iptables
iptables是用户空间中写内容发送到内核中的五个位置上，帮我们生成规则的工具。iptables命令分为匹配条件和之后的处理动作。
其中匹配条件分两种：
- 基本匹配条件
-s，检查报文中的源ip地址
-d，检查报文中的目标ip地址
-p，检查报文中的协议
-i，数据报文的流入接口
-o，检查报文的流出接口 - 扩展匹配条件
隐式扩展——在使用-p选项指明了特定的协议时，无需再同时使用-m选项指明扩展模块的扩展机制
显式扩展——必须使用-m选项指明要调用的扩展模块的扩展机制
其中使用显示的扩展匹配条件分为七种，可以让访问者发送到本机的报文实现多端口匹配、地址范围匹配、连接追踪、字符串匹配、时间匹配、并发连接限制、报文状态匹配等应用。
环境配置
提供服务器的主机：192.168.10.10
远程访问的主机：192.168.10.11
现在服务器上iptables规则是空的
[root@localhost ~]# iptables -vnL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination
服务端安装软件包来测试
[root@localhost ~]# yum -y install httpd telnet-server samba tftp-server vsftpd mariadb-server
配置服务端iptables规则
[root@localhost ~]# iptables -A INPUT -d 192.168.10.10 -p tcp --dport 22 -j ACCEPT
[root@localhost ~]# iptables -A OUTPUT -s 192.168.10.10 -p tcp --sport 22 -j ACCEPT
#先放行ssh连接
[root@localhost ~]# iptables -A INPUT -i ens33 -j REJECT
[root@localhost ~]# iptables -A OUTPUT -o ens33 -j REJECT
#拒绝服务器网络接口的所有连接
[root@localhost ~]# iptables -I OUTPUT 2 -s 192.168.10.10 -p icmp --icmp-type 8 -j ACCEPT
[root@localhost ~]# iptables -I INPUT 2 -d 192.168.10.10 -p icmp --icmp-type 0/0 -j ACCEPT
#放行服务器ping外部主机的报文
现在服务器的iptables规则如下：
[root@localhost ~]# iptables -vnL --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 2090 187K ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 tcp dpt:22
2 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.10.10 icmptype 0 code 0
3 15 1533 REJECT all -- ens33 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 1524 301K ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 tcp spt:22
2 0 0 ACCEPT icmp -- * * 192.168.10.10 0.0.0.0/0 icmptype 8
3 49 4080 REJECT all -- * ens33 0.0.0.0/0 0.0.0.0/0 reje
1. multiport，多端口匹配
服务器启动http和samba服务，80，139，445端口都被监听
[root@localhost ~]# systemctl start httpd.service nmb.service smb.service
[root@localhost ~]# ss -tnl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 50 *:139 *:*
LISTEN 0 128 *:111 *:*
LISTEN 0 128 *:22 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 50 *:445 *:*
LISTEN 0 50 :::139 :::*
LISTEN 0 128 :::111 :::*
LISTEN 0 128 :::80 :::*
LISTEN 0 128 :::22 :::*
LISTEN 0 100 ::1:25 :::*
LISTEN 0 50 :::445 :::*
[root@localhost ~]# vim /var/www/html/index.html
<h1>Hello world!</h1>
#创建web首页
此时用浏览器访问不成功，httpd服务虽然开了，但是防火墙不允许
图片.png
配置iptables开放各个服务端口
[root@localhost ~]# iptables -I INPUT -d 192.168.10.10 -p udp --dport 137:138 -j ACCEPT
[root@localhost ~]# iptables -I OUTPUT -s 192.168.10.10 -p udp --sport 137:138 -j ACCEPT
#开放samba名称解析服务
[root@localhost ~]# iptables -R INPUT 2 -d 192.168.10.10 -p tcp -m multiport --dports 22,80,139,445 -j ACCEPT
[root@localhost ~]# iptables -R OUTPUT 2 -s 192.168.10.10 -p tcp -m multiport --sports 22,80,139,445 -j ACCEPT
#修改第二条规则，增加开放80和139，445这三个端口，现在httpd和samba服务在防火墙中都允许访问
现在iptables规则如下：
[root@localhost ~]# iptables -vnL --line-numbers
Chain INPUT (policy ACCEPT 12 packets, 1248 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 udp dpts:137:138
2 177 16504 ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 multiport dports 22,80,139,445
3 4 336 ACCEPT icmp -- * * 0.0.0.0/0 192.168.10.10 icmptype 0 code 0
4 41 4466 REJECT all -- ens33 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 12 packets, 1248 bytes)
num pkts bytes target prot opt in out source destination
1 10 1134 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 udp spts:137:138
2 11 1364 ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 multiport sports 22,80,139,445
3 4 336 ACCEPT icmp -- * * 192.168.10.10 0.0.0.0/0 icmptype 8
4 181 15197 REJECT all -- * ens33 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
浏览器成功访问
图片.png
此时客户端连接服务器的samba服务成功
[root@localhost ~]# smbclient -L 192.168.10.10
Enter SAMBA\root's password:
Anonymous login successful
Sharename Type Comment
--------- ---- -------
myfiles Disk A test shared dir.
