netfilter不只是包过滤防火墙（四层）

netfilter同样是状态防火墙[root@uplook ~]# iptables -m icmp -h //从后往前查看 -m指定模块 从下往上看[root@uplook ~]# iptables -m iprange -h //从后往前查看

[root@uplook ~]# yum -y install vsftpd httpd

[root@uplook ~]# service httpd start; service vsftpd start; service sshd start[root@uplook ~]# iptables -F[root@uplook ~]# iptables -A INPUT -j REJECT

-m icmp

[root@uplook ~]# iptables -t filter -I INPUT -p icmp -m icmp --icmp-type echo-reply -j ACCEPT //回应any禁止ping，但可以访问-m iprange[root@uplook ~]# iptables -t filter -I INPUT -m iprange --src-range 192.168.2.20-192.168.2.100 -j REJECT

-m multiport

[root@uplook ~]# iptables -m multiport -h[root@uplook ~]# iptables -t filter -I INPUT -p tcp -m multiport --dports 20,21,22,25,80,110 -j ACCEPT

-m state

跟TCP中的状态没有关系NEW 新生态ESTABLISHED 连接态RELATED 衍生态 ftpINVALID 无效态[root@uplook ~]# iptables -t filter -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

==================================================================

lab1： 使用状态防火墙，放行本机FTP服务[被动模式][root@uplook ~]# iptables -t filter -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT[root@uplook ~]# iptables -t filter -I INPUT -p tcp --dport 20:21 -j ACCEPT[root@uplook ~]# iptables -t filter -A INPUT -j REJECT [root@uplook ~]# modprobe nf_conntrack_ftp [root@uplook ~]# vim /etc/sysconfig/iptables-configIPTABLES_MODULES="nf_conntrack_ftp"小结： 该内核模块的作用是在<连接数据端口时>，将第一次握手的数据包状态由原来的 NEW 识别成 RELATED

-m tos //ip协议头部type of service

[root@uplook ~]# iptables -F[root@uplook ~]# tcpdump -i eth0 -nn port 22 -vvv //抓取远程主机访问本机ssh数据包，分别于输入密码前和后观察TOS值[root@uplook ~]# tcpdump -i eth0 -nn port 22 -vvv //抓取远程从本机rsync或scp复制文件，分别于输入密码前和后观察TOS值小结：都是使用22/tcp，但可以通过IP报文中的TOS值来区分应用ssh： tos 0x0 0x10scp： tos 0x0 0x8rsync: tos 0x0 0x8[root@uplook ~]# iptables -m tos -h[root@uplook ~]# iptables -t filter -A INPUT -p tcp --dport 22 -m tos ! --tos 0x10 -j ACCEPT //仅拒绝客户端ssh到本机[root@uplook ~]# iptables -t filter -A INPUT -j REJECT

-m tcp

按TCP标记匹配Flags are: SYN ACK FIN RST URG PSH ALL NONE[root@uplook ~]# iptables -t filter -A INPUT -p tcp -m tcp --tcp-flags SYN,ACK,FIN,RST SYN --dport 80 -j ACCEPT [root@uplook ~]# iptables -t filter -A INPUT -p tcp --syn --dport 80 -j ACCEPT

--tcp-flags SYN,ACK,FIN,RST SYN 检查四个标记位SYN,ACK,FIN,RST 但只有SYN标记位才匹配

则允许三次握手中的第一次握手，等价于 --syn

-m limit [要命不要脸]

[root@uplook ~]# iptables -F实验：从客户端ping本机，观察序列号[root@uplook ~]# iptables -t filter -A INPUT -p icmp -m limit --limit 20/minute -j ACCEPT[root@uplook ~]# iptables -t filter -A INPUT -j REJECT进入本机INPUT链的ICMP，如果匹配第一条则放行，不匹配的将被第二条拒绝，默认前5个不限16/second16/minute16/hour16/day[root@uplook ~]# iptables -t filter -A INPUT -p tcp --syn --dport 80 -m limit --limit 50/second -j ACCEPT[root@uplook ~]# iptables -t filter -A INPUT -j REJECT

-m connlimit 限同一IP最大连接数

[root@uplook ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT[root@uplook ~]# iptables -A INPUT -p tcp --syn --dport 22 -m connlimit ! --connlimit-above 2 -j ACCEPT //仅允许每个客户端有两个ssh连接

等价于：

[root@uplook ~]# iptables -A INPUT -p tcp --syn --dport 22 -m connlimit --connlimit-above 2 -j REJECT//超过两个连接拒绝

[root@uplook ~]# iptables -A INPUT -p tcp --syn --dport 80 -m connlimit ! --connlimit-above 100 -j ACCEPT

