wA@As峹аѦo

qĤC 7.1-1 ڭ̥iHo{Oӫʥ]niJDeĤ@DdAAOHLinux 𦳭ǾH iHFPLkF쪺\঳ǡHण@ϰ쨾ӤOȰw@DӤwOHALinux DnOzL Netfilter P TCP Wrappers ӾӺ޲zC𫟺AzL Netfilter Aڭ̥iHFp IP DW (IP ɾ\) AåB] Internet sڤp IP Ҭ[] Linux A (DNAT \)IuܤI o@zӻA]unաI

9.1 {Ѩ
@@9.1.1 }leӭӴƶ
@@9.1.2 ݭn
@@9.1.3 Linux tΤW𪺥DnO
@@9.1.4 𪺤@GuܷN
@@9.1.5 𪺨ϥέ
 9.2 TCP Wrappers
@@9.2.1 ǪAȦ䴩G ldd
@@9.2.2 /etc/hosts.{allow|deny} ]w觋
 9.3 Linux ʥ]LonG iptables
@@9.3.1 P Linux ֤ߪn
@@9.3.2 ʥ]iJy{GWhǪnʡI
@@9.3.3 iptables (table) P (chain)
@@9.3.4 iptables yk
@@9.3.4-1 Wh[PM
@@9.3.4-2 wqw]F (policy)
@@9.3.4-3 ʥ]¦GIP, Τ˸mG H˸m, H
@@9.3.4-4 TCP, UDP WhGwf]w
@@9.3.4-5 iptables ~ҲաGmac P state
@@9.3.4-6 ICMP ʥ]WhGwO_^ ping ӳ]p
@@9.3.4-7 WKΤݨ]pPWhxs
@@9.3.5 IPv4 ֤ߺ޲z\G/proc/sys/net/ipv4/*
 9.4 𪺤@ӹ
@@9.4.1 Wh
@@9.4.2 ڳ]w
 9.5 NAT A]w
@@9.5.1 O NATH SNATH DNATH
@@9.5.2 ̶K NAT AG IP ɥ\
@@9.5.3 iptables B~֤߼Ҳե\
@@9.5.4 bݤA DNAT ]w
 9.6 I^U
9.7 D
9.8 ѦҸƻP\Ū
9.9 w糧媺ijGhttp://phorum.vbird.org/viewtopic.php?p=114475
9.1 {Ѩ

wFHɪ`Nn骺|}HκWwq~AA̦n̾ڦۤvҨӭqwI o˹AҡA|O٤@II򤰻OOHNOzLqw@ǦǪWhAúިiJڭ̺줺D (Ϊ̥iHO) ƫʥ]@ؾIsqӻAunRPLoiXڭ̺޲z쪺ʥ]ơA NiH٬C

SiHw骡Pn骡Cw骡OѼtӳ]pnDwA ow骡𤺪@~tΥDnHѫʥ]ƪLoDAñNLn\ளC]§@\ӤwA ]ʥ]LoIJvΡCܩn骡OHNOڭ̳oӳ`nӽͽתڡI n骡𥻨NObO@tκw@Mn(κ٬)AҦp Netfilter P TCP Wrappers iH٬n骡C

L׫AϥNOΨӫO@ڭ̺wNNNաIڭ̳oӳ`Dnb Linux tΥѪn骡𪺥\ANO Netfilter Cܩ TCP Wrappers Mb¦gĤQK{ѨtΪA̭͹LFAڭ̳oٷ|yL²檺аաI


9.1.1 }leӭӴƶ

ѩ󥻳Dnتb Netfilter oثʥ]LoA]¦̭\hʥ]PTتnD`MA ]A쪺, IP 쪺g觋Aݦ@w¦~CШĤG[j@U MAC, IP, ICMP, TCP, UDP ʥ]Yƪ{ѡAH Network/Netmask (CIDR) gkC

t~AM Netfilter iHzL iptables O觋ӶiWhƧǻPקALijAQ shell script ӼgݩAۤvnA]WhƧǻPJ㦳n[ʡA iHAWhM@ICҥHbA}lAѩUƤeAƱAiH\ŪLƤFG

9.1.2 ݭn

JӤRĤC 7.1-1 iHo{A ʥ]iJɡA|qLBAn{ǡBSELinuxPɮרtεCҥH򥻤WApGAt (1)wgݭnӥBMIAȡF (2)wgNӨtΪҦn鳣Ob̷sAF (3)v]wBwɶiƥu@F (4)wgШ|ϥΪ̨㦳}nBtξާ@ߺDC AtιڤWwgᬰwFInn[]HNoI

LA@ɬOܽA Linux D]O@²檺FAw@ѧAbiYӳn骺ծɡA DMNҰʤF@ӺAȡApGASިӪAȪϥνdAӪAȴNҦ Internet }A N·ФFI]ӪAȥiiH\HnJAtΡAOMIH

ҥHoA@OH̤j\NOUAyYǪAȪsӷzI |ҨӻG (1)AiHɮ׶ǿA (FTP) ubl줺D~ϥΡAӤ Internet }F (2)AiH㳡 Linux DȥiHȤݪ WWW nDALAȳF (3)A٥iH㳡DȯDʹ~suCϹLӻAYΤݹڭ̥DoeDʳsuʥ]A (TCP ʥ] SYN flag) NH׵CoǴNO̥Dn\FI

ҥH{A̭nȴNObWXG

MաA Linux iptables n٥iHiӳ`J NAT (Network Address Translation) ]wAöiuʪ IP ʥ]˥\ALA@DӻA ²檺٬OWTNOFIҥHAAݤݭnOHzפWAMݭnI ӥBAnDyAtέǸƻPAȻݭnO@zAwݭnO@AȨӳ]w𪺳WhaI Uڭ̥ӽͤ@͡Ab Linux WY`ǡH

9.1.3 Linux tΤW𪺥DnO

򥻤WA̾ڨ޲zdAڭ̥iHNϤ쫬P@DޡCb@Dޤ譱A Dn𦳫ʥ]Lo Netfilter P̾ڪAȳn{@R TCP Wrappers ءCYHϰ쫬ӨA ѩ𳣬O@ѾA]Dnhʥ]Lo Netfilter PQΥNzA (proxy server) isNz觋FC

9.1.4 𪺤@GuܷN

ѫeAAӥiHAѨ@ơANO𰣤FiHyO@ҦbDz~A٥iHyO@᭱DzC]NOA𰣤FiHƥQJI~A L٥iH[]bѾWǥH޶iXaݺ쪺ʥ]C oسW󤺳p쪺w]@w{תO@@ΩOIUڭ̵yLͤ@ͥثe`PGutmaG


9.1.5 𪺨ϥέ

qeRAڭ̤wgDLʥ]oDnbR OSI Chw 2, 3, 4 hAJMpܡA Linux Netfilter 쩳iHǤƱOHiHi檺Ru@DnG

M Netfilter wgiHohƱALA٬OܦhƱSkzL Netfilter ӧI H]w𤧫٤wڡIMաIֻ]wF𤧫AtδN@wwH MiHw諸ʥ]iJڭ̪ALAYDZpUALäOҧڭ̪@wNܦwC |XӨҤlӽͤ@͡G