IPC$ IPC IPC Service (Samba Server Version 4.7.1)
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful
Server Comment
--------- -------
Workgroup Master
--------- -------
MYGROUP
2. iprange，IP范围匹配
[root@localhost ~]# useradd centos
[root@localhost ~]# echo 112233 | passwd --stdin centos
#添加账户，设置密码
[root@localhost ~]# systemctl start telnet.socket
#启动telnet服务
[root@localhost ~]# ss -tnl | grep 23
LISTEN 0 128 :::23 :::*
#telnet服务的23端口被监听
添加规则允许IP范围连接23端口
[root@localhost ~]# iptables -I INPUT 3 -d 192.168.10.10 -p tcp --dport 23 -m iprange --src-range 192.168.10.10-192.168.10.12 -j ACCEPT
[root@localhost ~]# iptables -I OUTPUT 3 -s 192.168.10.10 -p tcp --sport 23 -m iprange --dst-range 192.168.10.10-192.168.10.12 -j ACCEPT
此时iptables规则：
[root@localhost ~]# iptables -vnL --line-numbers
Chain INPUT (policy ACCEPT 8 packets, 832 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 udp dpts:137:138
2 898 76002 ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 multiport dports 22,80,139,445
3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 tcp dpt:23 source IP range 192.168.10.10-192.168.10.12
4 4 336 ACCEPT icmp -- * * 0.0.0.0/0 192.168.10.10 icmptype 0 code 0
5 61 6697 REJECT all -- ens33 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 8 packets, 832 bytes)
num pkts bytes target prot opt in out source destination
1 28 2892 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 udp spts:137:138
2 504 61425 ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 multiport sports 22,80,139,445
3 0 0 ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 tcp spt:23 destination IP range 192.168.10.10-192.168.10.12
4 4 336 ACCEPT icmp -- * * 192.168.10.10 0.0.0.0/0 icmptype 8
5 261 21265 REJECT all -- * ens33 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
使用192.168.10.11的telnet连接服务器，连接正常
[root@localhost ~]# telnet 192.168.10.10
Trying 192.168.10.10...
Connected to 192.168.10.10.
Escape character is '^]'.
Kernel 3.10.0-693.el7.x86_64 on an x86_64
localhost login: centos
Password:
[centos@localhost ~]$ ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet 192.168.10.10 netmask 255.255.255.0 broadcast 192.168.10.255
inet6 fe80::48ce:e732:4093:e240 prefixlen 64 scopeid 0x20<link>
ether 00:0c:29:5b:bb:9e txqueuelen 1000 (Ethernet)
RX packets 12605 bytes 11697499 (11.1 MiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 6849 bytes 845935 (826.1 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10<host>
loop txqueuelen 1 (Local Loopback)
RX packets 330 bytes 32456 (31.6 KiB)
RX errors 0 dropped 0 overruns 0 frame 0
TX packets 330 bytes 32456 (31.6 KiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
使用不在服务器配置IP范围内的主机192.168.10.13来连接，不成功
[root@localhost ~]# telnet 192.168.10.10
Trying 192.168.10.10...
