打开APP
userphoto
未登录

开通VIP，畅享免费电子书等14项超值服

开通VIP

首页

好书

留言交流

下载APP

联系客服
Linux（Centos7 ）防火墙iptables使用详解
userphoto 关注

安装前

我们需要安装iptables-services，用来启动和停止iptables服务

[root@mcw01 ~]$ yum list all|grep iptables-servicesiptables-services.x86_64 1.4.21-35.el7 base [root@mcw01 ~]$ yum install -y iptables-services[root@mcw01 ~]$ rpm -ql iptables-services/etc/sysconfig/ip6tables/etc/sysconfig/iptables #防火墙配置就是这个/usr/lib/systemd/system/ip6tables.service/usr/lib/systemd/system/iptables.service #服务启动停止文件/usr/libexec/initscripts/legacy-actions/ip6tables/usr/libexec/initscripts/legacy-actions/ip6tables/panic/usr/libexec/initscripts/legacy-actions/ip6tables/save/usr/libexec/initscripts/legacy-actions/iptables/usr/libexec/initscripts/legacy-actions/iptables/panic/usr/libexec/initscripts/legacy-actions/iptables/save/usr/libexec/iptables/usr/libexec/iptables/ip6tables.init/usr/libexec/iptables/iptables.init[root@mcw01 ~]$ modprobe ip_tablesmodprobe iptable_filtermodprobe iptable_natmodprobe ip_conntrackmodprobe ip_conntrack_ftpmodprobe ip_nat_ftpmodprobe ipt_state[root@mcw01 ~]$ lsmod|egrep 'filter|nat|iptable' #默认是没有开启这些内核模块的[root@mcw01 ~]$ [root@mcw01 ~]$ modprobe ip_tables #加载这些模块，应该写进配置，即使重启了也加载，永久性修改生效。[root@mcw01 ~]$ modprobe iptable_filter[root@mcw01 ~]$ modprobe iptable_nat[root@mcw01 ~]$ modprobe ip_conntrack[root@mcw01 ~]$ modprobe ip_conntrack_ftp[root@mcw01 ~]$ modprobe ip_nat_ftp[root@mcw01 ~]$ modprobe ipt_state加载内核模块的配置在/etc/modprobe.d/目录下[root@mcw01 ~]$ ls /etc/modprobe.d/tuned.conf[root@mcw01 ~]$ [root@mcw01 ~]$ tail -7 /etc/rc.local #也可以直接加到开机自启动文件里modprobe ip_tablesmodprobe iptable_filtermodprobe iptable_natmodprobe ip_conntrackmodprobe ip_conntrack_ftpmodprobe ip_nat_ftpmodprobe ipt_state[root@mcw01 ~]$ 然后再检查下，现在有这些内核模块了[root@mcw01 ~]$ lsmod|egrep 'filter|nat|iptable'nf_nat_ftp 12770 0 nf_conntrack_ftp 18638 1 nf_nat_ftpiptable_nat 12875 0 nf_nat_ipv4 14115 1 iptable_natnf_nat 26787 2 nf_nat_ftp,nf_nat_ipv4nf_conntrack 133387 6 nf_nat_ftp,nf_nat,xt_state,nf_nat_ipv4,nf_conntrack_ftp,nf_conntrack_ipv4iptable_filter 12810 0 ip_tables 27115 2 iptable_filter,iptable_natlibcrc32c 12644 4 xfs,sctp,nf_nat,nf_conntrack[root@mcw01 ~]$

关闭firewalld，开启iptables

关闭firewalldsystemctl stop firewalld systemctl disable firewalldsystemctl is-active firewalld.servicesystemctl is-enabled firewalld.service[root@mcw01 ~]$ systemctl stop firewalld [root@mcw01 ~]$ systemctl disable firewalldRemoved symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.[root@mcw01 ~]$ systemctl is-active firewalld.service   #只有不活跃，就关闭了，只有禁用了就不会开机自启了unknown[root@mcw01 ~]$ systemctl is-enabled firewalld.service disabled[root@mcw01 ~]$开启iptablessystemctl start iptables.servicesystemctl enable iptables.service[root@mcw01 ~]$ systemctl start iptables.service [root@mcw01 ~]$ systemctl enable iptables.service Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.[root@mcw01 ~]$ [root@mcw01 ~]$ iptables -Ln  #写反了什么都没有iptables: No chain/target/match by that name.[root@mcw01 ~]$ iptables -nL #这里默认显示的是filter表的。这里有filter表的input链，forword链，和output链Chain INPUT (policy ACCEPT)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHEDACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited#用户请求来的时候，默认先从input链这里一行一行规则往下匹配，如果都没有匹配上了，就走input链后面的小括号里面的规则，#这里是(policy ACCEPT)，小括号里面表示默认规则Chain FORWARD (policy ACCEPT)target     prot opt source               destination         REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibitedChain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$

学习前环境准备

清除所有的iptables规则--flush -F [chain] Delete all rules in chain or all chains 清除所有规则 --delete-chain -X [chain] Delete a user-defined chain 删除用户自定义的规则 --zero -Z [chain [rulenum]] Zero counters in chain or all chains 清除链的计数器清除所有规则，但不会清除默认规则[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHEDACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibitedChain FORWARD (policy ACCEPT)target prot opt source destination REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibitedChain OUTPUT (policy ACCEPT)target prot opt source destination [root@mcw01 ~]$ iptables -F #清除所有的iptables规则[root@mcw01 ~]$ iptables -nL #再次查看，安装好后默认设置的规则都清除掉了Chain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@mcw01 ~]$

禁止访问22端口(指定端口)

 --append  -A chain        Append to chain  #追加链，追加是放到最下面，如果是拒绝的规则，那么应该放到最上面才防止未匹配到而失效。--delete  -D chain        Delete matching rule from chain--insert  -I chain [rulenum]      Insert in chain as rulenum (default 1=first)  #把规则放到前面，插入，一般拒绝的规则放到前面--jump    -j target    target for rule (may load target extension)  #匹配到规则需要做的动作，满足条件后的动作，比如:DROP/ACCEPT/REJECT 拒绝，接受，拒绝--dport 目标端口， -d 目标ip    --sport源端口 -A添加规则;INPUT，我要在INPUT链中添加规则。是需要指定端口还是ip呢，这里是22端口，指定端口的话一般要先指定协议(协议一般这里有tcp，udp，icmp，all就是所有)，端口在网络中一般有两种情况，ip也是有两种情况，就是目标端口，源端口，目标ip，源ip，我这里是禁止访问22端口，也就是端口是目标端口，所以--dport 22；需要禁止访问，那就是 -j DROP ,这个DROP要大写iptables  -A INPUT -p tcp --dport 22 -j DROPiptables  -t filter -A INPUT -p tcp --dport 22 -j DROP需要谨慎，看清了。这里是演示，如果真的把22端口禁了，就连不上了。我这里是虚拟机，可以在VMware上把这条规则清除掉重新远程连接如果我们只是想清除一条规则，可以先执行iptables -nL --line-numbers查看到是第几条链，防止眼睛数错行。这里是在INPUT链上的第一条规则，然后执行删除这条规则.清除之后，22端口就能重新连接了iptables -D INPUT 1 如下，我禁用23端口和解除23端口的过程[root@mcw01 ~]$ iptables  -A INPUT -p tcp --dport 23 -j DROP  #未指定默认是filter表了；添加；在input链上;tcp协议，目标端口23；来访问了就drop丢掉[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:23  #禁用23端口Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$ iptables -nL --line-numbers  #查看规则是第几个，删除可以用到Chain INPUT (policy ACCEPT)num  target     prot opt source               destination         1    DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:23Chain FORWARD (policy ACCEPT)num  target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)num  target     prot opt source               destination         [root@mcw01 ~]$ iptables -D INPUT 1    #删除，指定是INPUT链，第一个规则[root@mcw01 ~]$ iptables -nL Chain INPUT (policy ACCEPT)target     prot opt source               destination         Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$