ҥHաA٬O^ĤC 7.1-1 hݬݡAR@UӹϥܡAAN|DAbA Linux DaWeA٬OoG

LT٬OШĤC{Ѻw̭hݤ@ݫW[ۨwaI

9.2 TCP Wrappers

biJDDeAڭ̥Ӫ@²檺ANO TCP Wrappers oNCpPeA TCP wrappers OzLΤݷQns{ɦWAMRΤݪ IP AݬݬO_ݭnCǵ{䴩 TCP wrappers \Ho TCP wrappers SӦp]wHڭ̳o̥²檺ͽͧaI(oӤp`ȬO²檺йL TCP wrappers Ah\аѦҰ¦Dz߽gĤQKeI)


9.2.1 ǪAȦ䴩

FA TCP wrappers NOzL /etc/hosts.allow, /etc/hosts.deny o_JӺ޲z@𪺾A ëDҦn鳣iHzLoɮרӱޡAuUn~zLoɮרӺ޲zWhAOOG

g xinetd ޲zA٦nzѡANO]wɦb /etc/xinetd.d/ ̭AȴNO xinetd Һ޲zڡI 򤰻O䴩 libwrap.so ҲթOHNڭ̨Ӷi橳UDAANeoG

DG
ЬdXAtΦSw xinetd AYSЦwˡCw˧AЬd xinetd ޲zAȦǡH
G
[root@www ~]# yum install xinetd
Setting up Install Process
Package 2:xinetd-2.3.14-10.el5.i386 already installed and latest version
Nothing to do
# eܡAwgO̷s xinetd IҥHAwgwoI
# UӧX xinetd Һ޲zAȸsI

[root@www ~]# chkconfig --list
....(eٲ)....
xinetd based services:
        chargen-dgram:  off
        chargen-stream: off
....(ٲ)....
        kshell:         off     <==U@p`dҴNγoNӸ
        rsync:          off
        tcpmux-server:  off
        time-dgram:     off
        time-stream:    off
WzG̲׿XNO xinetd Һ޲zAȸsoIWzAȤ²]wAiHzL TCP wrappers Ӻ޲zPI

DG
аݡA syslogd, sshd, xinetd, httpd (YӪAȤsbAЦۦw˳n)Ao|ӵ{S䴩 tcp wrappers ץ\H
G
ѩ䴩 tcp wrappers Aȥw]t libwrap o@ӰʺA祃wA]iHϥ ldd [ӪAȧYiC ²檺ϥΤ觋G 
[root@www ~]# ldd $(which syslogd sshd xinetd httpd)
# oӤ觋iHNҦʺA祃wXӬd\ALݭnjMC
# iHzLU觋ӳBz֡I

[root@www ~]# for name in syslogd sshd xinetd httpd; do echo $name; \
> ldd $(which $name) | grep libwrap; done
syslogd
sshd
        libwrap.so.0 => /lib/libwrap.so.0 (0x00aa3000)
xinetd
        libwrap.so.0 => /lib/libwrap.so.0 (0x0052e000)
httpd
WzGAbɦWɤUX{ libwrap ANӨ祃wA~䴩 tcp wrappersC ҥHA sshd, xinetd 䴩AO syslogd, httpd o{h䴩C]NOA httpd P syslogd ϥ /etc/hosts.{allow|deny} Ӷi樾ޡC

9.2.2 /etc/hosts.{allow|deny} ]w觋

pzLoɮרөצD IP ӷOHoɮתyk@ˡA²檺G

<service(program_name)> : <IP, domain, hostname> 
<A   (Y{W)> : <IP λ ΥDW>
# WY > < Osb]wɤI

ڭ̪D𪺳WhOǪAoɮ׻PWhuO˩OH򥻤WOo˪G

ڭ̮ kshell o xinetd ޲zAȨӶi满nFAаѦҩUDaG

DG
}񥻾 127.0.0.1 iHi󥻾AȡAMAϺ (192.168.1.0/24) iHϥ kshell A P 10.0.0.100 ]ϥ kshell ALӷh\ϥ kshell C
G
ڭ̱onD kshell AȱҰʪɦWA] tcp wrappers OzLҰʪAȪɦWӺ޲zC ڭ[ kshell ]wɮɡAiHo{G 
[root@www ~]# cat /etc/xinetd.d/kshell
service kshell
{
        flags           = REUSE
        socket_type     = stream
        wait            = no
        user            = root
        server          = /usr/kerberos/sbin/kshd   <==ɦWs kshd
        server_args     = -e -5
        disable         = yes
}
]{쪺حngO kshell IӬO kshd ~I]Aڭӭno˳]wG 
[root@www ~]# vim /etc/hosts.allow
ALL: 127.0.0.1    <==oNOAȳI
kshd: 192.168.1.0/255.255.255.0 10.0.0.100

[root@www ~]# vim /etc/hosts.deny
kshd: ALL

WDXӭIAA tcp wrappers zפW䴩 192.168.1.0/24 oسzL bit ƭȨөwqA u䴩 netmask }ܤ觋Ct~ApGhӺΪ̬O@ӷAiHzLŮӲ֥[C pGQnghOH]iHڡIhgXy kshd: IP z觋]iHAnNҦƶb@աI] tcp wrappers ]O@@WhI

򥻤WAAunzѳoǸƧYiI]jɨAڭ̳|ijϥΩUЪ Netfilter ө׫ʥ]C ڭ̷dzƶ}lӪ iptables ʥ]LoaI

9.3 Linux ʥ]LonGiptables

WͤFohADn٬OƱAAѨ쨾OoijDIӥB]ƱADëDU઺C nFA򩳤Uڭ̲שiH@@@Aثeڭ̪ 2.6 o Linux ֤ߨ쩳ϥΤ֤ߥ\Ӷi樾]wH


9.3.1 P Linux ֤ߪn

Linux 𬰤\onHoO]LNO Linux ֤ߩҴѡAѩ󪽱gL֤ߨӳBzA]įD`nI LAP֤ߪҨϥΪnO@˪I]֤ߤ䴩OvtiӨӪI

]P֤ߨϥΪPAB䴩nOPyk]ۦPAҥHb Linux WY]wݩAۤvWhɡAn`NڡA uname -r lܤ@UA֤ߪAIpGAOw 2004 ~HX distributions ANݭnߤFA]o distributions XGϥ kernel 2.6 ֤߰ڡI ^_^

9.3.2 ʥ]iJy{GWhǪnʡI

eXӤp`̭ڭ̤@ͨGyWhzAxIԣOWhڡH] iptables OQΫʥ]LoA ҥHL|Rʥ]YơCھڪYƻPwqyWhzӨMwӫʥ]O_iHiJDΪ̬OQC NNOGyھګʥ]R "" AwwqWheA Yʥ]ƻPWheۦPhiʧ@A_hN~U@WhIz IbӡyPRǡzWC

|²檺ҤlA]ڹwwq 10 WhnFA Internet ӤF@ӫʥ]QniJڪDA 򨾤OpRoӫʥ]OHڭ̥HUϥܨӻnFG

ʥ]LoWhʧ@ΤRy{
9.3-1Bʥ]LoWhʧ@ΤRy{

@Ӻʥ]niJDeA|g NetFilter iˬdANO iptables WhFC ˬdqLh (ACCEPT) iJo귽ApGˬdqLAhiऩH (DROP) I WϤDnتbiAGyWhOǪzIҦpʥ]iJ Rule 1 ɡA pGﵲGŦX Rule 1 AɳoӺʥ]N|i Action 1 ʧ@AӤ|z| Rule 2, Rule 3.... WhRFC

ӦpGoӫʥ]äŦX Rule 1 AN|iJ Rule 2 FIp@Ӥ@ӳWhhiNOFC pGҦWhŦXHɴN|zLw]ʧ@ (ʥ]F, Policy) ӨMwoӫʥ]hVC ҥHաAAWhDZƦC~ɡAN|ͫY~FC 򻡩OHڭ̬ݬݩUoӨҤlG