telnet: connect to address 192.168.10.10: Connection timed out
3. time，匹配能访问网络的时间
开放同步时间服务端口，客户端同步用的323，使用ntp命令同步用的123
[root@localhost ~]# iptables -I OUTPUT 4 -s 192.168.10.10 -p udp -m multiport --dports 123,323 -j ACCEPT
[root@localhost ~]# iptables -I INPUT 4 -d 192.168.10.10 -p udp -m multiport --sports 123,323 -j ACCEPT
配置允许访问的IP段在什么时间才允许访问
[root@localhost ~]# iptables -R INPUT 3 -d 192.168.10.10 -p tcp --dport 23 -m iprange --src-range 192.168.10.10-192.168.10.12 -m time --timestart 12:00:00 --timestop 16:00:00 --weekdays 1,2,3,4,5 --kerneltz -j ACCEPT
[root@localhost ~]# iptables -R OUTPUT 3 -s 192.168.10.10 -p tcp --sport 23 -m iprange --dst-range 192.168.10.10-192.168.10.12 -m time --timestart 12:00:00 --timestop 16:00:00 --weekdays 1,2,3,4,5 --kerneltz -j ACCEPT
#在周一到周五的12点至16点允许访问，周六周日全天允许访问，--kerneltz使用内核中的时间
此时规则如下：
[root@localhost ~]# iptables -vnL --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 udp dpts:137:138
2 1922 158K ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 multiport dports 22,80,139,445
3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 tcp dpt:23 source IP range 192.168.10.10-192.168.10.12 TIME from 12:00:00 to 16:00:00 on Mon,Tue,Wed,Thu,Fri
4 27 2052 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 multiport sports 123,323
5 4 336 ACCEPT icmp -- * * 0.0.0.0/0 192.168.10.10 icmptype 0 code 0
6 104 11233 REJECT all -- ens33 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 55 5529 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 udp spts:137:138
2 1216 146K ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 multiport sports 22,80,139,445
3 0 0 ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 tcp spt:23 destination IP range 192.168.10.10-192.168.10.12 TIME from 12:00:00 to 16:00:00 on Mon,Tue,Wed,Thu,Fri
4 31 2356 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 multiport dports 123,323
5 4 336 ACCEPT icmp -- * * 192.168.10.10 0.0.0.0/0 icmptype 8
6 338 27293 REJECT all -- * ens33 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
使用在范围内的主机连接也失败，因为我这的时间未到12点
[root@localhost ~]# telnet 192.168.10.10
Trying 192.168.10.10...
telnet: connect to address 192.168.10.10: Connection timed out
把时间改为10点至16点，我这现在时间是11点
[root@localhost ~]# iptables -R OUTPUT 3 -s 192.168.10.10 -p tcp --sport 23 -m iprange --dst-range 192.168.10.10-192.168.10.12 -m time --timestart 10:00:00 --timestop 16:00:00 --weekdays 1,2,3,4,5 --kerneltz -j ACCEPT
[root@localhost ~]# iptables -R INPUT 3 -d 192.168.10.10 -p tcp --dport 23 -m iprange --src-range 192.168.10.10-192.168.10.12 -m time --timestart 10:00:00 --timestop 16:00:00 --weekdays 1,2,3,4,5 --kerneltz -j ACCEPT
连接登录成功
[root@localhost ~]# telnet 192.168.10.10
Trying 192.168.10.10...
Connected to 192.168.10.10.
Escape character is '^]'.
Kernel 3.10.0-693.el7.x86_64 on an x86_64
localhost login: centos
Password:
Last login: Wed Jun 27 22:44:22 from ::ffff:192.168.10.11
4. string，字符串匹配
配置网站网页包含敏感字符串apple时，用户访问时不让响应
[root@localhost ~]# vim /var/www/html/test.html
hi apple,how are you!
