擴展匹配查看幫助
iptables -t filter -m icmp -h
user1 通過 user2 ping user2 拒絕 user1 ping
iptables -t filter -A INPUT -s 172.16.1.11 -p icmp -m icmp --icmp-type echo-request -j DROP
拒絕多端口
iptables -t filter -A INPUT -s 172.16.1.11 -p tcp -m multiport --dport 80,22,21 -j DROP
拒絕一個網段
iptables -t filter -A INPUT -m iprange --src-range 192.168.1.1-192.168.1.100 -j DROP
拒絕mac通過
iptables -t filter -A INPUT -m mac --mac-source 00:0C:29:7F:54:B5 -j DROP
允許ssh拒絕scp
iptables -t filter -A INPUT -s 172.16.1.11 -p tcp --dport 22 -m tos --tos 8 -j DROP
TOS match v1.3.5 options:
[!] --tos value Match Type of Service field from one of the
following numeric or descriptive values:
Minimize-Delay 16 (0x10) 最小延遲
Maximize-Throughput 8 (0x08) 最大吞吐量
Maximize-Reliability 4 (0x04) 最大可靠性
Minimize-Cost 2 (0x02) 最小開銷
Normal-Service 0 (0x00) 一般服務
state 狀態防火牆
--state NEW 建立新的連接
--state ESTABLISHED 已建立連接
--state RELATED 相關的
--state INVALID 無效的
icmp 實驗
通 NEW ESTABLISHED
不通 NEW ESTABLISHED RELATED INVALID
出去
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-request -m state --state NEW -j LOG --log-prefix "OUT_ICMP_NEW"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-request -m state --state ESTABLISHED -j LOG --log-prefix "OUT_ICMP_ESTABLISHED"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-request -m state --state RELATED -j LOG --log-prefix "OUT_ICMP_RELATED"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-request -m state --state INVALID -j LOG --log-prefix "OUT_ICMP_INVALID"
進入
iptables -t filter -A INPUT -p icmp -m icmp --icmp-type echo-reply -m state --state NEW -j LOG --log-prefix "IN_ICMP_NEW"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -m state --state ESTABLISHED -j LOG --log-prefix "IN_ICMP_ESTABLISHED"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -m state --state RELATED -j LOG --log-prefix "IN_ICMP_RELATED"
iptables -t filter -A INPUT -p icmp -m icmp --icmp-type echo-reply -m state --state INVALID -j LOG --log-prefix "IN_ICMP_INVALID"
tcp協議 http實驗
出口
iptables -t filter -A UOTPUT -p tcp --dport 80 -m state --state NEW -j LOG --log-prefix " OUT_80_NEW"
iptables -t filter -A UOTPUT -p tcp --dport 80 -m state --state ESTABLISHED -j LOG --log-prefix " OUT_80_ES"
iptables -t filter -A UOTPUT -p tcp --dport 80 -m state --state RELATED -j LOG --log-prefix " OUT_80_RE"
iptables -t filter -A UOTPUT -p tcp --dport 80 -m state --state INVALID -j LOG --log-prefix " OUT_80_IN"
進口
iptables -t filter -A INPUT -p tcp --sport 80 -m state --state NEW -j LOG --log-prefix " IN_80_NEW"
iptables -t filter -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED -j LOG --log-prefix " IN_80_ES"
iptables -t filter -A INPUT -p tcp --sport 80 -m state --state RELATED -j LOG --log-prefix " IN_80_RE"
iptables -t filter -A INPUT -p tcp --sport 80 -m state --state INVALID -j LOG --log-prefix " IN_80_IN"
一共10個包 第一個包是new 其他9個是ESTABLISHED
ftp協議 tcp實驗 有 NEW ESTABLISHED RELATED 3種狀態
控制鏈路 產生2個NEW
出口
iptables -t filter -A OUTPUT -p tcp --dport 21 -m state --state NEW -j LOG --log-prefix "OUT_21_NEW"
iptables -t filter -A OUTPUT -p tcp --dport 21 -m state --state ESTABLISHED -j LOG --log-prefix "OUT_21_ES"