]A Linux DѤF WWW AȡA۵MNnw port 80 ӱҥγqLʥ]WhAOAo{ IP ӷ 192.168.100.100 ѬOcNդJIAtΡAҥHAQnN IP ڵӡA̫AҦD WWW ʥ]LANoTӳWhӻAAnp]w綶ǩOH

  1. Rule 1 192.168.100.100 F
  2. Rule 2 AnD WWW AȪʥ]qLF
  3. Rule 3 NҦʥ]C

o˪ƦCǴNŦXAݨDALAU@ADZƿFAܦG

  1. Rule 1 nD WWW AȪʥ]qLF
  2. Rule 2 A 192.168.100.100 F
  3. Rule 3 NҦʥ]C

ɡA 192.168.100.100 yiHϥΧA WWW AȡzIunLADeX WWW nDʥ]ANiHϥΧA WWW \FA]AWhǩwqĤ@N|LqLAӤhҼ{ĤGWhIo˥iHzѳWhǪNqFܡI {bAӷQ@QApG Rule 1 ܦFyNҦʥ]zARule 2 ~]wyWWW Aȫʥ]qLzAаݡAڪ client iHϥΧڪ WWW AȶܡHI׬Oy_zQqFܡH ^_^

9.3.3 iptables (table) P (chain)

ƹWA 9.3-1 ҦCXWhȬO iptables h@ (chain) ӤwC OOHoo iptables Wٻ_C٬ ip"tables" OH ]oӨṋhӪ (table) ACӪ泣wqXۤvw]FPWhA BCӪ檺γ~ۦPCڭ̥iHϥΩUoiϨӵyLAѤ@UG

iptables PܷN
9.3-2Biptables PܷN

9.3-1 WheȥuO 9.3-2 Y chain ӤwI ӹw]pUA Linux iptables ܤִNTӪA]A޲ziX filter B޲zݥD (𤺳Lq) nat B޲zSXШϥΪ mangle (֨ϥ) C󦳬ƪ̡Aڭ٥iHۭqB~OI uOܯ_aICӪP𫟺쪺γ~OOo˪G

ҥHApGA Linux O@ www AȡAn}ΤݹA www nD^ANonBz filter INPUT F ӦpGA Linux O@ϰѾANonR nat UH filter FORWARD ~C]NOA UӪ檺쵲OYI²檺YiHѤUϳoݡG

iptables ئUP쪺
9.3-3Biptables ئUP쪺

WϥܫܽIL򥻤WA¥iHݥXӡAڭ̪ iptables iHTثʥ]yVG

So{ӡyѧP_zOH]OVAҥHiPXn}ӬݡI]AiJʥ]ݭnѧP_A eXʥ]M]niѧP_~oeXhڡIAѥGH

ѩ mangle oӪܤֳQϥΡApGN 9.3-3 mangle ܡANeݪhFG

iptables ئUP쪺(²)
9.3-4Biptables ئUP쪺(²)

zL 9.3-4 ANiHPAѨAƹWP̦O filter oӪ椺 INPUT P OUTPUT oApGA iptables uOΨӫO@ Linux DܡA nat WhڥNݭnzLA]w}YiC

LApGAƹWOΨӺި LAN LDܡAANnAw filter FORWARD oA٦ nat PREROUTING, POSTROUTING H OUTPUT iB~Whqw~C nat 檺ϥλݭnܲMѷ~]wnAijsnII̦hNO@̶K nat \yIP ɾ\zNnFI ^_^Ioڭ̦b̫@p`|ЪաI

9.3.4 iptables yk

zפWAAw˦n Linux Atӷ|DʪAҰʤ@ӶKWh~OA LoӶKiणOڭ̷QnҦA]ڭ̻ݭnB~i@ǭ׭q欰CLAb}li橳UmߤeA o̦ӫܭnƱni@UC] iptables O|Nʥ]iLoΩתʧ@AҥHA ФnbݥDWi樾𪺽mA]Aܦi@p߱Nۤvba~I ɶqbenJ tty1-tty6 ׺ݾimߡA_h``|oʹd@ڡIHeb iptables ɡAN``]p߳Wh]w~AɭP``nлݪBs}...

责쫥̪ iptables ܤ֦Tӹw] table (filter, nat, mangle)A`ΪO filter A o]Ow]աCt@ӫhOݥD nat Aܩ mangle ֨ϥΡAҥHoӳ`ڭ̨ä|Q mangleC ѩ󤣦P table L̪줣@ˡAɭPϥΪOykΦhΤֳItC boӤp`Aڭ̥DnNw filter oӹw]檺TӰСCUNӪ@aI

𪺳]wDnϥΪNO iptables oӫOӤwCӨOtκ޲zDnȤ@A BtΪvT۷jA]yu root ϥ iptables zA׬O]w٬O[WhI
9.3.4-1 Wh[PM

pGAbw˪ɭԿܨS𪺸ܡA iptables b@}lɭӬOSWhALA i]Abw˪ɭԴNܨtΦ۰AإߨAtδN|w]WhFI LצpAڭ̥ӬݬݥثeWhOpaI

[root@www ~]# iptables [-t tables] [-L] [-nv]
ﶵPѼơG
-t G᭱ table AҦp nat  filter AYٲءAhϥιw] filter
-L GCXثe table Wh
-n Gi IP P HOSTNAME ϬdAܰTt׷|֫ܦhI
-v GCXhTA]AqLӳWhʥ]`줸ơB

dҡGCX filter table T쪺Wh
[root@www ~]# iptables -L -n
Chain INPUT (policy ACCEPT)    <==w INPUT ABw]Fi
target               prot opt source     destination  <==
RH-Firewall-1-INPUT  all  --  0.0.0.0/0  0.0.0.0/0    <==Wh RH hˬd

Chain FORWARD (policy ACCEPT) <==w FORWARD ABw]Fi
target               prot opt source     destination
RH-Firewall-1-INPUT  all  --  0.0.0.0/0  0.0.0.0/0

Chain OUTPUT (policy ACCEPT) <==w OUTPUT ABw]Fi
target     prot opt source               destination

Chain RH-Firewall-1-INPUT (2 references)  <==ۭq쪺Wh
target     prot opt source     destination
ACCEPT     all  --  0.0.0.0/0  0.0.0.0/0                  <== 1 Wh
ACCEPT     icmp --  0.0.0.0/0  0.0.0.0/0    icmp type 255 <== 2 Wh
ACCEPT     esp  --  0.0.0.0/0  0.0.0.0/0                  <== 3 Wh
ACCEPT     ah   --  0.0.0.0/0  0.0.0.0/0                  <==U@ 9 Wh
ACCEPT     udp  --  0.0.0.0/0  224.0.0.251  udp dpt:5353
ACCEPT     udp  --  0.0.0.0/0  0.0.0.0/0    udp dpt:631
ACCEPT     tcp  --  0.0.0.0/0  0.0.0.0/0    tcp dpt:631
ACCEPT     all  --  0.0.0.0/0  0.0.0.0/0    state RELATED,ESTABLISHED
REJECT     all  --  0.0.0.0/0  0.0.0.0/0    reject-with icmp-host-prohibited

dҡGCX nat table T쪺Wh
[root@www ~]# iptables -t nat -L -n
Chain PREROUTING (policy ACCEPT)
target     prot opt source               destination

