23 alt1">
<code class="bash keyword">done</code> <code class="bash plain">< </code><code class="bash plain">/etc/fw</code><code class="bash plain">.list2</code>
</div>
<div class="line number25 index24 alt2">
</div>
<div class="line number26 index25 alt1">
<code class="bash comments"># IP转发</code>
</div>
<div class="line number27 index26 alt2">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --dport 20002 -j ACCEPT</code>
</div>
<div class="line number28 index27 alt1">
<code class="bash plain">$IPTABLES -A INPUT -d 172.16.204.7 -p tcp -m tcp --dport 20002 -i eth0 -j ACCEPT</code>
</div>
<div class="line number29 index28 alt2">
<code class="bash plain">$IPTABLES -t nat -A PREROUTING -d 211.100.39.44 -p tcp -m tcp --dport 20002 -j DNAT --to-destination 172.16.204.7:20002</code>
</div>
<div class="line number30 index29 alt1">
<code class="bash plain">$IPTABLES -t nat -A POSTROUTING -d 172.16.204.7 -p tcp -m tcp --dport 20002 -j SNAT --to-</code><code class="bash functions">source</code> <code class="bash plain">10.6.39.44</code>
</div>
<div class="line number31 index30 alt2">
</div>
<div class="line number32 index31 alt1">
</div>
<div class="line number33 index32 alt2">
<code class="bash comments"># if pkg visit 80,7710 port then accept</code>
</div>
<div class="line number34 index33 alt1">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT</code>
</div>
<div class="line number35 index34 alt2">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --dport 8080 -j ACCEPT</code>
</div>
<div class="line number36 index35 alt1">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT</code>
</div>
<div class="line number37 index36 alt2">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --dport 873 -j ACCEPT</code>
</div>
<div class="line number38 index37 alt1">
<code class="bash comments"># $IPTABLES -A INPUT -i eth0 -m limit --limit 1/sec --limit-burst 5 -j ACCEPT</code>
</div>
<div class="line number39 index38 alt2">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m limit --limit 30</code><code class="bash plain">/m</code> <code class="bash plain">--limit-burst 2 -j ACCEPT</code>
</div>
<div class="line number40 index39 alt1">
<code class="bash plain">$IPTABLES -A FORWARD -p tcp --syn -m limit --limit 10</code><code class="bash plain">/s</code> <code class="bash plain">-j ACCEPT</code>
</div>
<div class="line number41 index40 alt2">
<code class="bash plain">$IPTABLES -A FORWARD -f -m limit --limit 100</code><code class="bash plain">/s</code> <code class="bash plain">--limit-burst 100 -j ACCEPT</code>
</div>
<div class="line number42 index41 alt1">
</div>
<div class="line number43 index42 alt2">
</div>
<div class="line number44 index43 alt1">
<code class="bash comments"># if pkg from allow ip then accept</code>
</div>
<div class="line number45 index44 alt2">
</div>
<div class="line number46 index45 alt1">
<code class="bash plain">$IPTABLES -A INPUT -p tcp -s 127.0.0.1 -j ACCEPT</code>
</div>
<div class="line number47 index46 alt2">
</div>
<div class="line number48 index47 alt1">
</div>
<div class="line number49 index48 alt2">
</div>
<div class="line number50 index49 alt1">
<code class="bash comments"># if pkg not above then deny</code>
</div>
<div class="line number51 index50 alt2">
</div>
<div class="line number52 index51 alt1">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --syn -j DROP</code>
</div>
<div class="line number53 index52 alt2">
</div>
<div class="line number54 index53 alt1">
<code class="bash plain">下面这个防火墙测试结果更正确，能起到一定的防攻击的功能</code>
</div>
<div class="line number55 index54 alt2">
</div>
<div class="line number56 index55 alt1">
</div>
<div class="line number57 index56 alt2">
</div>
<div class="line number58 index57 alt1">
<code class="bash preprocessor bold">#!/bin/sh</code>
</div>
<div class="line number59 index58 alt2">
</div>
<div class="line number60 index59 alt1">
<code class="bash plain">IPTABLES=</code><code class="bash string">"/sbin/iptables"</code>
</div>
<div class="line number61 index60 alt2">
</div>
<div class="line number62 index61 alt1">
<code class="bash functions">echo</code> <code class="bash string">"1"</code> <code class="bash plain">> </code><code class="bash plain">/proc/sys/net/ipv4/ip_forward</code>
</div>
<div class="line number63 index62 alt2">
</div>
<div class="line number64 index63 alt1">
<code class="bash plain">$IPTABLES -P INPUT DROP</code>
</div>
<div class="line number65 index64 alt2">
<code class="bash plain">$IPTABLES -P FORWARD DROP</code>
</div>
<div class="line number66 index65 alt1">
<code class="bash plain">$IPTABLES -P OUTPUT DROP</code>
</div>
<div class="line number67 index66 alt2">
<code class="bash plain">$IPTABLES -F</code>
</div>
<div class="line number68 index67 alt1">
<code class="bash plain">$IPTABLES -X</code>
</div>
<div class="line number69 index68 alt2">
</div>
<div class="line number70 index69 alt1">
</div>
<div class="line number71 index70 alt2">
<code class="bash plain">$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT</code>
</div>
<div class="line number72 index71 alt1">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT</code>
</div>
<div class="line number73 index72 alt2">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --dport 80 --tcp-flags SYN,ACK,FIN,RST SYN -m limit --limit 30</code><code class="bash plain">/m</code> <code class="bash plain">--limit-burst 2 -j ACCEPT</code>
</div>
<div class="line number74 index73 alt1">
</div>
<div class="line number75 index74 alt2">
</div>
<div class="line number76 index75 alt1">
<code class="bash plain">$IPTABLES -A OUTPUT -p tcp -s 127.0.0.1 -j ACCEPT</code>
</div>
<div class="line number77 index76 alt2">
<code class="bash plain">$IPTABLES -A OUTPUT -p tcp -s 192.168.1.102 -j ACCEPT</code>
</div>
<div class="line number78 index77 alt1">
<code class="bash plain">$IPTABLES -A OUTPUT -p udp -s 127.0.0.1 -j ACCEPT</code>
</div>
<div class="line number79 index78 alt2">
<code class="bash plain">$IPTABLES -A OUTPUT -p udp -s 192.168.1.102 -j ACCEPT</code>
</div>
<div class="line number80 index79 alt1">
</div>
<div class="line number81 index80 alt2">
</div>
<div class="line number82 index81 alt1">
</div>
<div class="line number83 index82 alt2">
<code class="bash plain">$IPTABLES -A INPUT -p tcp --syn -j DROP</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持服务器之家。</p>

頁: [1]

琼殿技术论坛's Archiver

CentOS服务器iptables配置简单教程