[root@localhost ~]# iptables -I OUTPUT -s 192.168.10.10 -m string --algo kmp --string "apple" -j REJECT
#配置规则禁止apple字符串
iptables规则如下:
[root@localhost ~]# iptables -vnL --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 udp dpts:137:138
2 2915 236K ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 multiport dports 22,80,139,445
3 190 10244 ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 tcp dpt:23 source IP range 192.168.10.10-192.168.10.12 TIME from 10:00:00 to 16:00:00 on Mon,Tue,Wed,Thu,Fri
4 61 4636 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 multiport sports 123,323
5 4 336 ACCEPT icmp -- * * 0.0.0.0/0 192.168.10.10 icmptype 0 code 0
6 185 18276 REJECT all -- ens33 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 544 205K REJECT all -- * * 192.168.10.10 0.0.0.0/0 STRING match "apple" ALGO name kmp TO 65535 reject-with icmp-port-unreachable
2 73 7287 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 udp spts:137:138
3 1876 231K ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 multiport sports 22,80,139,445
4 108 6159 ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 tcp spt:23 destination IP range 192.168.10.10-192.168.10.12 TIME from 10:00:00 to 16:00:00 on Mon,Tue,Wed,Thu,Fri
5 65 4940 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 multiport dports 123,323
6 4 336 ACCEPT icmp -- * * 192.168.10.10 0.0.0.0/0 icmptype 8
7 410 33565 REJECT all -- * ens33 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
此时用浏览器访问test.html不能访问
图片.png
5. connlimit，单ip的并发连接数限制
[root@localhost ~]# systemctl start mariadb.service
[root@localhost ~]# mysql
MariaDB [(none)]> CREATE USER 'test'@'192.168.%.%' IDENTIFIED BY '112233';
MariaDB [(none)]> FLUSH PRIVILEGES;
MariaDB [(none)]> \q
[root@localhost ~]# vim /etc/my.cnf.d/server.cnf
[mysqld]
skip_name_resolve=ON
[root@localhost ~]# systemctl restart mariadb.service
[root@localhost ~]# iptables -I INPUT 2 -s 192.168.10.0/24 -d 192.168.10.10 -p tcp --dport 3306 -j ACCEPT
[root@localhost ~]# iptables -I OUTPUT 2 -d 192.168.10.0/24 -s 192.168.10.10 -p tcp --sport 3306 -j ACCEPT
#添加规则放行3306
iptables默认规则是黑名单，配置mysql连接数小于或等于2是允许访问
[root@localhost ~]# iptables -R INPUT 2 -s 192.168.10.0/24 -d 192.168.10.10 -p tcp --dport 3306 -m connlimit --connlimit-upto 2 -j ACCEPT
#只要修改入栈规则，不需修改出栈，因限制了入栈自然就不会有多余的出栈
iptables规则：
[root@localhost ~]# iptables -vnL --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 udp dpts:137:138
2 0 0 ACCEPT tcp -- * * 192.168.10.0/24 192.168.10.10 tcp dpt:3306 #conn src/32 <= 2
3 1453 112K ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 multiport dports 22,80,139,445
4 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 tcp dpt:23 source IP range 192.168.10.10-192.168.10.12 TIME from 10:00:00 to 16:00:00 on Mon,Tue,Wed,Thu,Fri
5 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 multiport sports 123,323
6 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.10.10 icmptype 0 code 0
7 7 942 REJECT all -- ens33 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all -- * * 192.168.10.10 0.0.0.0/0 STRING match "apple" ALGO name kmp TO 65535 reject-with icmp-port-unreachable
2 7 554 ACCEPT tcp -- * * 192.168.10.10 192.168.10.0/24 tcp spt:3306
3 0 0 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 udp spts:137:138