Chain POSTROUTING (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

bWAC@ Chain NOe쪺Co Chain @̭A policy NOw]FA U target, prot NOH

bXGAĤ@ӽdҦ]S[W -t ﶵAҥHw]NO filter oӪ椺 INPUT, OUTPUT, FORWARD T쪺WhoCѩw]WhAINPUT P FORWARD Wh@PA] CentOS N쪺Whgb@Aܦ@Ӧۭq RH-Firewall-1-INPUT IAon`NOA̫@WhFO REJECT (ڵ) I ҥHAM INPUT P FORWARD FO (ACCEPT)ALꤣXe 8 Whʥ]|Q 9 WhڵC

LoӫO[uO@Ӯ榡ƪd\AnԲӸCӳWh|eѪRC|ҨӻA ڭ̱NWzEWh̾ڿXGӻ@UAG|ܦG

  1. Lץӷ (0.0.0.0/0) BnhؼЪʥ]Aץʥ]榡 (prot all)Aqq
  2. unO icmp 255 ANH
  3. unOʥ]榡 esp ANH (S\)
  4. unOʥ]榡 ah ANH (S\)
  5. unOnǰeؼЬ 224.0.0.251 B udp f 5353 ANH
  6. unOǵ port 631 udp ʥ]N
  7. unOǵ port 631 tcp ʥ]N
  8. unOʥ]A RELATED,ESTABLISHED NH
  9. ʥ]Tqqڵ

̦쪺ӬOĤ@WhFA|Ҧʥ]THHpGܡA򪺳WhڥN|ιI ꨺WhOȰwCDjպ (lo) աIpGSCXAڭ̴Nܮedo ҥHAӳijϥ iptables-save oӫO[WhաI] iptables-save |CX㪺WhAuOèSWƿXӤwC

[root@www ~]# iptables-save [-t table]
ﶵPѼơG
-t GiHȰwYǪӿXAҦpȰw nat  filter 

[root@www ~]# iptables-save
# Generated by iptables-save v1.3.5 on Wed Jan 26 18:25:15 2011
*filter                       <==P}YOAo̬ filter
:INPUT ACCEPT [0:0]           <==_}YOATؤ@ۭq
:FORWARD ACCEPT [0:0]         <==T쪺FO ACCEPT oI
:OUTPUT ACCEPT [4:496]
:RH-Firewall-1-INPUT - [0:0]
-A INPUT -j RH-Firewall-1-INPUT    <==w INPUT Wh
-A FORWARD -j RH-Firewall-1-INPUT  <==w FORWARD Wh
-A RH-Firewall-1-INPUT -i lo -j ACCEPT <==wۭq RH Wh
-A RH-Firewall-1-INPUT -p icmp -m icmp --icmp-type any -j ACCEPT
-A RH-Firewall-1-INPUT -p esp -j ACCEPT
-A RH-Firewall-1-INPUT -p ah -j ACCEPT
-A RH-Firewall-1-INPUT -d 224.0.0.251 -p udp -m udp --dport 5353 -j ACCEPT
-A RH-Firewall-1-INPUT -p udp -m udp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -p tcp -m tcp --dport 631 -j ACCEPT
-A RH-Firewall-1-INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Jan 26 18:25:15 2011

ѤWXӬݡAuWhA -i lo NO lo diӪʥ]I oˬݴNMhFI]g줶YڡIe iptables -L -n IoAѥGI LAJMoӳWhOڭ̷QnAӦpקWhOHijARWhACCإߦUӻݭnWhI pMWhHo˰NFG

[root@www ~]# iptables [-t tables] [-FXZ]
ﶵPѼơG
-F GMҦwqwWhF
-X GҦϥΪ "ۭq"  chain (ӻO tables ^oF
-Z GNҦ chain pƻPyqέpks

dҡGM (filter) ҦWh
[root@www ~]# iptables -F
[root@www ~]# iptables -X
[root@www ~]# iptables -Z

ѩoTӫO|N𪺩ҦWhMAo|ܹw]F (policy) A ҥHpGAObUFoTOɡAܥiA|Qۤvצba~ (Y INPUT ]w DROP )Inp߰ڡI

@ӻAڭ̦bswq𪺮ɭԡA|NWhLMCٰOoڭ̫eͨ쪺A 𪺡yWhǡzOSNqAҥHoA MMWhAM@@ӳ]w|e@IաCUNӽͽͩwqw]FaI

9.3.4-2 wqw]F (policy)

MWhAAUӴNOn]wWhFաIٰOoFOܡHy Aʥ]bA]wWhɡAhӫʥ]qLP_AOH Policy ]wzAb譱w]FA]A󤺳ϥΪ̦HߪܡA filter INPUT 譱iHwqY@IA FORWARD P OUTPUT hiHqwP@ǡIq`ON INPUT policy wq DROP աALӫhwq ACCEPTC ܩ nat table hȮɥz|LC

[root@www ~]# iptables [-t nat] -P [INPUT,OUTPUT,FORWARD] [ACCEPT,DROP]
ﶵPѼơG
-P GwqF( Policy )C`NAo P jgڡI
ACCEPT Gӫʥ]i
DROP   Gӫʥ]A| client ݪDQC

dҡGN INPUT ]w DROP AL]w ACCEPT
[root@www ~]# iptables -P INPUT   DROP
[root@www ~]# iptables -P OUTPUT  ACCEPT
[root@www ~]# iptables -P FORWARD ACCEPT
[root@www ~]# iptables-save
# Generated by iptables-save v1.3.5 on Wed Jan 26 23:41:43 2011
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [24:2120]
COMMIT
# Completed on Wed Jan 26 23:41:43 2011
# ѩ INPUT ]w DROP ӤS|WhAҥHWXGܡG
# Ҧʥ]LkiJADIOq]wI(suOV)

ݨXGFaHINPUT QקF]wIL nat table T쪺w]F]w]O@˪觋AҦpGy iptables -t nat -P PREROUTING ACCEPT zN]wF nat table PREROUTING 쬰iNIw]F]wAӽͤ@UWhʥ]¦]waC

9.3.4-3 ʥ]¦GIP, Τ˸m

}lӶi樾Whʥ]]waIJMOںAڭ̴Nѳ̰¦ IP, ΰfAYO OSI ĤThͰ_AAӽͽ͸˸m (d) Co@p`PU@p`ykA@wnOA]oO̰¦ykI

[root@www ~]# iptables [-AI W] [-io ] [-p w] \
> [-s ӷIP/] [-d ؼIP/] -j [ACCEPT|DROP|REJECT|LOG]
ﶵPѼơG
-AI WGwYiWh "J"  "֥["
    -A GsW[@WhAӳWhW[b쥻Wh̫᭱CҦp쥻wg|WhA
         ϥ -A NiH[WĤWhI
    -I GJ@WhCpGSwWhǡAw]OJܦĤ@WhC
         Ҧp쥻|WhAϥ -I hӳWhܦĤ@Aӭ쥻|ܦ 2~5 
     G INPUT, OUTPUT, FORWARD AW٤SP -io AЬݩUC

-io G]wʥ]iXWd
    -i Gʥ]ҶiJӺAҦp eth0, lo CݻP INPUT tXF
    -o Gʥ]ҶǥXӺAݻP OUTPUT tXF

-p wG]wWhAΩثʥ]榡
   Dnʥ]榡G tcp, udp, icmp  all C

-s ӷ IP/G]wWhʥ]ӷءAiwª IP Υ]AAҦpG
   IP  G192.168.0.100
   G192.168.0.0/24, 192.168.0.0/255.255.255.0 iC
   YWdy\zɡAh[W ! YiAҦpG
   -s ! 192.168.100.0/24 ܤ\ 192.168.100.0/24 ʥ]ӷF