//仅允许每个客户端有100个requests[root@uplook ~]# iptables -A INPUT -j REJECT

-m time

[root@uplook ~]# iptables -A INPUT -m time --timestart 12:00 --timestop 13:00 -j ACCEPT[root@uplook ~]# iptables -A INPUT -p tcp --syn --dport 22 -m time --timestart 12:00 --timestop 13:00 -j ACCEPT[root@uplook ~]# iptables -A INPUT -j REJECT

-m comment

[root@uplook ~]# iptables -A INPUT -s 172.16.130.7 -m comment --comment "cloud class" -j REJECT

-m mark

[root@uplook ~]# iptables -t filter -A INPUT -m mark --mark 2 -j REJECT

二、动作扩展 TARGET EXTENSIONS

filter:-j ACCEPT-j DROP-j REJECT-j LOG

nat:

-j SNAT //转换源地址-j MASQUERADE //转换源地址-j DNAT //转换目标地址及端口-j REDIRECT //转换目标端口（重定向）

mangle:

-j MARK

-j LOG

[root@uplook ~]# grep 'kern.' /etc/rsyslog.conf

kern. /var/log/kernel.log[root@uplook ~]# service rsyslog restart

[root@uplook ~]# iptables -j LOG -h

[root@uplook ~]# iptables -t filter -A INPUT -p tcp --syn --dport 22 -j LOG --log-prefix " uplook_ssh " [root@uplook ~]# iptables -t filter -A INPUT -p tcp --syn --dport 22 -j ACCEPT[root@uplook ~]# iptables -t filter -A INPUT -j REJECT

-j REJECT

当访问一个未开启的TCP端口时，应该返回一个带有RST标记的数据包当访问一个开启的TCP端口，但被防火墙REJECT，结果返回port xxx unreachable[root@uplook ~]# iptables -j REJECT -h[root@uplook ~]# iptables -t filter -A INPUT -p tcp --dport 22 -j REJECT --reject-with tcp-reset //返回一个自定义消息类型

-j MARK

[root@uplook ~]# iptables -t mangle -L[root@uplook ~]# iptables -j MARK -h[root@uplook ~]# iptables -t mangle -A PREROUTING -s 192.168.2.110 -j MARK --set-mark 1[root@uplook ~]# iptables -t mangle -A PREROUTING -s 192.168.2.25 -j MARK --set-mark 2[root@uplook ~]# iptables -t filter -A INPUT -m mark --mark 1 -j ACCEPT //按照标记匹配[root@uplook ~]# iptables -t filter -A INPUT -m mark --mark 2 -j REJECT

NAT表：

POSTROUTING： SNAT, MASQUERADE

PRETROUTING： DNAT, REDIRECTOUTPUT： DNAT,针对本机

让KVM虚拟机访问外部网络（默认）：

-j SNAT/MASQUERADE [必须开启kernel ip_forward][root@uplook ~]# iptables -t nat -F[root@uplook ~]# iptables -F[root@uplook ~]# iptables -t nat -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j SNAT --to 外部地址[root@uplook ~]# iptables -t nat -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE

暴露KVM虚拟机的服务（端口映射）：

-j DNAT [必须开启kernel ip_forward][root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.30 -p tcp --dport 80 -j DNAT --to 192.168.122.66:80[root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.30 -p tcp --dport 8080 -j DNAT --to 192.168.122.77:80[root@uplook ~]# iptables -t nat -A PREROUTING -p tcp --dport 2222 -j DNAT --to 192.168.122.66:22

[root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.240 -p tcp --dport 80 -j DNAT --to 192.168.122.66

[root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.240 -p tcp --dport 22 -j DNAT --to 192.168.122.66[root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.241 -p tcp --dport 80 -j DNAT --to 192.168.122.67[root@uplook ~]# iptables -t nat -A PREROUTING -d 172.16.30.241 -p tcp --dport 22 -j DNAT --to 192.168.122.67

为接口绑定地址

[root@uplook ~]# ip addr add dev eth0 172.16.30.240/24[root@uplook ~]# ip addr add dev eth0 172.16.30.241/24[root@uplook ~]# ip a s eth03: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000link/ether 3c:97:0e:54:c5:82 brd ff:ff:ff:ff:ff:ffinet 172.16.30.30/24 brd 172.16.30.255 scope global eth0inet 172.16.30.240/24 scope global secondary eth0inet 172.16.30.241/24 scope global secondary eth0inet6 fe80::3e97:eff:fe54:c582/64 scope link valid_lft forever preferred_lft forever

[root@uplook ~]# cat /etc/sysconfig/network-scripts/ifcfg-eth0

IPADDR=172.16.30.30PREFIX=24IPADDR1=172.16.30.240PREFIX1=24IPADDR2=172.16.30.241PREFIX2=24GATEWAY=172.16.30.254

-j REDIRECT //本地端口转发

[root@nat_server ~]# iptables -t nat -A PREROUTING -s 172.16.130.0/24 -p tcp --dport 8888 -j REDIRECT --to-ports 22