4 978 117K ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 multiport sports 22,80,139,445
5 0 0 ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 tcp spt:23 destination IP range 192.168.10.10-192.168.10.12 TIME from 10:00:00 to 16:00:00 on Mon,Tue,Wed,Thu,Fri
6 0 0 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 multiport dports 123,323
7 0 0 ACCEPT icmp -- * * 192.168.10.10 0.0.0.0/0 icmptype 8
8 4 352 REJECT all -- * ens33 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
同一个ip并发连接数据库超过两个时，在新增的连接不成功
图片.png
6. limit，速率限制
这里的限制是指报文的发包速率限制。使用的是令牌桶算法，每拿一个令牌才能相应的发一个报文，而令牌按照固定频率发放，在没有报文发送的时候，会像桶一样把令牌攒起来，在需要发送报文的时候会一次性把桶里的报文都发出去，这就叫做令牌桶算法。
添加规则
[root@localhost ~]# iptables -I INPUT 6 -d 192.168.10.10 -p icmp --icmp-type 8 -m limit --limit-burst 5 --limit 20/minute -j ACCEPT
[root@localhost ~]# iptables -I OUTPUT 6 -s 192.168.10.10 -p icmp --icmp-type 0 -j ACCEPT
iptables规则：
[root@localhost ~]# iptables -vnL --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 udp dpts:137:138
2 39 2688 ACCEPT tcp -- * * 192.168.10.0/24 192.168.10.10 tcp dpt:3306 #conn src/32 <= 2
3 1936 147K ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 multiport dports 22,80,139,445
4 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 tcp dpt:23 source IP range 192.168.10.10-192.168.10.12 TIME from 10:00:00 to 16:00:00 on Mon,Tue,Wed,Thu,Fri
5 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 multiport sports 123,323
6 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.10.10 icmptype 8 limit: avg 20/min burst 5
7 0 0 ACCEPT icmp -- * * 0.0.0.0/0 192.168.10.10 icmptype 0 code 0
8 19 2537 REJECT all -- ens33 * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 REJECT all -- * * 192.168.10.10 0.0.0.0/0 STRING match "apple" ALGO name kmp TO 65535 reject-with icmp-port-unreachable
2 35 2960 ACCEPT tcp -- * * 192.168.10.10 192.168.10.0/24 tcp spt:3306
3 0 0 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 udp spts:137:138
4 1278 152K ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 multiport sports 22,80,139,445
5 0 0 ACCEPT tcp -- * * 192.168.10.10 0.0.0.0/0 tcp spt:23 destination IP range 192.168.10.10-192.168.10.12 TIME from 10:00:00 to 16:00:00 on Mon,Tue,Wed,Thu,Fri
6 0 0 ACCEPT icmp -- * * 192.168.10.10 0.0.0.0/0 icmptype 0
7 0 0 ACCEPT udp -- * * 192.168.10.10 0.0.0.0/0 multiport dports 123,323
8 0 0 ACCEPT icmp -- * * 192.168.10.10 0.0.0.0/0 icmptype 8
9 11 968 REJECT all -- * ens33 0.0.0.0/0 0.0.0.0/0 reject-with icmp-port-unreachable
另一台主机发起ping请求，令牌桶用完后，3秒一个发包
图片.png
7. state，报文状态匹配
state是一个非常重要的扩展，可以基于连接追踪功能去查看每一报文当前所处的状态。不论什么协议，客户端第一次访问时，服务器会去内核内存中的追踪表查看他之前是否来过，查不到就证明是第一次来，记录入追踪表，如果查到以前来过就不检查规则，直接允许访问，这称为连接追踪机制。在访问量特别大的场景下，比如负载均衡服务器不建议开启，追踪表最大只能记录6万多的条目，访问数超过就会无法记录出错，导致所有的连接失败。
报文状态有五种：
NEW: 第一次连接时
ESTABLISHED：已建立的连接；
INVALID：无法识别的连接；
RELATED：相关联的连接，当前连接是一个新请求，但附属于某个已存在的连接
UNTRACKED：row表上关闭连接追踪功能
使用此扩展可以使规则写的更简洁，无论请求本地的任何服务，只要NEW之后的再次连接都认为是没问题的，把入栈的第一条规则匹配ESTABLISHED状态放行，此时会提升很高效率。
配置规则：
[root@localhost ~]# iptables -F
#清空之前的所有规则
[root@localhost ~]# iptables -A INPUT -d 192.168.10.10 -p tcp -m multiport --dports 22:23,80,139,445,3306 -m state --state NEW -j ACCEPT
#tcp协议的22:23,80,139,445,3306这些端口的NEW请求都允许连接
[root@localhost ~]# iptables -I INPUT -d 192.168.10.10 -m state --state ESTABLISHED -j ACCEPT