-d ؼ IP/GP -s AuLo̫OؼЪ IP κC

-j G᭱ʧ@ADnʧ@(ACCEPT)B(DROP)Bڵ(REJECT)ΰO(LOG)

iptables 򥻰ѼƴNpPWҥܪAȥuͨ IP BP˸mTA ܩ TCP, UDP ʥ]Sf (port number) PA (p SYN X) hbUp`~|ͨC nAڭ̨Ӭݬݳ̰¦XӳWhAҦp} lo oӥHάY IP ӷaI

dҡG]w lo H˸mAYiX lo ʥ]H
[root@www ~]# iptables -A INPUT -i lo -j ACCEPT

JӬݤWèSCX -s, -d WhAoܡG׫ʥ]ӦۦBΥh̡AunOӦ lo oӤANHIo[nANOySwءAhܸӶاzNI ҦpoӮרҷA -s, -d...ѼƨSWwɡANNפȳ|QoC

oNOҿתH˸mաIpADiAӺdA𫟺@iO鷺A]ӺdN eth1 nFA pGOiHAӺdiXʥ]Nqq|QAANΡGyiptables -A INPUT -i eth1 -j ACCEPTz ӱNӸ˸m]wH˸mCLAUFoӫOenSO`NA]o˵ӺdS󨾳ƤFI

dҡGunOӦۤ (192.168.1.0/24) ʥ]qq
[root@www ~]# iptables -A INPUT -i eth0 -s 192.168.1.0/24 -j ACCEPT
# ѩONA]]iH٤yHzoC

dҡGunOӦ 192.168.0.1 NA 192.168.1.20 oӴcNӷN
[root@www ~]# iptables -A INPUT -i eth0 -s 192.168.0.1 -j ACCEPT
[root@www ~]# iptables -A INPUT -i eth0 -s 192.168.1.20 -j DROP
# w@ IP ӷAiHDΪ̬OHcNӷI

[root@www ~]# iptables-save
# Generated by iptables-save v1.3.5 on Fri Jan 28 14:25:09 2011
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [17:1576]
-A INPUT -i lo -j ACCEPT
-A INPUT -s 192.168.1.0/255.255.255.0 -i eth0 -j ACCEPT
-A INPUT -s 192.168.0.1 -i eth0 -j ACCEPT
-A INPUT -s 192.168.1.20 -i eth0 -j DROP
COMMIT
# Completed on Fri Jan 28 14:25:09 2011

oNO̳²檺Wh]wP[觋CLAbWרҤAA]o{즳Whi঳D NOWSr_ӪWhǡCwgF 192.168.1.0/24 FAҥH 192.168.1.20 WhNi|QΨI oNOD]wڡIAѥGHӫHNڡI@_@IpGAQnOYӳWhHiHo˰G

[root@www ~]# iptables -A INPUT -s 192.168.2.200 -j LOG
[root@www ~]# iptables -L -n
target prot opt source         destination
LOG    all  --  192.168.2.200  0.0.0.0/0   LOG flags 0 level 4

ݨXG̥A|X{O LOG Iunʥ]Ӧ 192.168.2.200 o IP ɡA ӫʥ]TN|QgJ֤߰TAYO /var/log/messages oɮ׷C Mӫʥ]|~i򪺳WhCҥHA LOG oӰʧ@ȦbiOӤwAä|vToӫʥ]LWh諸C nFAUӧڭ̤OӬݬ TCP,UDP H ICMP ʥ]LWhaI

9.3.4-4 TCP, UDP WhGwf]w

ڭ̦bĤG¦͹LUؤPʥ]榡A bͨ TCP P UDP ɡASNOӰf (port)Ab TCP 譱ht~ҿתsuʥ]AA ]A̱` SYN Dʳsuʥ]榡Cpwoثʥ]榡i樾Wh]wOHAiHoˬݡG

[root@www ~]# iptables [-AI ] [-io ] [-p tcp,udp] \
> [-s ӷIP/] [--sport fd] \
> [-d ؼIP/] [--dport fd] -j [ACCEPT|DROP|REJECT]
ﶵPѼơG
--sport fdGӷfXAfXiHOs򪺡AҦp 1024:65535
--dport fdGؼЪfXC

ƹWNOhF --sport --dport oӪNAIb port WաI LAonSO`NA]Ȧ tcp P udp ʥ]㦳fA]AQnϥ --dport, --sport ɡAon[W -p tcp -p udp ѼƤ~|\IUڭ̨ӶiXӤpաG

dҡGQnsuiJ port 21 ʥ]ױG
[root@www ~]# iptables -A INPUT -i eth0 -p tcp --dport 21 -j DROP

dҡGQsڳoD (upd port 137,138 tcp port 139,445) N
[root@www ~]# iptables -A INPUT -i eth0 -p udp --dport 137:138 -j ACCEPT
[root@www ~]# iptables -A INPUT -i eth0 -p tcp --dport 139 -j ACCEPT
[root@www ~]# iptables -A INPUT -i eth0 -p tcp --dport 445 -j ACCEPT

@IAiHQ UDP P TCP wҾ֦fXӶiYǪAȪ}IA٥iHXBzOIҦpGunӦ 192.168.1.0/24 1024:65535 fʥ]ABQnsu쥻 ssh port NHסAiHo˰G

[root@www ~]# iptables -A INPUT -i eth0 -p tcp -s 192.168.1.0/24 \
> --sport 1024:65534 --dport ssh -j DROP

pGѰO[W -p tcp NϥΤF --dport ɡA|oԣDOH

[root@www ~]# iptables -A INPUT -i eth0 --dport 21 -j DROP
iptables v1.3.5: Unknown arg `--dport'
Try `iptables -h' or 'iptables --help' for more information.

Aӷ|ıoܩ_ǡAy --dport z|OѼ (arg) OHoO]AS[W -p tcp -p udp tGڡIܭnI

Ff~Ab TCP ٦SXаڡI̱`NOӥDʳsu SYN XФFC ڭ̦b iptables ̭٤䴩y --syn zBz觋Aڭ̥HUҤlӻnFG

dҡGNӦۥaӷ port 1:1023 Dʳsu쥻ݪ 1:1023 su
[root@www ~]# iptables -A INPUT -i eth0 -p tcp --sport 1:1023 \
> --dport 1:1023 --syn -j DROP

@ӻAclient ݱҥΪ port Oj 1024 HWfA server ݫhOҥΤp 1023 HUfbťCҥHڭ̥iHӦۻݪp 1023 HUfƪDʳsuLI AΦb FTP DʳsuIoڭ̥Ӧb FTP `AӽͧaI

9.3.4-5 iptables ~ҲաGmac P state

b kernel 2.2 Heϥ ipchains ޲zɡAq`|tκ޲z۷YhI] ipchains Sҿתʥ]AҲաA]ڭ̥nwʥ]iBXViޱC|ҨӻApGAQnsu컷ݥD port 22 ɡAAnwWhӳ]wG

o|ܳ·СI]pGAnsu 10 D port 22 ɡA] OUTPUT w]} (ACCEPT)A A»ݭngQWhAQݥD port 22 iHsuAaݥDWC pG}ҥ port 22 OHS߬YǴcND|DʥH port 22 suAWI P˪DzApGAnaݥDiHs~ port 80 (WWW A)AN󤣱oF oNOsuOV@ӫܭnI

nbڭ̪ iptables KFoӧxZILiHzL@ӪAҲըӤR yoӷQniJʥ]O_ڵoXh^Hz pGOڵoXh^ANiHHIzIuΡIo˴Nκ޻ݥDO_suiӪDFI pFOHݬݩUykG

