一、认识iptables

二、Iptables命令2.1、语法：iptables -t table 命令 chain rules -j targettable：有filter、nat、mangle，默认是filter命令：-L 或 --list 查看iptables规则列表[root@appex ~]# iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination -v 显示更多设置，-n 以数字形式显示IP地址和端口[root@appex ~]#iptables -L FORWARD -nv Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)pkts bytes target prot opt in out source destination 0 0 ACCEPT all -- 172.16.2.0/24 172.16.3.0/24 limit: avg 3/hour burst 1000 0 0 ACCEPT all -- 172.16.2.0/24 172.16.3.0/24 limit: avg 303/sec burst 5 0 0 DROP all -- 172.16.2.0/24 172.16.3.0/24 limit: avg 303/sec burst 5 -P 或 --policy 定义默认策略[root@appex ~]# iptables -t filter -P FORWARD DROP [root@appex ~]#iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy DROP)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@appex ~]# iptables -t filter -P FORWARD ACCEPT[root@appex ~]#iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination -A 或--append 在规则列表的最后增加一条规则[root@appex ~]#iptables -t filter -A FORWARD -p icmp -j DROP[root@appex ~]#iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy DROP)target prot opt source destination DROP icmp -- anywhere anywhere Chain OUTPUT (policy ACCEPT)target prot opt source destination -I或--insert 在规则列表的最前面插入一条规则[root@appex ~]# iptables -t filter -I FORWARD 2 -p icmp -j ACCEPT[root@appex ~]# iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy DROP)target prot opt source destination DROP icmp -- anywhere anywhere ACCEPT icmp -- anywhere anywhere Chain OUTPUT (policy ACCEPT)target prot opt source destination -R或--replace 替换规则列表中的某条规则[root@appex ~]#iptables -t filter -R FORWARD 2 -p icmp -j DROP[root@appex ~]#iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy DROP)target prot opt source destination DROP icmp -- anywhere anywhere DROP icmp -- anywhere anywhere Chain OUTPUT (policy ACCEPT)target prot opt source destination -D或--delete 从规则列表中删除一条规则[root@appex ~]#iptables -t filter -D FORWARD 2[root@appex ~]#iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy DROP)target prot opt source destination DROP icmp -- anywhere anywhere Chain OUTPUT (policy ACCEPT)target prot opt source destination -F或--flush 删除表中所有的规则[root@appex ~]#iptables -t filter -F[root@appex ~]#iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy DROP)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination 2.2、Iptables匹配选项-i或--in-interface 指定数据包从哪块网络接口进入，如eth0、eth1等-o或--out-interface 指定数据包从哪块网络接口输出，如eth0、eth1等[root@appex ~]# iptables -t filter -I FORWARD -i eth0 -j DROP[root@appex ~]# iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT)target prot opt source destination -p或--protocol 指定数据包匹配的协议，如TCP、UDP、ICMP等-s或--source 指定数据包匹配的源地址-d或--destination 指定数据包匹配的目的地址--sport 指定数据包匹配的源端口号，可以使用”起始端口号：结束端口号”的格式指定一个范围--dport 指定数据包匹配的目标端口号，可以使用”起始端口号：结束端口号”的格式指定一个范围[root@appex ~]# iptables -t filter -I FORWARD -p tcp -s 10.0.0.90/32 -d 10.0.0.80/32 --dport 3389 -j DROP[root@appex ~]# iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination DROP tcp -- 10.0.0.90 10.0.0.80 tcp dpt:ms-wbt-server DROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@appex ~]#iptables -t filter -I FORWARD -p tcp -s 10.0.0.0/24 -d 10.10.10.0/24 --dport 3389 -j DROP[root@appex ~]# iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination DROP tcp -- 10.0.0.0/24 10.0.10.0/24 tcp dpt:ms-wbt-server DROP tcp -- 10.0.0.90 10.0.0.80 tcp dpt:ms-wbt-serverDROP all -- anywhere anywhere Chain OUTPUT (policy ACCEPT)target prot opt source destination 2.3、Iptables使用扩展选项限制网速：-m