[root@localhost ~]# iptables -A OUTPUT -s 192.168.10.10 -m state --state ESTABLISHED -j ACCEPT
#入栈和出栈的ESTABLISHED状态都允许连接
[root@localhost ~]# iptables -I INPUT 2 -d 192.168.10.10 -p udp --dport 137:138 -m state --state NEW -j ACCEPT
#udp的137，138端口第一次NEW访问时放行
[root@localhost ~]# iptables -A INPUT -d 192.168.10.10 -j REJECT
[root@localhost ~]# iptables -A OUTPUT -d 192.168.10.10 -j REJECT
#把默认规则设置为拒绝REJECT
iptables规则：
[root@localhost ~]# iptables -vnL --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 884 70044 ACCEPT all -- * * 0.0.0.0/0 192.168.10.10 state ESTABLISHED
2 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 udp dpts:137:138 state NEW
3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 multiport dports 22:23,80,139,445,3306 state NEW
4 0 0 REJECT all -- * * 0.0.0.0/0 192.168.10.10 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 519 53140 ACCEPT all -- * * 192.168.10.10 0.0.0.0/0 state ESTABLISHED
2 0 0 REJECT all -- * * 0.0.0.0/0 192.168.10.10 reject-with icmp-port-unreachable
测试以下四种服务都成功访问
图片.png
[root@localhost ~]# smbclient -L 192.168.10.10
Enter SAMBA\root's password:
Anonymous login successful
Sharename Type Comment
--------- ---- -------
myfiles Disk A test shared dir.
IPC$ IPC IPC Service (Samba Server Version 4.7.1)
Reconnecting with SMB1 for workgroup listing.
Anonymous login successful
Server Comment
--------- -------
Workgroup Master
--------- -------
MYGROUP
[root@localhost ~]# telnet 192.168.10.10
Trying 192.168.10.10...
Connected to 192.168.10.10.
Escape character is '^]'.
Kernel 3.10.0-693.el7.x86_64 on an x86_64
localhost login: centos
Password:
Last login: Wed Jun 27 11:30:24 from ::ffff:192.168.10.11
[root@localhost ~]# mysql -utest -h192.168.10.10 -p112233
Welcome to the MariaDB monitor. Commands end with ; or \g.
Your MariaDB connection id is 10
Server version: 5.5.56-MariaDB MariaDB Server
Copyright (c) 2000, 2017, Oracle, MariaDB Corporation Ab and others.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
MariaDB [(none)]>
现在配置放行ftp服务
[root@localhost ~]# systemctl start vsftpd.service
[root@localhost ~]# ss -tnl | grep 21
LISTEN 0 32 :::21 :::*
#21端口已被监听
[root@localhost ~]# modprobe nf_conntrack_ftp
#安装ftp追踪模块
修改规则：
[root@localhost ~]# iptables -R INPUT 3 -d 192.168.10.10 -p tcp -m multiport --dports 21:23,80,139,445,3306 -m state --state NEW -j ACCEPT
#现在对规则改造下，添加21端口
[root@localhost ~]# iptables -R INPUT 1 -d 192.168.10.10 -m state --state ESTABLISHED,RELATED -j ACCEPT
#添加RELATED
iptables规则：
[root@localhost ~]# iptables -vnL --line-numbers
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 12 940 ACCEPT all -- * * 0.0.0.0/0 192.168.10.10 state RELATED,ESTABLISHED
2 0 0 ACCEPT udp -- * * 0.0.0.0/0 192.168.10.10 udp dpts:137:138 state NEW
3 0 0 ACCEPT tcp -- * * 0.0.0.0/0 192.168.10.10 multiport dports 21:23,80,139,445,3306 state NEW
4 0 0 REJECT all -- * * 0.0.0.0/0 192.168.10.10 reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 1315 143K ACCEPT all -- * * 192.168.10.10 0.0.0.0/0 state ESTABLISHED
2 22 1628 REJECT all -- * * 0.0.0.0/0 192.168.10.10 reject-with icmp-port-unreachable
另一台主机ftp登录测试：
[root@localhost ~]# ftp 192.168.10.10
Connected to 192.168.10.10 (192.168.10.10).
220 (vsFTPd 3.0.2)
Name (192.168.10.10:root):
530 Permission denied.
Login failed.
ftp> ls
#匿名登录成功