[root@www ~]# iptables -A INPUT [-m state] [--state A]
ﶵPѼơG
-m G@ iptables ~ҲաADn`G
     state GAҲ
     mac   Gdw} (hardware address)
--state G@ǫʥ]AADnG
     INVALID    GLĪʥ]AҦpƯ}lʥ]A
     ESTABLISHEDGwgsu\suAF
     NEW        GQnsإ߳suʥ]AF
     RELATED    Goӳ̱`ΡIܳoӫʥ]OPڭ̥DoeXhʥ]

dҡGunwإߩάʥ]NHqLAunOXkʥ]N
[root@www ~]# iptables -A INPUT -m state \
> --state RELATED,ESTABLISHED -j ACCEPT
[root@www ~]# iptables -A INPUT -m state --state INVALID -j DROP

p@ӡAڭ̪ iptables N|DʤRXӫʥ]O_^AAYOܡANHCI oˤ@ӧANݭnw^ʥ]ӼgӧOWhFIouOӴΤFIUڭ~ͤ@U iptables t@ӥ~A NOwdӶiPmG

dҡGwϰ aa:bb:cc:dd:ee:ff D}su
[root@www ~]# iptables -A INPUT -m mac --mac-source aa:bb:cc:dd:ee:ff \
> -j ACCEPT
ﶵPѼơG
--mac-source GNOӷD MAC աI

pGAϺYǺAѬOiHzLק IP hճzLѾ~]AAӫH DNӰϺڵHäݭnAAiHzLeͨ쪺 ARP Ah쨺D MAC AMzLWYoӾA NӥD DROP YiCޥLF IP ADLDAOκd MAC Ӻ޲zA_hLNOXhաIAѥGH

MAC ]OiH˪AiHzLYdznӭקd MACCLAo̧ڭ̬O] MAC OLkק諸pӻC ~AMAC OѪA]WzרҤ~SOObϺAӤO Internet ~ӷI
9.3.4-6 ICMP ʥ]WhGwO_^ ping ӳ]p

bĤG ICMP wڭ̪D ICMP ۷hAӥBܦh ICMP ʥ]OFnΨӶi˴ΪIҥH̦nnNҦ ICMP ʥ]IpGOѾDɡAq`ڭ̷| ICMP type 8 (echo request) ӤwAݥDDڭ̬O_sbA]| ping ^NOFCICMP ʥ]榡BzOo˪G

[root@www ~]# iptables -A INPUT [-p icmp] [--icmp-type ] -j ACCEPT
ﶵPѼơG
--icmp-type G᭱n ICMP ʥ]A]iHϥΥNA
              Ҧp 8  N echo request NC

dҡG 0,3,4,11,12,14,16,18  ICMP type iHiJG
[root@www ~]# vi somefile
#!/bin/bash
icmp_type="0 3 4 11 12 14 16 18"
for typeicmp in $icmp_type
do
   iptables -A INPUT -i eth0 -p icmp --icmp-type $typeicmp -j ACCEPT
done

[root@www ~]# sh  somefile

o˴N}񳡤 ICMP ʥ]榡iJi˴u@FILApGADO@ϺѾA ij icmp ʥ]٬Onqq~nIoO]Τ˴ɡA``|ϥ ping ӴըѾuO_ZqGI ҥHnNѾ icmp A|pաI

9.3.4-7 WKΤݨ]pPWhxs

gLWz iptables ykRAUӧڭ̨ӷQQApGbΤݥBѺAȪ Linux ɡA Aӭnp]pAOHѹ껡AAunRL CentOS w]WhN|DFAzפWA ӭnWhpUG

  1. WhksGMҦwgsbWh (iptables -F...)
  2. w]FGF INPUT oӦۭq] DROP ~ALw] ACCEPTF
  3. HGѩ lo 糧ӻO۷nA] lo ]wH˸mF
  4. ^ʥ]GDʦV~nDӦ^ʥ]iHiJ (ESTABLISHED,RELATED)
  5. HΤGoODnApGAQnϺӷiΧAD귽

oNO̶̳KAAiHzLĤGBJשҦݪӷʥ]AӳzLĥ|BJAnDݥD^ʥ]iHiJA [W lo oӤj˸miHAKKI@ client MΪWhN OK FIAiHbY script Wo˰YiG

[root@www ~]# vim firewall.sh
#!/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin; export PATH

# 1. MWh
iptables -F
iptables -X
iptables -Z

# 2. ]wF
iptables -P   INPUT DROP
iptables -P  OUTPUT ACCEPT
iptables -P FORWARD ACCEPT

# 3~5. qUWh
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i eth0 -m state --state RELATED,ESTABLISHED -j ACCEPT
#iptables -A INPUT -i eth0 -s 192.168.1.0/24 -j ACCEPT

# 6. gJWh]w
/etc/init.d/iptables save

[root@www ~]# sh firewall.sh
bxsWh /etc/sysconfig/iptables:              [  Tw  ]

꨾]O@ӪAȡAAiHzLychkconfig --list iptableszhݴNDFC ]AAoק諸Uس]wQnbU}٫OsANoniy /etc/init.d/iptables save zoӫO[ѼơC ]A{bONxsʧ@gJo firewall.sh }A¨oI{bAA Linux Dwg۷O@FA uOpGQn@AAΪ̬O@ѾANonۦ[WYǦۭqWhoC

ѹ껡ApGA Linux xܡAhק /etc/sysconfig/iptables MN iptables oӪA restartA AWhNO|b}sboILAӤH٬Owg scripts NOFC

qnWhMNOnoIpթOH

  1. ѥDV~DʳsuլݬݡF
  2. AѨp줺 PC V~DʳsuլݬݡF
  3. ̫A Internet WDADʳsuA Linux DլݬݡF

@B@B@UӡAݬݰDXb̡AMhhhiB}I򥻤WAWثeܦhƥiHѧAѦҤFI o@g]wgO²Aj٦bжqӤwIƱjaUI bѦҸ(2)CXXӦΪAƱjaůunhhhݬݡI|ܦUI

9.3.5 IPv4 ֤ߺ޲z\G /proc/sys/net/ipv4/*

F iptables oӨn𫗪~Aꫥ Linux kernel 2.6 ѫܦh֤߹w]׾I ѩO֤ߪ\AҥH]wƳOmb /proc/sys/net/ipv4/ oӥؿC ܩӥؿUUɮתԲӸơAiHѦҮ֤ߪG

WoӻƥiH http://www.kernel.org oӺU@Ӯ֤߭lXAYNݨC o̤]@ƥG

쪺ӭnۦhd@dnIڭ̩UNX²檺ɮרӧ@aI

9.4 𪺤@ӹ

ФFohykP`NƶAשnӬ[]FC٬Onϥθ}ӼgA MzL̲ת /etc/init.d/iptables save ӱNGxs /etc/sysconfig/iptables hI ӥB@S٥iHΦbIsL scripts AiHWh㦳FϥΤ觋C nFANӽͽͦp]w̪WhaI


9.4.1 Wh

UЪoӨAiHΨӧ@ѾWA]iHΨӧ@C ]wsupPUϩҥܡA Linux D]O LAN ѾIYO@²檺 IP ɾ\աI]UoǡG

@ӰϰѾ[cܷN
9.4-1B@ӰϰѾ[cܷN

ѩƱNH (LAN) PH (Internet) Ӥ}@IA ҥHƱAiHb Linux Ww˨HWdANdbPAo˥iHקKܦhDC ܩ̭nFOGyҦsuAȶ}SwAzҦC ӥB]ϥΪ̤wgL}nVmA]b filter table Tӹw]FOG