limit --limit控制瞬间爆发流量：-m limit --limit-burst [root@appex ~]# iptables -t filter -F[root@appex ~]#iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@appex ~]# iptables -t filter -I FORWARD -s 172.16.2.0/24 -d 172.16.3.0/24 -m limit --limit 300/second -j ACCEPT[root@appex ~]#iptables -t filter -A FORWARD -s 172.16.2.0/24 -d 172.16.3.0/24 -m limit --limit 300/second -j DROP //超过的就drop[root@appex ~]#iptables -t filter -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination ACCEPT all -- 172.16.2.0/24 172.16.3.0/24 limit: avg 303/sec burst 5 DROP all -- 172.16.2.0/24 172.16.3.0/24 limit: avg 303/sec burst 5 Chain OUTPUT (policy ACCEPT)target prot opt source destination [root@appex ~]#iptables -t filter -I FORWARD -s 172.16.2.0/24 -d 172.16.3.0/24 -m limit --limit-burst 1000 -j ACCEPT[root@appex ~]#iptables -LChain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination ACCEPT all -- 172.16.2.0/24 172.16.3.0/24 limit: avg 3/hour burst 1000 ACCEPT all -- 172.16.2.0/24 172.16.3.0/24 limit: avg 303/sec burst 5 DROP all -- 172.16.2.0/24 172.16.3.0/24 limit: avg 303/sec burst 5 Chain OUTPUT (policy ACCEPT)target prot opt source destination 2.4、处理动作-j 参数用来指定要进行的处理动作，常用的处理动作包括：ACCEPT、REJECT、DROP、REDIRCT、MASQUERADE、LOG、DNAT、SNAT、MIRROR、QUEUE、RETURN、MARKFilter表能使用的主要动作：ACCEPT:将封包放行，进行完此处理动作后，将不再匹配其他规则，直接跳往下一个规则链REJECT:拦截该封包，并传送封包通知对方，进行完此处理动作后，将不再匹配其他规则，直接中断过滤程序DROP:丢弃封包不予处理，进行完此处理动作后，将不再匹配其他规则，直接中断过滤程序。三、保存和还原iptables设置3.1、保存修改的iptables到配置文件中[root@appex ~]# /etc/rc.d/init.d/iptables save3.2、查看iptables的配置文件[root@appex ~]# cat /etc/sysconfig/iptables3.3、保存修改的iptables到一个文件中及从文件中导入到iptables中[root@appex ~]# iptables-save >iptables.conf1[root@appex ~]# iptables-restore< iptables.conf1四、配置NAT实现网络地址转换[root@appex ~]# ifconfig eth0:0 10.0.0.81 netmask 255.255.255.0[root@appex ~]#ip addr show eth0:02: eth0: < BROADCAST,MULTICAST,UP,LOWER_UP > mtu 1500 qdisc pfifo_fast state UP qlen 1000link/ether 00:0c:29:21:85:0e brd ff:ff:ff:ff:ff:ffinet 10.0.0.80/24 brd 10.0.0.255 scope global eth0inet 10.0.0.81/24 brd 10.0.0.255 scope global secondary eth0:0inet6 fe80::20c:29ff:fe21:850e/64 scope link valid_lft forever preferred_lft forever[root@appex ~]# iptables -t nat -L POSTROUTINGChain POSTROUTING (policy ACCEPT)target prot opt source destination [root@appex ~]# iptables -t nat -A POSTROUTING -s 10.0.10.0/24 -o eth0 -j SNAT --to-source 10.0.0.80-10.0.0.81[root@appex ~]#iptables -t nat -L POSTROUTING -nvChain POSTROUTING (policy ACCEPT 3 packets, 205 bytes)pkts bytes target prot opt in out source destination 0 0 SNAT all -- - eth0 10.0.10.0/24 0.0.0.0/0 to:10.0.0.80-10.0.0.81 五、mangle表的应用--ttl-inc 1--ttl-dec 2--ttl-set 40[root@appex ~]#iptables -t mangle -LChain PREROUTING (policy ACCEPT)target prot opt source destination Chain INPUT (policy ACCEPT)target prot opt source destination Chain FORWARD (policy ACCEPT)target prot opt source destination Chain OUTPUT (policy ACCEPT)target prot opt source destination Chain POSTROUTING (policy ACCEPT)target prot opt source destination [root@appex ~]# iptables -t mangle -I PREROUTING -i eth0 -j TTL --ttl-inc 1[root@appex ~]#iptables -t mangle -I PREROUTING -i eth0 -j TTL --ttl-dec 2[root@appex ~]# iptables -t mangle -A PREROUTING -i eth0 -j TTL --ttl-set 40[root@appex ~]#iptables -t mangle -L PREROUTING Chain PREROUTING (policy ACCEPT)target prot opt source destination TTL all -- anywhere anywhere TTL decrement by 2 TTL all -- anywhere anywhere TTL increment by 1 TTL all -- anywhere anywhere TTL set to 40