禁止指定ip，访问本服务器指定端口

禁止指定ip，访问本服务器指定端口iptables -I INPUT -s 10.0.0.12 -p tcp --dport 22 -j DROP 防火墙四表五链，我们常用的是filter，nat表。我们常用的是filter表的INPUT,FORWARD,OUTPUT链；nat表的PREROUTING,POSTROUTING链，OUTPUT链禁止10.0.0.12访问10.0.0.11服务器的22端口10.0.0.11 172.16.0.11 mcw0110.0.0.12 172.16.0.12 mcw02iptables -I INPUT -s 10.0.0.12 -p tcp --dport 22 -j DROP 一开始12能访问11的22端口[root@mcw02 ~]$ ssh 10.0.0.11 hostnameroot@10.0.0.11's password: mcw01[root@mcw02 ~]$ [root@mcw01 ~]$ iptables -I INPUT -s 10.0.0.12 -p tcp --dport 22 -j DROP [root@mcw01 ~]$ iptables -nL #禁止10.0.0.12访问10.0.0.11服务器的22端口Chain INPUT (policy ACCEPT)target prot opt source destination DROP tcp -- 10.0.0.12 0.0.0.0/0 tcp dpt:22#来自10.0.0.12的IP，访问本机的22端口被dropChain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination 再次从12上访问11的22端口，发现是连接超时的[root@mcw02 ~]$ ssh 10.0.0.11 hostnamessh: connect to host 10.0.0.11 port 22: Connection timed out[root@mcw02 ~]$ [root@mcw02 ~]$ ssh 172.16.0.11 hostname #如果使用内网ip,还是可以访问的，因为只是禁用10.0.0.12访问 root@172.16.0.11's password: mcw01[root@mcw02 ~]$ ping 10.0.0.11 -c 1 #访问icmp协议的还是不影响的PING 10.0.0.11 (10.0.0.11) 56(84) bytes of data.64 bytes from 10.0.0.11: icmp_seq=1 ttl=64 time=0.682 ms--- 10.0.0.11 ping statistics ---1 packets transmitted, 1 received, 0% packet loss, time 0msrtt min/avg/max/mdev = 0.682/0.682/0.682/0.000 ms[root@mcw02 ~]$ [root@mcw02 ~]$ nc 10.0.0.11 22 #使用nc查看端口是否能连上Ncat: Connection timed out.[root@mcw02 ~]$[root@mcw02 ~]$ telnet 10.0.0.11 22 #telnet查看是否能连上Trying 10.0.0.11...telnet: connect to address 10.0.0.11: Connection timed out[root@mcw02 ~]$ 正常能连的显示[root@mcw03 ~]$ nc 10.0.0.11 22SSH-2.0-OpenSSH_7.4 #夯住

命令有，但不知道是哪个包带来的命令，两种方式找到包

[root@mcw01 ~]$ rpm -qa nc[root@mcw01 ~]$ rpm -qa ncat[root@mcw01 ~]$ rpm -qa |grep ncirqbalance-1.0.7-10.el7.x86_64ncurses-base-5.9-14.20130511.el7_4.noarchperl-Encode-2.51-7.el7.x86_64qrencode-libs-3.4.1-3.el7.x86_64ncurses-libs-5.9-14.20130511.el7_4.x86_64ncurses-5.9-14.20130511.el7_4.x86_64nmap-ncat-6.40-19.el7.x86_64vim-enhanced-7.4.629-8.el7_9.x86_64ncurses-devel-5.9-14.20130511.el7_4.x86_64[root@mcw01 ~]$ [root@mcw01 ~]$ rpm -qa |grep ncatnmap-ncat-6.40-19.el7.x86_64[root@mcw01 ~]$ which nc/usr/bin/nc[root@mcw01 ~]$ yum provides nc  #方式一：yum查看命令是哪个包里的Loaded plugins: fastestmirrorLoading mirror speeds from cached hostfilenetcat-1.218-2.el7.x86_64 : OpenBSD netcat to read and write data across connections using TCP or UDPRepo        : epelMatched from:Provides    : nc = 1.218-2.el72:nmap-ncat-6.40-19.el7.x86_64 : Nmap's Netcat replacementRepo        : baseMatched from:Provides    : nc2:nmap-ncat-6.40-19.el7.x86_64 : Nmap's Netcat replacementRepo        : @baseMatched from:Provides    : nc[root@mcw01 ~]$ rpm -qf `which nc`  #方式二：rpm查看命令是哪个包里的nmap-ncat-6.40-19.el7.x86_64[root@mcw01 ~]$

使用nc命令进行端口间通信

当我使用nc连接本服务器端口的时候[root@mcw03 ~]$ nc -l 6381#夯住新开一个窗口，发现这个命令的进程[root@mcw03 ~]$ ps -ef|grep -v grep |grep 6381root 19421 19094 0 03:26 pts/0 00:00:00 nc -l 6381[root@mcw03 ~]$ --如下当我将mcw03上redis端口，使用nc命令夯住后[root@mcw03 ~]$ nc -l 6381wo shi machangweinihaoya当我在其他机器，比如在mcw01上telnet mcw03的这个6381端口，也会夯住，然后这样两者间就可以互相写字进行通信了，一行一行的发送，点击enter就发送。telnet如果是客户端的话，那么我断开telnet，nc命令并不会终止[root@mcw01 ~]$ telnet 10.0.0.13 6381Trying 10.0.0.13...Connected to 10.0.0.13.Escape character is '^]'.wo shi machangweinihaoya当我在mcw03上使用nc之后，夯住[root@mcw03 ~]$ nc -l 6381然后[root@mcw01 ~]$ cat /etc/hosts127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4::1 localhost localhost.localdomain localhost6 localhost6.localdomain6[root@mcw01 ~]$ cat /etc/hosts |nc 10.0.0.13 6381 #然后在另一个主机上连接这个端口，就能发送文件内容过去[root@mcw03 ~]$ nc -l 6381 #接收到文件内容，我们也可以将接收的文件内容重定向到文件里，实现nc通过端口传输文件127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4::1 localhost localhost.localdomain localhost6 localhost6.localdomain6[root@mcw03 ~]$ [root@mcw03 ~]$ nc -l 6381 >1.host[root@mcw03 ~]$ cat 1.host 127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4::1 localhost localhost.localdomain localhost6 localhost6.localdomain6[root@mcw03 ~]$

禁止指定网段访问本服务器的指定端口

禁止指定网段访问本服务器的指定端口iptables -I INPUT -s 172.16.0.0/24 -p tcp --dport 8080 -j DROP别人访问我，是进入的包，INPUT链。别人访问我的某个端口服务，我这个端口是对方访问的目标端口，所以是dport，禁止就得drop，-I拒绝的就往前面插入我在mcw01上开启了8080端口的监听，然后通过两个ip访问，都能通，接收到信息[root@mcw02 ~]$ echo 111|nc 10.0.0.11 8080[root@mcw02 ~]$ echo 111|nc 172.16.0.11 8080[root@mcw02 ~]$ [root@mcw01 ~]$ nc -l 8080111[root@mcw01 ~]$ nc -l 8080111[root@mcw01 ~]$ 现在设置防火墙规则，禁止指定172.16.0.0/24网段访问本服务器的指定端口8080[root@mcw01 ~]$ iptables -I INPUT -s 172.16.0.0/24 -p tcp --dport 8080 -j DROP[root@mcw01 ~]$ [root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         DROP       tcp  --  172.16.0.0/24        0.0.0.0/0            tcp dpt:8080DROP       tcp  --  10.0.0.12            0.0.0.0/0            tcp dpt:22Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$ 然后再看，mcw02连接mcw01的nc开启的连接服务，发现172.16.0.11只有这个网段的不能连上服务了，说明禁止生效了[root@mcw02 ~]$ echo 111|nc 10.0.0.11 8080[root@mcw02 ~]$ echo 111|nc 172.16.0.11 8080Ncat: Connection timed out.[root@mcw02 ~]$ [root@mcw01 ~]$ nc -l 8080111[root@mcw01 ~]$ nc -l 8080 #夯住，没反应

指定只能某个网段访问本服务器。(不是指定网段的拒绝掉)

指定只能某个网段访问本服务器。(不是指定网段的拒绝掉)iptables -I INPUT ! -s 10.0.0.0/24 -j DROP当我清空所以防火墙配置之后，mcw02能访问mcw01上nc开启的2222端口[root@mcw02 ~]$ echo 2222|nc 10.0.0.11 2222[root@mcw02 ~]$ echo 2222|nc 172.16.0.11 2222[root@mcw02 ~]$ [root@mcw01 ~]$ nc -l 22222222[root@mcw01 ~]$ nc -l 22222222[root@mcw01 ~]$ [root@mcw01 ~]$ iptables -I INPUT ! -s 10.0.0.0/24 -j DROP[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target prot opt source destination DROP all -- !10.0.0.0/24 0.0.0.0/0 Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@mcw01 ~]$ 当我两次在mcw01上nc开启2222端口时，只有访问10.0.0.11能访问到，访问172.16.0.11访问不到。所以防火墙配置生效[root@mcw02 ~]$ echo 2222|nc 10.0.0.11 2222[root@mcw02 ~]$ echo 2222|nc 172.16.0.11 2222Ncat: Connection timed out.[root@mcw02 ~]$ [root@mcw01 ~]$ nc -l 22222222[root@mcw01 ~]$ nc -l 2222

禁止用户访问本服务器指定范围或者指定多个的端口

禁止用户访问本服务器指定范围或者指定多个的端口iptables -I INPUT -p tcp --dport 1024:65535 -j DROPiptables -I INPUT -p tcp -m multiport --dport 81,444 -j DROP执行命令前，nc开启mcw01的端口，mcw02上都能访问到[root@mcw02 ~]$ echo 2222|nc 10.0.0.11 444[root@mcw02 ~]$ echo 2222|nc 10.0.0.11 1024[root@mcw02 ~]$ echo 2222|nc 10.0.0.11 60000[root@mcw02 ~]$ [root@mcw01 ~]$ nc -l 4442222[root@mcw01 ~]$ nc -l 10242222[root@mcw01 ~]$ nc -l 600002222[root@mcw01 ~]$ [root@mcw01 ~]$ iptables -I INPUT -p tcp --dport 1024:65535 -j DROP[root@mcw01 ~]$ iptables -I INPUT -p tcp -m multiport --dport 81,444 -j DROP[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 81,444DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpts:1024:65535DROP       all  -- !10.0.0.0/24          0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination     执行命令后，无法访问到[root@mcw02 ~]$ echo 2222|nc 10.0.0.11 444Ncat: Connection timed out.[root@mcw02 ~]$ echo 2222|nc 10.0.0.11 1024Ncat: Connection timed out.[root@mcw02 ~]$ echo 2222|nc 10.0.0.11 60000Ncat: Connection timed out.[root@mcw02 ~]$ [root@mcw01 ~]$ nc -l 444^C[root@mcw01 ~]$ nc -l 1024^C[root@mcw01 ~]$ nc -l 60000^C[root@mcw01 ~]$

使用iptables实现禁止ping功能

使用iptables实现禁止ping功能iptables -I INPUT -p icmp --icmp-type 8 -j DROP #实际上icmp协议的类型有很多，影响我们ping的类型是8，只需禁止8就行iptables -I INPUT -p icmp --icmp-type any -j DROP当我给mcw01添加内核设置为1的时候，mcw02就无法ping通mcw01了，当我修改为0的时候，就能ping同mcw01了echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_allecho 0 >/proc/sys/net/ipv4/icmp_echo_ignore_all加上这条命令后，里面就不能ping通了 ，这里是任意类型，好像写成8也可以[root@mcw01 ~]$ iptables -I INPUT -p icmp --icmp-type any -j DROP[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target prot opt source destination DROP icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 255DROP tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 81,444DROP tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpts:1024:65535DROP all -- !10.0.0.0/24 0.0.0.0/0 Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@mcw01 ~]$

保存和恢复规则

iptables-save保存当前防火墙到配置文件中，加上重定向，可以将防火墙规则导入到指定文件中备份起来[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         DROP       icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 255DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 81,444DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpts:1024:65535DROP       all  -- !10.0.0.0/24          0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$ iptables-save  #会把所有的打印出来，*后面显示表的名字；冒号后欧美是默认的规则，再往下就死我们自己配置的规则# Generated by iptables-save v1.4.21 on Mon Mar  7 16:48:59 2022*nat:PREROUTING ACCEPT [6543:408185]:INPUT ACCEPT [76:11426]:OUTPUT ACCEPT [358288:21886420]:POSTROUTING ACCEPT [358288:21886420]COMMIT# Completed on Mon Mar  7 16:48:59 2022# Generated by iptables-save v1.4.21 on Mon Mar  7 16:48:59 2022*filter  :INPUT ACCEPT [696:58996]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [653551:39668311] #*后面显示表的名字；冒号后欧美是默认的规则，再往下就死我们自己配置的规则-A INPUT -p icmp -m icmp --icmp-type any -j DROP-A INPUT -p tcp -m multiport --dports 81,444 -j DROP-A INPUT -p tcp -m tcp --dport 1024:65535 -j DROP-A INPUT ! -s 10.0.0.0/24 -j DROPCOMMIT# Completed on Mon Mar  7 16:48:59 2022[root@mcw01 ~]$ 防火墙配置，实际保存的是如下文件中。可以看到和命令查询出来的差不多[root@mcw01 ~]$ cat /etc/sysconfig/iptables# sample configuration for iptables service# you can edit this manually or use system-config-firewall# please do not ask us to add additional ports/services to this default configuration*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibitedCOMMIT[root@mcw01 ~]$ 如下保存防火墙规则[root@mcw01 ~]$ iptables-save >iptRule.txt[root@mcw01 ~]$ cat iptRule.txt # Generated by iptables-save v1.4.21 on Mon Mar  7 16:53:44 2022*nat:PREROUTING ACCEPT [6642:414294]:INPUT ACCEPT [77:11655]:OUTPUT ACCEPT [363901:22224847]:POSTROUTING ACCEPT [363901:22224847]COMMIT# Completed on Mon Mar  7 16:53:44 2022# Generated by iptables-save v1.4.21 on Mon Mar  7 16:53:44 2022*filter:INPUT ACCEPT [781:65217]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [664961:40365111]-A INPUT -p icmp -m icmp --icmp-type any -j DROP-A INPUT -p tcp -m multiport --dports 81,444 -j DROP-A INPUT -p tcp -m tcp --dport 1024:65535 -j DROP-A INPUT ! -s 10.0.0.0/24 -j DROPCOMMIT# Completed on Mon Mar  7 16:53:44 2022[root@mcw01 ~]$ 不小心把防火墙都误清除了，因为之前保存到配置里了，重启一下防火墙重新就出来了[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         DROP       icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 255DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 81,444DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpts:1024:65535DROP       all  -- !10.0.0.0/24          0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$ iptables -F[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$ systemctl restart iptables.service [root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHEDACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibitedChain FORWARD (policy ACCEPT)target     prot opt source               destination         REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibitedChain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$ iptables-restore无需重启防火墙，可以将备份导出来的防火墙规则，再导入回去[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHEDACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibitedChain FORWARD (policy ACCEPT)target     prot opt source               destination         REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibitedChain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$ iptables -F[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$ iptables-restore <iptRule.txt [root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         DROP       icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 255DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 81,444DROP       tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpts:1024:65535DROP       all  -- !10.0.0.0/24          0.0.0.0/0           Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$

修改默认规则为drop，默认都不接受的做法

-i --input 数据进入的时候通过哪个网卡-o --output 数据出去的时候通过哪个网卡-P --policy -P chain target Change policy on chain to target 修改默认规则修改默认规则前设置：iptables -I INPUT -p tcp --dport 22 -j ACCEPTiptables -A INPUT -i lo -j ACCEPTiptables -A OUTPUT -o lo -j ACCEPTiptables -I INPUT -ptcp -m multiport --dport 80,443 -j ACCEPT修改默认规则iptables -P INPUT DROPiptables -P FORWARD DROP iptables -P OUTPUT ACCEPT修改默认规则后添加自己使用的网段为白名单iptables -A INPUT -s 10.0.0.0/24 -j ACCEPTiptables -A INPUT -s 172.16.0.0/24 -j ACCEPT清除好环境[root@mcw01 ~]$ iptables -F[root@mcw01 ~]$ iptables -X[root@mcw01 ~]$ iptables -Z[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@mcw01 ~]$ 在修改默认策略为拒绝时，首先要提前做些准备。比如接收22端口访问[root@mcw01 ~]$ #准许连接 22端口[root@mcw01 ~]$ iptables -I INPUT -p tcp --dport 22 -j ACCEPT[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@mcw01 ~]$ 设置本地lo通讯规则[root@mcw01 ~]$ iptables -A INPUT -i lo -j ACCEPT[root@mcw01 ~]$ iptables -A OUTPUT -o lo -j ACCEPT[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 [root@mcw01 ~]$ 添加指定服务需要能被访问，比如80 443 [root@mcw01 ~]$ iptables -I INPUT -ptcp -m multiport --dport 80,443 -j ACCEPT[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 [root@mcw01 ~]$ 修改默认规则[root@mcw01 ~]$ #修改默认规则[root@mcw01 ~]$ iptables -P INPUT DROP #进来的时候，默认是drop[root@mcw01 ~]$ iptables -nLChain INPUT (policy DROP)target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 [root@mcw01 ~]$ iptables -P FORWARD DROP #这个也默认是drop[root@mcw01 ~]$ iptables -P OUTPUT ACCEPT #出去的时候不管，都接受[root@mcw01 ~]$ iptables -nLChain INPUT (policy DROP)target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy DROP)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 [root@mcw01 ~]$ 添加两个白名单[root@mcw01 ~]$ iptables -A INPUT -s 10.0.0.0/24 -j ACCEPT[root@mcw01 ~]$ iptables -A INPUT -s 172.16.0.0/24 -j ACCEPT[root@mcw01 ~]$ iptables -nLChain INPUT (policy DROP)target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 80,443ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 10.0.0.0/24 0.0.0.0/0 ACCEPT all -- 172.16.0.0/24 0.0.0.0/0 Chain FORWARD (policy DROP)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 然后保存下我们的配置[root@mcw01 ~]$ iptables-save # Generated by iptables-save v1.4.21 on Mon Mar 7 17:21:59 2022*nat:PREROUTING ACCEPT [148:9218]:INPUT ACCEPT [13:949]:OUTPUT ACCEPT [2894:191439]:POSTROUTING ACCEPT [2894:191439]COMMIT# Completed on Mon Mar 7 17:21:59 2022# Generated by iptables-save v1.4.21 on Mon Mar 7 17:21:59 2022*filter:INPUT DROP [0:0]:FORWARD DROP [0:0]:OUTPUT ACCEPT [195:20374]-A INPUT -p tcp -m multiport --dports 80,443 -j ACCEPT-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -s 10.0.0.0/24 -j ACCEPT-A INPUT -s 172.16.0.0/24 -j ACCEPT-A OUTPUT -o lo -j ACCEPTCOMMIT# Completed on Mon Mar 7 17:21:59 2022[root@mcw01 ~]$ #其中默认是drop ，INPUT和OUTPUT链添加了规则

