iptables配置模版
$ iptables -A INPUT -p tcp --dport 80 -j ACCEPT
1、
iptables -t raw -A PREROUTING -i eth0 -p tcp --dport 8888 --syn -j NOTRACK iptables -A INPUT -i eth0 -p tcp --dport 8888 -m state --state UNTRACKED,INVALID -j SYNPROXY --sack-perm --timestamp --mss 1480 --wscale 7 --ecn echo 0 > /proc/sys/net/netfilter/nf_conntrack_tcp_loose
2、
-s 源地址
--sport 源端口
-d 目标地址
--dport 目标端口
3、
# Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 45000:50000 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited -A OUTPUT -p udp --dport 53 -d 8.8.8.8 -j ACCEPT # ntpdate 1.asia.pool.ntp.org -A OUTPUT -p udp --dport 123 -j ACCEPT -A OUTPUT -p tcp --dport 80 -d 121.10.139.19 -j ACCEPT -A OUTPUT -m state --state ESTABLISHED,RELATED -p tcp --sport 20 -j ACCEPT -A OUTPUT -m state --state ESTABLISHED,RELATED -p tcp --sport 21 -j ACCEPT -A OUTPUT -m state --state ESTABLISHED,RELATED -p tcp --sport 22 -j ACCEPT -A OUTPUT -m state --state ESTABLISHED,RELATED -p tcp --sport 80 -j ACCEPT -A OUTPUT -m state --state ESTABLISHED,RELATED -p tcp --sport 3306 -j ACCEPT -A OUTPUT -m state --state ESTABLISHED,RELATED -p tcp --sport 45000:50000 -j ACCEPT -A OUTPUT -p tcp -d 127.0.0.1 -j ACCEPT -A OUTPUT -p tcp -d 203.124.14.0/24 -j ACCEPT -A OUTPUT -m tcp -p tcp -d 121.10.139.19 --dport 3306 -j ACCEPT -A INPUT -p tcp ! -d 127.0.0.1 -m connlimit --connlimit-above 10 --connlimit-mask 32 -j DROP -A OUTPUT -p tcp ! -d 127.0.0.1 -m connlimit --connlimit-above 5 --connlimit-mask 32 -j DROP -A INPUT -j DROP -A FORWARD -j DROP -A OUTPUT -j DROP COMMIT
4、本机端口转发
# 访问8082端口实际请求到80端口 $ iptables -t nat -A PREROUTING -p tcp --dport 8082 -j REDIRECT --to-ports 80 # udp $ iptables -t nat -A PREROUTING -p tcp --dport 8082 -j REDIRECT --to-ports 80
5、端口转发
# 访问 192.168.1.2:20022 实际访问 192.168.1.3:22 iptables -t nat -A PREROUTING -p tcp -d 192.168.1.2 --dport 20022 -j DNAT --to-destination 192.168.1.3:22 iptables -t nat -I POSTROUTING -p tcp -d 192.168.1.3 --dport 22 -j SNAT --to-source 192.168.1.2
6、firewall
# 添加端口 firewall-cmd --zone=public --add-port=80/tcp --permanent # 添加多个端口 firewall-cmd --zone=public --add-port=8000-8080/tcp --permanent # 移除端口 firewall-cmd --zone=public --remove-port=80/tcp --permanent