UwpѪy{Oo˪G

Why{ܷN
9.4-2BWhy{ܷN

hWA LAN DPD}׫ܰA] Output P Forward O}񤣲zIpaxDOiHA]ڭ̤qƶqhAӥBHOxA ҥHݭnSO[HޡIOGybj~Ao˪WOܤX檺A ]AOҤҦHiHӧAWwӨϥ Network Iz]NOyazrI ]A˪ҳs Output P Forward ݭnSO[H޲z~I

9.4.2 ڳ]w

ƹWAڭ̦b]w𪺮ɭԡAӥi|@Ӥ@ӫOJAq`OQ shell scripts ڭ̹Fo˪\oIUOQΤWy{ϩҳWXӪ}AAiHѦҬݬݡA OAݭnNҭק令AXAۤvҤ~I~AFӭק@KAN script TAOOG

ӤHߺDONoӸ}m /usr/local/virus/iptables ؿUAA]iHۦmۤvߺDmhC UN@@o}OgaI

[root@www ~]# mkdir -p /usr/local/virus/iptables
[root@www ~]# cd /usr/local/virus/iptables
[root@www iptables]# vim iptables.rule
#!/bin/bash

# ХJzѼơAnJ~FI
  EXTIF="eth1"           # oӬOiHsW Public IP 
  INIF="eth0"            #  LAN sFYLhg INIF=""
  INNET="192.168.1.0/24" # YL줶Aжg INNET=""
  export EXTIF INIF INNET

# Ĥ@Aw糧]wI##########################################
# 1. ]wn֤ߪ\G
  echo "1" > /proc/sys/net/ipv4/tcp_syncookies
  echo "1" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
  for i in /proc/sys/net/ipv4/conf/*/{rp_filter,log_martians}; do
        echo "1" > $i
  done
  for i in /proc/sys/net/ipv4/conf/*/{,accept_source_route,accept_redirects,\
send_redirects}; do
        echo "0" > $i
  done

# 2. MWhB]ww]Fζ} lo P]w
  PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/local/sbin:/usr/local/bin; export PATH
  iptables -F
  iptables -X
  iptables -Z
  iptables -P INPUT   DROP
  iptables -P OUTPUT  ACCEPT
  iptables -P FORWARD ACCEPT
  iptables -A INPUT -i lo -j ACCEPT
  iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# 3. ҰB~ script Ҳ
  if [ -f /usr/local/virus/iptables/iptables.deny ]; then
        sh /usr/local/virus/iptables/iptables.deny
  fi
  if [ -f /usr/local/virus/iptables/iptables.allow ]; then
        sh /usr/local/virus/iptables/iptables.allow
  fi
  if [ -f /usr/local/virus/httpd-err/iptables.http ]; then
        sh /usr/local/virus/httpd-err/iptables.http
  fi

# 4. \Y ICMP ʥ]iJ
  AICMP="0 3 3/4 4 11 12 14 16 18"
  for tyicmp in $AICMP
  do
    iptables -A INPUT -i $EXTIF -p icmp --icmp-type $tyicmp -j ACCEPT
  done

# 5. \YǪAȪiJAШ̷ӧAۤvҶ}
# iptables -A INPUT -p TCP -i $EXTIF --dport  21 --sport 1024:65534 -j ACCEPT # FTP
# iptables -A INPUT -p TCP -i $EXTIF --dport  22 --sport 1024:65534 -j ACCEPT # SSH
# iptables -A INPUT -p TCP -i $EXTIF --dport  25 --sport 1024:65534 -j ACCEPT # SMTP
# iptables -A INPUT -p UDP -i $EXTIF --dport  53 --sport 1024:65534 -j ACCEPT # DNS
# iptables -A INPUT -p TCP -i $EXTIF --dport  53 --sport 1024:65534 -j ACCEPT # DNS
# iptables -A INPUT -p TCP -i $EXTIF --dport  80 --sport 1024:65534 -j ACCEPT # WWW
# iptables -A INPUT -p TCP -i $EXTIF --dport 110 --sport 1024:65534 -j ACCEPT # POP3
# iptables -A INPUT -p TCP -i $EXTIF --dport 443 --sport 1024:65534 -j ACCEPT # HTTPS


# ĤGAwݥD]wI###############################
# 1. J@ǦΪҲ
  modules="ip_tables iptable_nat ip_nat_ftp ip_nat_irc ip_conntrack 
ip_conntrack_ftp ip_conntrack_irc"
  for mod in $modules
  do
      testmod=`lsmod | grep "^${mod} " | awk '{print $1}'`
      if [ "$testmod" == "" ]; then
            modprobe $mod
      fi
  done

# 2. M NAT table WhaI
  iptables -F -t nat
  iptables -X -t nat
  iptables -Z -t nat
  iptables -t nat -P PREROUTING  ACCEPT
  iptables -t nat -P POSTROUTING ACCEPT
  iptables -t nat -P OUTPUT      ACCEPT

# 3. }񦨬ѾAB IP ɾI
  if [ "$INIF" != "" ]; then
    iptables -A INPUT -i $INIF -j ACCEPT
    echo "1" > /proc/sys/net/ipv4/ip_forward
    if [ "$INNET" != "" ]; then
        for innet in $INNET
        do
            iptables -t nat -A POSTROUTING -s $innet -o $EXTIF -j MASQUERADE
        done
    fi
  fi
  # pGA MSN @LksuAΪ̬OYǺ OK YǺ OKA
  # iO MTU DAAiHNUo@浃LѨӱҰ MTU d
  # iptables -A FORWARD -p tcp -m tcp --tcp-flags SYN,RST SYN -m tcpmss \
  #          --mss 1400:1536 -j TCPMSS --clamp-mss-to-pmtu

# 4. NAT Aݪ LAN ~A]w
# iptables -t nat -A PREROUTING -p tcp -i $EXTIF --dport 80 \
#          -j DNAT --to-destination 192.168.1.210:80 # WWW

# 5. S\A]A Windows ݮୱҲͪWhA]ୱD 1.2.3.4
# iptables -t nat -A PREROUTING -p tcp -s 1.2.3.4  --dport 6000 \
#          -j DNAT --to-destination 192.168.1.100
# iptables -t nat -A PREROUTING -p tcp -s 1.2.3.4  --sport 3389 \
#          -j DNAT --to-destination 192.168.1.100

# 6. ̲ױNoǥ\xsUӧaI
  /etc/init.d/iptables save

SOdNW{XSr鳡A򥻤WAAunק@ṲW𫍧A ӴNB@oӨFCL]CӤHҳۦPA ]Ab]wA»ݭnդ@U~IMAXFDnǧڰڡI.... AӬݤ@U iptables.allow eOpHpڭn@ 140.116.44.0/24 oӺ쪺ҦDӷiHiJڪDܡAoɮתeiHgoˡG

[root@www iptables]# vim iptables.allow
#!/bin/bash
# UhgA\iJLΥDڡI
  iptables -A INPUT -i $EXTIF -s 140.116.44.0/24 -j ACCEPT

# UhOתɮ׳]wkI
[root@www iptables]# vim iptables.deny
#!/bin/bash
# UgOyAnתөNNIz
  iptables -A INPUT -i $EXTIF -s 140.116.44.254 -j DROP