内网服务器通过iptables转发实现访问外网SNAT(共享上网)

内网服务器通过iptables转发实现访问外网(共享上网)10.0.0.11是集群中的外网ip，能通过这个ip访问外网的。这个ip所在服务器可以做成网关，让其它主机的网关设置成该主机的内网ip，然后通过ipv4内核源地址转换实现访问外网单个ip实现源地址转换iptables -t nat -A POSTROUTING -s 172.16.0.13 -j SNAT --to-source 10.0.0.11echo 1 >/proc/sys/net/ipv4/ip_forwardecho 'net.ipv4.ip_forward=1' >>/etc/sysctl.confsysctl -p指定网段的地址实现源地址转换iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -j SNAT --to-source 10.0.0.11当公网ip不固定时：更换。用如下命令iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -j MASQUERADEMASQUERADEmasquerade英[ˌmæskəˈreɪd]美[ˌmæskəˈreɪd]n.    掩藏; 掩饰; 化装舞会; 假面舞会;vi.    假扮; 乔装; 伪装;nat表(可以共享上网，端口映射，ip映射)主机环境(将mcw02和mcw03的外网ip10网段的先停掉网卡，只剩内网ip172网段的，纯内网机子了)：10.0.0.11  172.16.0.11 mcw0110.0.0.12  172.16.0.12 mcw0210.0.0.13  172.16.0.13 mcw03准备环境：先把上面做的环境改回来，记得先改回默认策略为接受，然后再清空所有的规则。不然默认规则是拒绝，我把22接受服务的删除掉，那么就连不上服务器了，只能去机房连接服务器恢复了[root@mcw01 ~]$ iptables -P INPUT ACCEPT[root@mcw01 ~]$ iptables -P FORWARD ACCEPT[root@mcw01 ~]$ iptables -P OUTPUT ACCEPT[root@mcw01 ~]$ [root@mcw01 ~]$ iptables -F[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target     prot opt source               destination         Chain FORWARD (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         [root@mcw01 ~]$ [root@mcw01 ~]$ ping www.baidu.com -c 1  #查看百度的ip是110.242.68.4，我现在需要内网的机子能访问这个ipPING www.a.shifen.com (110.242.68.4) 56(84) bytes of data.64 bytes from 110.242.68.4 (110.242.68.4): icmp_seq=1 ttl=128 time=17.1 ms--- www.a.shifen.com ping statistics ---1 packets transmitted, 1 received, 0% packet loss, time 0msrtt min/avg/max/mdev = 17.186/17.186/17.186/0.000 ms[root@mcw01 ~]$ 我现在mcw03这个后端内网服务器不能访问到外网，mcw01可以访问到外网。我想通过mcw01做转发，实现mcw03访问外网mcw03的ip是172.16.0.13，这时数据包通过mcw01访问110.242.68.4时，目标ip110.242.68.4不变，在mcw01上要将源ip172.16.0.13修改mcw01的ip即10.0.0.11。所以，需要内网实现共享上网的时候，需要使用snat，源网络地址转换这时我们的mcw03的数据包，是需要通过mcw01上出去，进而访问外网，所以我们需要修改的是以前画的那张图里的nat表POSTROUTING所以，需要设置防火墙命令如下：需要在nat表设置；需要在POSTROUTING链里追加；目标ip是访问的外网ip,需要指定源ip是mcw03内网ip地址需要转换为可以访问的外网ip；动作是mcw03的内网ip,源ip转换为能访问外网的mcw01上的外网ip,动作是源地址访问;将源地址改为mcw01上的外网ip10.0.0.11mcw01配置了防火墙，还要开启mcw01的ip转发内核参数。将mcw03网关应该修改为mcw01的内网ip,内网网卡上给mcw03添加DNS服务器的配置，不然无法解析了。单个ip实现源地址转换iptables -t nat -A POSTROUTING -s 172.16.0.13 -j SNAT --to-source 10.0.0.11echo 1 >/proc/sys/net/ipv4/ip_forwardecho 'net.ipv4.ip_forward=1' >>/etc/sysctl.confsysctl -p指定网段的地址实现源地址转换iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -j SNAT --to-source 10.0.0.11操作前检查情况[root@mcw02 ~]$ ssh 172.16.0.13  #从mcw02上连接mcw03内网iproot@172.16.0.13's password: Last login: Mon Mar  7 17:58:21 2022 from 172.16.0.12[root@mcw03 ~]$ ip a  #查看网卡情况1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo       valid_lft forever preferred_lft forever    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000    link/ether 00:0c:29:3b:e7:99 brd ff:ff:ff:ff:ff:ff    inet 172.16.0.13/24 brd 172.16.0.255 scope global ens34       valid_lft forever preferred_lft forever    inet6 fe80::d4fb:80c5:2bc7:80e9/64 scope link        valid_lft forever preferred_lft forever3: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 00:0c:29:3b:e7:8f brd ff:ff:ff:ff:ff:ff    inet 10.0.0.13/24 brd 10.0.0.255 scope global ens33       valid_lft forever preferred_lft forever    inet6 fe80::6782:98:f742:b0e8/64 scope link        valid_lft forever preferred_lft forever    inet6 fe80::6faf:5935:98b1:7f8d/64 scope link tentative dadfailed        valid_lft forever preferred_lft forever    inet6 fe80::cdd:d005:758:ad29/64 scope link tentative dadfailed        valid_lft forever preferred_lft forever[root@mcw03 ~]$ ifdown ens33  #将mcw03的外网网卡关闭掉Device 'ens33' successfully disconnected.[root@mcw03 ~]$ ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo       valid_lft forever preferred_lft forever    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000    link/ether 00:0c:29:3b:e7:99 brd ff:ff:ff:ff:ff:ff    inet 172.16.0.13/24 brd 172.16.0.255 scope global ens34       valid_lft forever preferred_lft forever    inet6 fe80::d4fb:80c5:2bc7:80e9/64 scope link        valid_lft forever preferred_lft forever3: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 00:0c:29:3b:e7:8f brd ff:ff:ff:ff:ff:ff[root@mcw03 ~]$ ping www.baidu.com  #查看mcw03无法访问外网，只有内网ip172.16.0.13可以通信ping: www.baidu.com: Name or service not known[root@mcw03 ~]$ [root@mcw01 ~]$ iptables -t nat -A POSTROUTING -s 172.16.0.13 -j SNAT --to-source 10.0.0.11[root@mcw01 ~]$ echo 1 >/proc/sys/net/ipv4/ip_forward[root@mcw01 ~]$ echo 'net.ipv4.ip_forward=1' >>/etc/sysctl.conf[root@mcw01 ~]$ sysctl -p发现mcw03还是不通外网，是因为忘记修改网关了，网关应该修改为mcw01的内网ip.