iptables -t filter -A OUTPUT -p tcp --dport 21 -m state --state RELATED -j LOG --log-prefix "OUT_21_RE"
iptables -t filter -A OUTPUT -p tcp --dport 21 -m state --state INVALID -j LOG --log-prefix "OUT_21_IN"
進口
iptables -t filter -A INPUT -p tcp --sport 21 -m state --state NEW -j LOG --log-prefix "IN_21_NEW"
iptables -t filter -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j LOG --log-prefix "IN_21_ES"
iptables -t filter -A INPUT -p tcp --sport 21 -m state --state RELATED -j LOG --log-prefix "IN_21_RE"
iptables -t filter -A INPUT -p tcp --sport 21 -m state --state INVALID -j LOG --log-prefix "IN_21_IN"
數據鏈路
進口
iptabels -t filter -A INPUT -p tcp --sport 20 -m state --state NEW -j LOG --log-prefix "IN_20_NEW"
iptables -t filter -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED -j LOG --log-prefix " IN_20_ES"
iptables -t filter -A INPUT -p tcp --sport 20 -m state --state RELATED -j LOG --log-prefix " IN_20_RE"
iptables -t filter -A INPUT -p tcp --sport 20 -m state --state INVALID -j LOG --log-prefix "IN_20_IN"
出口
iptabels -t filter -A OUTPUT -p tcp --dport 20 -m state --state NEW -j LOG --log-prefix "OUT_20_NEW"
iptables -t filter -A OUTPUT -p tcp --dport 20 -m state --state ESTABLISHED -j LOG --log-prefix " OUT_20_ES"
iptables -t filter -A OUTPUT -p tcp --dport 20 -m state --state RELATED -j LOG --log-prefix " OUT_20_RE"
iptables -t filter -A OUTPUT -p tcp --dport 20 -m state --state INVALID -j LOG --log-prefix "OUT_20_IN"
產生 RELATED 相關連接 與 ip_conntrack_ftp 相關
ls /lib/modules/2.6.18*/kernel/net/ipv4/netfilter/
加載數據模塊內核
modprobe ip_conntrack_ftp
無效連接實驗
出口
iptabales -t filter -A OUTPUT -p tcp --dport 80 -m state --state NEW -j LOG --log-prefix "OUT_80_NEW"
iptabales -t filter -A OUTPUT -p tcp --dport 80 -m state --state INVALID -j LOG --log-prefix "OUT_80_IN"
iptabales -t filter -A OUTPUT -p tcp --dport 80 -m state --state ESTABLISHED -j LOG --log-prefix "OUT_80_ES"
iptabales -t filter -A OUTPUT -p tcp --dport 80 -m state --state RELATED -j LOG --log-prefix "OUT_80_RE"
進口
iptabales -t filter -A INPUT -p tcp --sport 80 -m state --state NEW -j LOG --log-prefix "IN_80_NEW"
iptabales -t filter -A INPUT -p tcp --sport 80 -m state --state INVALID -j LOG --log-prefix "IN_80_IN"
iptabales -t filter -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED -j LOG --log-prefix "IN_80_ES"
iptabales -t filter -A INPUT -p tcp --sport 80 -m state --state RELATED -j LOG --log-prefix "IN_80_RE"
yum install nmap 端口掃描
nmap 172.16.1.11
返回3個包
一個new 2個est
RST 重置
nmap -sA 172.16.1.11 -p 80
nmap 返回2個包
一個new 1個est
nmap -sF 172.16.1.11 -p 80
nmap 返回2個包
2個INVALID 返回兩個FIN信號 端口開啟會有
udp狀態
iptables.sh
#!/bin/bash
iptables -t filter -P INPUT DROP
iptables -t filter -P OUTPUT DROP
modprobe ip_conntrack_ftp
iptables -t filter -A INPUT -p tcp --syn --dport 80 -m state --state NEW -j ACCEPT
iptables -t filter -A INPUT -p tcp --syn --dport 22 -m state --state NEW -j ACCEPT
iptables -t filter -A INPUT -p tcp --syn --dport 21 -m state --state NEW -j ACCEPT
iptables -t filter -A OUTPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -t filter -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT
