8.2.2 基本的命令参数
根据OSI七层模型的定义，iptables属于数据链路层的服务，所以可以根据流量的源地址、目的地址、传输协议、服务类型等信息进行匹配；一旦匹配成功，iptables就会根据策略规则所预设的动作来处理这些流量。
防火墙策略规则的匹配顺序是从上到下的，因此要把较为严格、优先级较高的策略规则放到前面。
iptables中常数以及作用
| 参数 | 作用 |
| -P | 设置默认策略 |
| -F | 清空规则链 |
| -L | 查看规则链 |
| -A | 在规则链的末尾加入新规则 |
| -I num | 在规则链的头部加入新规则 |
| -D num | 删除一条规则 |
| -s | 匹配来源地址IP/MASK，加叹号“！”表示除这个IP外 |
| -d | 匹配目标地址 |
| -i 网卡名称 | 匹配从这块网卡流入的数据 |
| -o 网卡名称 | 匹配从这块网卡流出的数据 |
| -p | 匹配协议，如TCP、UDP、ICMP |
| --dport num | 匹配目标端口号 |
| --sport num | 匹配来源端口号 |
实验1：在iptables命令后添加-L参数查看已有的防火墙规则链
[root@localhost ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination LIBVIRT_INP all -- anywhere anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination LIBVIRT_FWX all -- anywhere anywhere LIBVIRT_FWI all -- anywhere anywhere LIBVIRT_FWO all -- anywhere anywhere Chain OUTPUT (policy ACCEPT) target prot opt source destination LIBVIRT_OUT all -- anywhere anywhere Chain LIBVIRT_INP (1 references) target prot opt source destination ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT udp -- anywhere anywhere udp dpt:bootps ACCEPT tcp -- anywhere anywhere tcp dpt:bootps Chain LIBVIRT_OUT (1 references) target prot opt source destination ACCEPT udp -- anywhere anywhere udp dpt:domain ACCEPT tcp -- anywhere anywhere tcp dpt:domain ACCEPT udp -- anywhere anywhere udp dpt:bootpc ACCEPT tcp -- anywhere anywhere tcp dpt:bootpc Chain LIBVIRT_FWO (1 references) target prot opt source destination ACCEPT all -- 192.168.122.0/24 anywhere REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain LIBVIRT_FWI (1 references) target prot opt source destination ACCEPT all -- anywhere 192.168.122.0/24 ctstate RELATED,ESTABLISHED REJECT all -- anywhere anywhere reject-with icmp-port-unreachable Chain LIBVIRT_FWX (1 references) target prot opt source destination ACCEPT all -- anywhere anywhere
实验2：在iptables命令后添加-F参数清空已有的防火墙规则链
[root@localhost ~]# iptables -F [root@localhost ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain LIBVIRT_INP (0 references) target prot opt source destination Chain LIBVIRT_OUT (0 references) target prot opt source destination Chain LIBVIRT_FWO (0 references) target prot opt source destination Chain LIBVIRT_FWI (0 references) target prot opt source destination Chain LIBVIRT_FWX (0 references) target prot opt source destination
实验3：把INPUT规则链的默认策略设置为拒绝。
[root@localhost ~]# iptables -P INPUT DROP [root@localhost ~]# iptables -L Chain INPUT (policy DROP) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain LIBVIRT_INP (0 references) target prot opt source destination Chain LIBVIRT_OUT (0 references) target prot opt source destination Chain LIBVIRT_FWO (0 references) target prot opt source destination Chain LIBVIRT_FWI (0 references) target prot opt source destination Chain LIBVIRT_FWX (0 references) target prot opt source destination
※ 通过iptables -L 查看规则链发现iptables不像腾讯云上的安全组一样是默认拒绝策略规则。这时可以通过iptables -P INPUT DROP 设置为默认拒绝规则。这里还需注意设置为默认拒绝后所有的端口开放将会被拒绝包括ssh连接会断开。
当把INPUT链设置为默认拒绝后，就要往里面写入允许策略了，否则所有流入的数据包都会被默认拒绝掉。需要注意的是，规则链的默认策略拒绝动作只能是DROP，而不能是REJECT。
实验4：向INPUT链中添加允许ICMP流量进入的策略规则（加入ICMP规则后即表示允许发送方ping命令检测行为）。
[root@localhost ~]# iptables -I INPUT -p icmp -j ACCEPT [root@localhost ~]# ping -c 4 192.168.72.10 PING 192.168.72.10 (192.168.72.10) 56(84) bytes of data. 64 bytes from 192.168.72.10: icmp_seq=1 ttl=64 time=0.122 ms 64 bytes from 192.168.72.10: icmp_seq=2 ttl=64 time=0.078 ms 64 bytes from 192.168.72.10: icmp_seq=3 ttl=64 time=0.080 ms 64 bytes from 192.168.72.10: icmp_seq=4 ttl=64 time=0.067 ms --- 192.168.72.10 ping statistics --- 4 packets transmitted, 4 received, 0% packet loss, time 3085ms rtt min/avg/max/mdev = 0.067/0.086/0.122/0.023 ms
实验5：删除INPUT规则链中刚刚加入的那条策略（允许ICMP流量），并把默认策略设置为允许。
[root@localhost ~]# iptables -D INPUT 1 [root@localhost ~]# iptables -P INPUT ACCEPT [root@localhost ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain LIBVIRT_INP (0 references) target prot opt source destination Chain LIBVIRT_OUT (0 references) target prot opt source destination Chain LIBVIRT_FWO (0 references) target prot opt source destination Chain LIBVIRT_FWI (0 references) target prot opt source destination Chain LIBVIRT_FWX (0 references) target prot opt source destination
实验6：将INPUT规则链设置为只允许指定网段的主机访问本机的22端口，拒绝来自其他所有主机的流量。
要对某台主机进行匹配，可直接写出它的IP地址；如需对网段进行匹配，则需要写为子网掩码的形式（比如192.168.72.0/24）。
可以看得到用得是VMnet8 网络，要与本机相通需要添加192.168.72.0/24 ip段即可
[root@localhost ~]# iptables -I INPUT -s 192.168.72.0/24 -p tcp --dport 22 -j ACCEPT [root@localhost ~]# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
[root@localhost ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- 192.168.72.0/24 anywhere tcp dpt:ssh
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh
防火墙策略规则是按照从上到下的顺序匹配的，因此一定要把允许动作放到拒绝动作前面，否则所有的流量就将被拒绝掉，从而导致任何主机都无法访问我们的服务。另外，这里提到的22号端口是ssh服务使用的
实验7：向INPUT规则链中添加拒绝所有人访问本机12345端口的策略规则。
[root@localhost ~]# iptables -I INPUT -p tcp --dport 12345 -j REJECT [root@localhost ~]# iptables -I INPUT -p udp --dport 12345 -j REJECT [root@localhost ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable ACCEPT tcp -- 192.168.72.0/24 anywhere tcp dpt:ssh REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
实验8：向INPUT规则链中添加拒绝192.168.10.5主机访问本机80端口（Web服务）的策略规则。
[root@localhost ~]# iptables -I INPUT -p tcp -s 192.168.10.5 --dport 80 -j REJECT [root@localhost ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination REJECT tcp -- 192.168.10.5 anywhere tcp dpt:http reject-with icmp-port-unreachable REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable ACCEPT tcp -- 192.168.72.0/24 anywhere tcp dpt:ssh REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
实验9：向INPUT规则链末尾中添加拒绝所有主机访问本机1000~1024端口的策略规则。
- iptables -I （后面可跟num第几条规则参数）在规则链的头部加入新规则。
- iptables -A 在规则链的末尾加入新规则。
[root@localhost ~]# iptables -A INPUT -p tcp --dport 1000:1024 -j REJECT [root@localhost ~]# iptables -A INPUT -p udp --dport 1000:1024 -j REJECT [root@localhost ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination REJECT tcp -- 192.168.10.5 anywhere tcp dpt:http reject-with icmp-port-unreachable REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable ACCEPT tcp -- 192.168.72.0/24 anywhere tcp dpt:ssh REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable REJECT tcp -- anywhere anywhere tcp dpts:cadlock2:1024 reject-with icmp-port-unreachable REJECT udp -- anywhere anywhere udp dpts:cadlock2:1024 reject-with icmp-port-unreachable
通过上面的iptables配置防火墙规则默认会在系统下一次重启时失效，如果想让配置的防火墙策略永久生效，还要执行保存命令。
[root@localhost ~]# iptables-save # Generated by iptables-save v1.8.4 on Sun Jun 23 23:00:03 2024 *filter :INPUT ACCEPT [2372:234316] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [1706:155687] :LIBVIRT_INP - [0:0] :LIBVIRT_OUT - [0:0] :LIBVIRT_FWO - [0:0] :LIBVIRT_FWI - [0:0] :LIBVIRT_FWX - [0:0] -A INPUT -s 192.168.10.5/32 -p tcp -m tcp --dport 80 -j REJECT --reject-with icmp-port-unreachable -A INPUT -p udp -m udp --dport 12345 -j REJECT --reject-with icmp-port-unreachable -A INPUT -p tcp -m tcp --dport 12345 -j REJECT --reject-with icmp-port-unreachable -A INPUT -s 192.168.72.0/24 -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j REJECT --reject-with icmp-port-unreachable -A INPUT -p tcp -m tcp --dport 1000:1024 -j REJECT --reject-with icmp-port-unreachable -A INPUT -p udp -m udp --dport 1000:1024 -j REJECT --reject-with icmp-port-unreachable
如果是服务器版本是5/6/7版本的话，就使用service iptables save
浙公网安备 33010602011771号