[root@mcw03 ~]$ ping www.baidu.comping: www.baidu.com: Name or service not known[root@mcw03 ~]$ ip rdefault via 172.160.0.253 dev ens34 proto static metric 100 172.16.0.0/24 dev ens34 proto kernel scope link src 172.16.0.13 metric 100 172.160.0.253 dev ens34 proto static scope link metric 100 这里将内网网卡配置的网关设置为mcw01主机的内网ip。让它onboot改为yes，不然重启就关闭网卡了[root@mcw03 ~]$ vim /etc/sysconfig/network-scripts/ifcfg-ens34 [root@mcw03 ~]$ egrep -i 'onboot|gateway' /etc/sysconfig/network-scripts/ifcfg-ens34ONBOOT=yesGATEWAY=172.16.0.11[root@mcw03 ~]$ vim /etc/sysconfig/network-scripts/ifcfg-ens33  #将外网网卡的onboot关闭掉，防止重启网络，而重启网卡[root@mcw03 ~]$ egrep -i 'onboot|gateway' /etc/sysconfig/network-scripts/ifcfg-ens33ONBOOT='no'GATEWAY='10.0.0.253'[root@mcw03 ~]$ systemctl restart network[root@mcw03 ~]$
检查环境以及验证内网访问外网[root@mcw03 ~]$ ip a #查看网络，没有问题，还是内网ip1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 link/ether 00:0c:29:3b:e7:99 brd ff:ff:ff:ff:ff:ff inet 172.16.0.13/24 brd 172.16.0.255 scope global ens34 valid_lft forever preferred_lft forever inet6 fe80::d4fb:80c5:2bc7:80e9/64 scope link valid_lft forever preferred_lft forever3: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:3b:e7:8f brd ff:ff:ff:ff:ff:ff[root@mcw03 ~]$ [root@mcw03 ~]$ ip r #查看网关，已经变成了mcw01主机的内网ipdefault via 172.16.0.11 dev ens34 proto static metric 100 172.16.0.0/24 dev ens34 proto kernel scope link src 172.16.0.13 metric 100 [root@mcw03 ~]$ [root@mcw03 ~]$ ping www.baidu.com #成功访问外网PING www.a.shifen.com (110.242.68.4) 56(84) bytes of data.64 bytes from 110.242.68.4 (110.242.68.4): icmp_seq=1 ttl=127 time=14.8 ms64 bytes from 110.242.68.4 (110.242.68.4): icmp_seq=2 ttl=127 time=13.6 ms^C--- www.a.shifen.com ping statistics ---2 packets transmitted, 2 received, 0% packet loss, time 999msrtt min/avg/max/mdev = 13.674/14.261/14.848/0.587 ms[root@mcw03 ~]$ 附上mcw01的内网ip查询[root@mcw01 ~]$ ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 link/ether 00:0c:29:4f:40:9c brd ff:ff:ff:ff:ff:ff inet 172.16.0.11/24 brd 172.16.0.255 scope global ens34 valid_lft forever preferred_lft forever inet6 fe80::9910:d66a:5b4d:7102/64 scope link valid_lft forever preferred_lft forever inet6 fe80::d4fb:80c5:2bc7:80e9/64 scope link tentative dadfailed valid_lft forever preferred_lft forever3: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:4f:40:92 brd ff:ff:ff:ff:ff:ff inet 10.0.0.11/24 brd 10.0.0.255 scope global ens33 valid_lft forever preferred_lft forever inet6 fe80::cdd:d005:758:ad29/64 scope link valid_lft forever preferred_lft forever[root@mcw01 ~]$ 执行完后，记得保存一下配置iptables -t nat -nL 查看nat表的转发规则[root@mcw01 ~]$ iptables -t nat -A POSTROUTING -s 172.16.0.0/24 -j SNAT --to-source 10.0.0.11[root@mcw01 ~]$ [root@mcw01 ~]$ [root@mcw01 ~]$ [root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@mcw01 ~]$ iptables -t nat -nLChain PREROUTING (policy ACCEPT)target prot opt source destination Chain INPUT (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination Chain POSTROUTING (policy ACCEPT)target prot opt source destination SNAT all -- 172.16.0.13 0.0.0.0/0 to:10.0.0.11SNAT all -- 172.16.0.0/24 0.0.0.0/0 to:10.0.0.11[root@mcw01 ~]$ [root@mcw01 ~]$ cat /etc/sysconfig/iptables# sample configuration for iptables service# you can edit this manually or use system-config-firewall# please do not ask us to add additional ports/services to this default configuration*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibitedCOMMIT[root@mcw01 ~]$ [root@mcw01 ~]$ [root@mcw01 ~]$ iptables-save # Generated by iptables-save v1.4.21 on Mon Mar 7 18:52:42 2022*nat:PREROUTING ACCEPT [143:9307]:INPUT ACCEPT [1:229]:OUTPUT ACCEPT [80:6466]:POSTROUTING ACCEPT [80:6466]-A POSTROUTING -s 172.16.0.13/32 -j SNAT --to-source 10.0.0.11-A POSTROUTING -s 172.16.0.0/24 -j SNAT --to-source 10.0.0.11COMMIT# Completed on Mon Mar 7 18:52:42 2022# Generated by iptables-save v1.4.21 on Mon Mar 7 18:52:42 2022*filter:INPUT ACCEPT [698927:234693305]:FORWARD ACCEPT [5426:390414]:OUTPUT ACCEPT [704597:225964959]COMMIT# Completed on Mon Mar 7 18:52:42 2022[root@mcw01 ~]$ [root@mcw01 ~]$ cat /etc/sysconfig/iptables# sample configuration for iptables service# you can edit this manually or use system-config-firewall# please do not ask us to add additional ports/services to this default configuration*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibitedCOMMIT

如何删除nat表的规则：

[root@mcw01 ~]$ iptables -t nat -nLChain PREROUTING (policy ACCEPT)target     prot opt source               destination         Chain INPUT (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         Chain POSTROUTING (policy ACCEPT)target     prot opt source               destination         SNAT       all  --  172.16.0.13          0.0.0.0/0            to:10.0.0.11SNAT       all  --  172.16.0.0/24        0.0.0.0/0            to:10.0.0.61[root@mcw01 ~]$ [root@mcw01 ~]$ [root@mcw01 ~]$ [root@mcw01 ~]$ iptables -t nat -D  POSTROUTING 2 #删除nat表的规则，需要指定nat表[root@mcw01 ~]$ [root@mcw01 ~]$ iptables -t nat -nLChain PREROUTING (policy ACCEPT)target     prot opt source               destination         Chain INPUT (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         Chain POSTROUTING (policy ACCEPT)target     prot opt source               destination         SNAT       all  --  172.16.0.13          0.0.0.0/0            to:10.0.0.11

DNAT端口转发(内网服务器不暴露在公网上，但是它上面的服务可以通过某台服务器的端口转发提供给外网)

DNAT端口转发(内网服务器不暴露在公网上，但是它上面的服务可以通过某台服务器的端口转发提供给外网)iptables -t nat -A PREROUTING -d 10.0.0.11 -p tcp --dport 9000 -j DNAT --to-destination 172.16.0.13:22有点像Nginx的端口转发当外网需要访问内网某个主机的某个服务时，服务无法提供。我们可以使用端口转发，mcw01有外网ip，当外网访问mcw01的外网时，我们可以根据端口来将请求转发给内网某个服务器如mcw03,mcw03上是没有外网ip的。主机环境(将mcw02和mcw03的外网ip10网段的先停掉网卡，只剩内网ip172网段的，纯内网机子了)：10.0.0.11 172.16.0.11 mcw0110.0.0.12 172.16.0.12 mcw0210.0.0.13 172.16.0.13 mcw03例如：当用户访问我们的mcw01主机上的9000端口(10.0.0.11:9000)时，我们将它转发到我们内网服务器mcw03上的22端口(172.16.0.13:22)。用户访问时，源地址是他们自己，他们的目标是访问我们的10.0.0.11:9000，我们要实现转发，需要将这个目标地址改成172.16.0.13:22。所以这里是目标地址转换DNAT。这里是目标地址转换，是nat表；这是用户来访问的数据包，也就是用户要进来，所以是PREROUTING 链；目标访问的是10.0.0.11;对方访问的是9000端口；动作我就用DNAT，目标地址转换，转换成我们内网的地址；这里是转换成目标地址172.16.0.13:22注意：此时这里的mcw03的网卡上配置的网关，要设置成mcw01上内网的ip。因为数据包是转发给mcw03了，但是我要回包的话，得发给mcw01的内网ip，然后mcw01内网ip再发给mcw01的公网ip10.0.0.11,这样才能给客户返回响应数据。这里之前已经配置了，详情见上面的SNAT共享上网iptables -t nat -A PREROUTING -d 10.0.0.11 -p tcp --dport -j DNAT --to-destination 172.16.0.13:22然后还需要开启ipv4转发。之前我已经配置好了[root@mcw01 ~]$ tail -1 /etc/sysctl.conf net.ipv4.ip_forward=1[root@mcw01 ~]$ 操作前检查情况mcw03和mcw01的9000端口目前都不能连接[c:\~]$ ssh root@172.16.0.13Connecting to 172.16.0.13:22...Could not connect to '172.16.0.13' (port 22): Connection failed.Type `help' to learn how to use Xshell prompt.[c:\~]$ [c:\~]$ [c:\~]$ [c:\~]$ ssh root@10.0.0.11 9000Connecting to 10.0.0.11:9000...Could not connect to '10.0.0.11' (port 9000): Connection failed.Type `help' to learn how to use Xshell prompt.[c:\~]$ 执行操作：配置目标地址转发，查看配置的规则，查看ipv4转发是否开启[root@mcw01 ~]$ iptables -t nat -A PREROUTING -d 10.0.0.11 -p tcp --dport 9000 -j DNAT --to-destination 172.16.0.13:22[root@mcw01 ~]$ iptables -t nat -nLChain PREROUTING (policy ACCEPT)target prot opt source destination DNAT tcp -- 0.0.0.0/0 10.0.0.11 tcp dpt:9000 to:172.16.0.13:22Chain INPUT (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination Chain POSTROUTING (policy ACCEPT)target prot opt source destination SNAT all -- 172.16.0.13 0.0.0.0/0 to:10.0.0.11SNAT all -- 172.16.0.0/24 0.0.0.0/0 to:10.0.0.11[root@mcw01 ~]$ tail -1 /etc/sysctl.conf net.ipv4.ip_forward=1[root@mcw01 ~]$ 检验配置的效果：发现当我们外网上连接mcw01的9000端口时，实际上我们是访问到了没有外网ip，不通外网的mcw03主机上。也就是在mcw01上成功实现端口转发。这样当我们内网的主机上某个服务要提供给外网访问时，可以使用端口转发的方式提供服务，这也能保证了内网服务器的安全性。[c:\~]$ ssh root@10.0.0.11 9000Connecting to 10.0.0.11:9000...Connection established.To escape to local shell, press 'Ctrl+Alt+]'.Last login: Mon Mar 7 18:06:33 2022 from 172.16.0.12[root@mcw03 ~]$ hostname -I172.16.0.13 [root@mcw03 ~]$ ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1 link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 inet 127.0.0.1/8 scope host lo valid_lft forever preferred_lft forever inet6 ::1/128 scope host valid_lft forever preferred_lft forever2: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000 link/ether 00:0c:29:3b:e7:99 brd ff:ff:ff:ff:ff:ff inet 172.16.0.13/24 brd 172.16.0.255 scope global ens34 valid_lft forever preferred_lft forever inet6 fe80::d4fb:80c5:2bc7:80e9/64 scope link valid_lft forever preferred_lft forever3: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000 link/ether 00:0c:29:3b:e7:8f brd ff:ff:ff:ff:ff:ff[root@mcw03 ~]$

ip地址转发(DNAT实现ip地址转发，ip映射)

主机环境(将mcw02和mcw03的外网ip10网段的先停掉网卡，只剩内网ip172网段的，纯内网机子了)：10.0.0.11  172.16.0.11 mcw0110.0.0.12  172.16.0.12 mcw0210.0.0.13  172.16.0.13 mcw03配置过程中需要注意的事项请参考上面的snat和dnat配置过程查看环境，将之前已有的端口转发配置去掉[root@mcw01 ~]$ iptables -t nat -nLChain PREROUTING (policy ACCEPT)target     prot opt source               destination         DNAT       tcp  --  0.0.0.0/0            10.0.0.11            tcp dpt:9000 to:172.16.0.13:22Chain INPUT (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         Chain POSTROUTING (policy ACCEPT)target     prot opt source               destination         SNAT       all  --  172.16.0.13          0.0.0.0/0            to:10.0.0.11SNAT       all  --  172.16.0.0/24        0.0.0.0/0            to:10.0.0.11[root@mcw01 ~]$ iptables -t nat -D PREROUTING 1  #删除之前配置的端口转发，防止收到影响[root@mcw01 ~]$ iptables -t nat -nLChain PREROUTING (policy ACCEPT)target     prot opt source               destination         Chain INPUT (policy ACCEPT)target     prot opt source               destination         Chain OUTPUT (policy ACCEPT)target     prot opt source               destination         Chain POSTROUTING (policy ACCEPT)target     prot opt source               destination         SNAT       all  --  172.16.0.13          0.0.0.0/0            to:10.0.0.11SNAT       all  --  172.16.0.0/24        0.0.0.0/0            to:10.0.0.11[root@mcw01 ~]$在mcw01上添加一个新的公网ip，当访问这个公网ip10.0.0.111时，将它转发到内网服务器mcw03的内网ip172.16.0.13然后可以给这个公网ip,在网关mcw01上加上标签，这样在mcw01上就能看到这个ip了。[root@mcw01 ~]$ iptables -t nat -A PREROUTING -d 10.0.0.111 -j DNAT --to-destination 172.16.0.13[root@mcw01 ~]$ ip a a 10.0.0.111/24 dev ens33 label ens33:0[root@mcw01 ~]$ ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo       valid_lft forever preferred_lft forever    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000    link/ether 00:0c:29:4f:40:9c brd ff:ff:ff:ff:ff:ff    inet 172.16.0.11/24 brd 172.16.0.255 scope global ens34       valid_lft forever preferred_lft forever    inet6 fe80::9910:d66a:5b4d:7102/64 scope link        valid_lft forever preferred_lft forever    inet6 fe80::d4fb:80c5:2bc7:80e9/64 scope link tentative dadfailed        valid_lft forever preferred_lft forever3: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 00:0c:29:4f:40:92 brd ff:ff:ff:ff:ff:ff    inet 10.0.0.11/24 brd 10.0.0.255 scope global ens33       valid_lft forever preferred_lft forever    inet 10.0.0.111/24 scope global secondary ens33:0       valid_lft forever preferred_lft forever    inet6 fe80::cdd:d005:758:ad29/64 scope link        valid_lft forever preferred_lft forever[root@mcw01 ~]$ ^C验证：当我在外网连接刚刚在mcw01上添加的公网ip10.0.0.111时，实际上连上了内网服务器mcw03上。也就是当用户访问mcw01上的外网ip10.0.0.111的某个端口服务时，它就会转发给内网服务器mcw03上对应的端口。这样就成功实现了ip地址转发。缺点是，只要某个服务器某个端口需要外网访问，就要对应一个外网ip，而一般情况下，不需要访问这么多端口，所以浪费公网ip资源[c:\~]$ [c:\~]$ ssh root@10.0.0.111Connecting to 10.0.0.111:22...Connection established.To escape to local shell, press 'Ctrl+Alt+]'.Last login: Mon Mar  7 19:30:16 2022 from 10.0.0.1[root@mcw03 ~]$ hostname -I172.16.0.13 [root@mcw03 ~]$ ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo       valid_lft forever preferred_lft forever    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000    link/ether 00:0c:29:3b:e7:99 brd ff:ff:ff:ff:ff:ff    inet 172.16.0.13/24 brd 172.16.0.255 scope global ens34       valid_lft forever preferred_lft forever    inet6 fe80::d4fb:80c5:2bc7:80e9/64 scope link        valid_lft forever preferred_lft forever3: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 00:0c:29:3b:e7:8f brd ff:ff:ff:ff:ff:ff[root@mcw03 ~]$ 当删除这个标签后，就不能通过这个ip访问内网指定服务器了[root@mcw01 ~]$ ip a del 10.0.0.111/24 dev ens33 label ens33:0[root@mcw01 ~]$ ip a1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00    inet 127.0.0.1/8 scope host lo       valid_lft forever preferred_lft forever    inet6 ::1/128 scope host        valid_lft forever preferred_lft forever2: ens34: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 1000    link/ether 00:0c:29:4f:40:9c brd ff:ff:ff:ff:ff:ff    inet 172.16.0.11/24 brd 172.16.0.255 scope global ens34       valid_lft forever preferred_lft forever    inet6 fe80::9910:d66a:5b4d:7102/64 scope link        valid_lft forever preferred_lft forever    inet6 fe80::d4fb:80c5:2bc7:80e9/64 scope link tentative dadfailed        valid_lft forever preferred_lft forever3: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000    link/ether 00:0c:29:4f:40:92 brd ff:ff:ff:ff:ff:ff    inet 10.0.0.11/24 brd 10.0.0.255 scope global ens33       valid_lft forever preferred_lft forever    inet6 fe80::cdd:d005:758:ad29/64 scope link        valid_lft forever preferred_lft forever[root@mcw01 ~]$

-F不能清除nat表的规则

[root@mcw01 ~]$ iptables -nLChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@mcw01 ~]$ iptables -t nat -nLChain PREROUTING (policy ACCEPT)target prot opt source destination DNAT all -- 0.0.0.0/0 10.0.0.111 to:172.16.0.13Chain INPUT (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination Chain POSTROUTING (policy ACCEPT)target prot opt source destination SNAT all -- 172.16.0.13 0.0.0.0/0 to:10.0.0.11SNAT all -- 172.16.0.0/24 0.0.0.0/0 to:10.0.0.11[root@mcw01 ~]$ [root@mcw01 ~]$ iptables -F[root@mcw01 ~]$ iptables -t nat -nLChain PREROUTING (policy ACCEPT)target prot opt source destination DNAT all -- 0.0.0.0/0 10.0.0.111 to:172.16.0.13Chain INPUT (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination Chain POSTROUTING (policy ACCEPT)target prot opt source destination SNAT all -- 172.16.0.13 0.0.0.0/0 to:10.0.0.11SNAT all -- 172.16.0.0/24 0.0.0.0/0 to:10.0.0.11[root@mcw01 ~]$ iptables -F[root@mcw01 ~]$ iptables -X[root@mcw01 ~]$ iptables -Z[root@mcw01 ~]$ iptables -t nat -nLChain PREROUTING (policy ACCEPT)target prot opt source destination DNAT all -- 0.0.0.0/0 10.0.0.111 to:172.16.0.13Chain INPUT (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination Chain POSTROUTING (policy ACCEPT)target prot opt source destination SNAT all -- 172.16.0.13 0.0.0.0/0 to:10.0.0.11SNAT all -- 172.16.0.0/24 0.0.0.0/0 to:10.0.0.11[root@mcw01 ~]$

原文地址：
https://www.cnblogs.com/machangwei-8/p/15978257.html

本站仅提供存储服务，所有内容均由用户发布，如发现有害或侵权内容，请点击举报。
打开APP，阅读全文并永久保存 查看更多类似文章
猜你喜欢
类似文章
【热】打开小程序，算一算2024你的财运
linux iptables配置
CentOS iptables配置笔记
【自动保存】场景：A:外网：eth0：1.2.3.4...
Docker 网络学习笔记
iptables
ftp服务的搭建和问题解答
更多类似文章 >>
生活服务
热点新闻
留言交流
回顶部
联系我们
分享 收藏 导长图 关注 下载文章
绑定账号成功
后续可登录账号畅享VIP特权！
如果VIP功能使用有故障，
可点击这里联系客服！

联系客服