[root@www iptables]# chmod 700 iptables.*

NoTɮתv]w 700 Buݩ root vAN iptables.rule oI Ln`NOAbWרҷAw]NҦAȪqDOI ҥHAn𪺲 5 BJBN@ǵѲŸ (#) Ѷ}~C P˪ApGLh port Qn}ҮɡA@˻ݭnW[B~Wh~I

LA٬OpPeڭ̩һAo firewall ȯണѰ򥻪w@ALDٻݭnAմթOI ~ApGAƱ@}N۰ʰo script ܡAбNoɮתɦWgJ /etc/rc.d/rc.local AIUoˡG

[root@www ~]# vim /etc/rc.d/rc.local
....(Lٲ)....
# 1. Firewall
/usr/local/virus/iptables/iptables.rule

ƹWAoӸ}̩Uwg[JgJw]Whɪ\AҥHAun@AN֦̥TWhFI Wz rc.local ȬOwU@ӤwC ^_^IWzTɮ׽ЧAnb Windows tΤWs~ǰe Linux WB@A] Windows tΪ_rDANiɭPɮ׵LkCijA쩳UhUAǰe Linux iHQ dos2unix Ohഫ_rIN|DI

oNO@ӳ²BKCPɡAoӨ٥iH㦳̶K IP ɾ\OI ]NOb iptables.rule oɮ׷ĤGFC oڭ̦bU@`|A~򤶲ЪC

9.5 NAT A]w

IIIשӨoӦaFIڭ̷dzƭn[]@ѾAAN٤ NAT AC NAT OOH²檺AAiH٥L LAN Dy IP ɾzաI

NAT WO Network Address TranslationArWNOy}ഫzCѦrWNڭ̨ӷQ@QA TCP/IP ʥ]O IP }ܡH IP }OӷPتܡHڭ̪ iptables ONק IP ʥ]YơA KKIsؼЩΨӷ IP }iHקOIƦܳs TCP ʥ]Y port number ]קIuOI

NAT A\iHF 9.1-2ҤЪ IP ɪ\ध~A ٥iHF 9.1-4ҤЪ DMZ (Dxư) \IoMڭ̪ NAT OקG (1)ӷ IP ٬O (2)ؼ IP IUڭ̴NӲ@aI ^_^


9.5.1 O NATH SNATH DNATH

bͨ NAT ڹB@eAڭ̦AӬݤ@U²檺ʥ]zL iptables ӶǰeݥDPy{(ЩeѦ 9.3-4)C Gup 9.1-2[cAY LAN @DQnǰeʥ]XhɡA oӫʥ]npzL Linux DӶǰeXhHLOo˪G

  1. gL NAT table PREROUTING F
  2. gѸѧP_Twoӫʥ]OniJP_AYiJAhU@BF
  3. AgL Filter table FORWARD F
  4. qL NAT table POSTROUTING A̫ǰeXhC

NAT AINbWy{ 1,4 BJA]NO NAT table nGPREROUTING P POSTROUTINGC o즳򭫭n\OHIbק IP IOoק諸 IP O@˪I POSTROUTING bקӷ IP APREROUTING hbקؼ IP C ѩק諸 IP @ˡAҥHN٬ӷ NAT (Source NAT, SNAT) Υؼ NAT (Destination NAT, DNAT)Cڭ̥ӽͤ@ IP ɾ\઺ SNAT aI


9.5.2 ̶K NAT AG IP ɥ\

b Linux NAT AAȷA̱`NO 9.1-2 IP ɾ\FC ӥѭ𫍧ЧA]ӪDAo IP ɾ\NO SNAT աI@δNuOb iptables NAT AӸѫ᪺ POSTROUTING i IP ˴NOFCt~A A]nAѡAA NAT An@ public IP AHΤ@Ӥ LAN s private IP ~CUdҤA]Oo˪G

OIAQΫeXͨ쪺ƨӳ]wAѼƫAȥniѪ˴A ]b NAT A]w譱A̮eXaNOѤFIרOb ppp0 oӹ~ҤUA oӰDYCϥAnOoGypGA public IP o觋O cable modem ɡAA]w /etc/sysconfig/network, ifcfg-eth0, ifcfg-eth1 ɮסAdUn]w GATEWAY աIz_hN|X{ default gateway AϦӷ|yDC

pGAwgUF iptables.rule Aɮפwgt NAT }FI AiHݨɮתĤG NAT AAӦݨ쩳UoXG

iptables -A INPUT -i $INIF -j ACCEPT
# o@欰DnADnتO LAN ϥ NAT A귽C
# 𫟺 $INIF bҤ eth0 

echo "1" > /proc/sys/net/ipv4/ip_forward
# WYo@hObA Linux 㦳 router O

iptables -t nat -A POSTROUTING -s $innet -o $EXTIF -j MASQUERADE
# o@INO[J nat table ʥ]ˡIҤ $innet O 192.168.1.0/24
#  $EXTIF hO~AҤ eth1

Ibӡy MASQUERADE zIoӳ]wȴNOy IP ˦ʥ]Xh (-o) ˸mW IP zIHWҤlӻANO $EXTIF A]NO eth1 աI ҥHʥ]ӷunӦ $innet (]NO LAN LD) Aunӫʥ]izL eth1 ǰeXhA N|۰ʪק IP ӷY eth1 public IP աINo²I AunN iptables.rule UAó]wnAB~A iptables.rule AA Linux N֦DH NAT A\FI

DG
pPWҭzרҡAA LAN L PC ӭnp]wѼơH
G
ר²ڡAN NAT A@ PC GATEWAY YiIunOoUѼƭȡG
  • NETWORK 192.168.1.0
  • NETMASK 255.255.255.0
  • BROADCAST 192.168.1.255
  • IP iH]w 192.168.1.1 ~ 192.168.1.254 AiơI
  • qTh (Gateway) ݭn]w 192.168.1.2 (NAT A Private IP)
  • DNS (/etc/resolv.conf) ݳ]w 168.95.1.1 (Hinet) 139.175.10.20 (Seed Net)A oӽШ̧A ISP өwF

ƹWAF IP (MASQUERADE) ~Aڭ٥iHwק IP ʥ]Yӷ IP OI |ҨӻApUoӨҤlG

DG
]~ IP Tw 192.168.200.250 AYQϥΰˡAӦpBzH
G
iptables -t nat -A POSTROUTING -o eth1 -j SNAT \
         --to-source 192.168.200.250

DG
]A NAT A~ IP nXӡAAQnyϥΤP IP ɡASӦp]wH|ҨӻAA IP d 192.168.200.210~192.168.200.220
G
iptables -t nat -A POSTROUTING -o eth1 -j SNAT \
         --to-source 192.168.200.210-192.168.200.220

oˤ]iHקʥ]ӷ IP ƳILADAϥΪOTw IP ABh IP iH~suA_h@ϥ IP ˧YiAݭnϥΨo SNAT աIMAA]i঳ۤvWSҰաI ^_^

9.5.3 iptables B~֤߼Ҳե\

pGAb iptables.rule ĤGJӬݪܡA Sıoܩ_ǡAڭ̻ݭnJ@ǦΪҲաH|ҨӻA ip_nat_ftp ip_nat_irc H oO]ܦhqTwϥΪʥ]ǿSAרO FTP ɮ׶ǿϥΨ port ӳBzơI oӳڭ̷|b FTP `AӸԽ͡Abo̧AnDAڭ̪ iptables ѫܦhnΪҲաA oǼҲեiHUʥ]Loγ~Aڭ̥iH`٫ܦh iptables WhwAnΪoI ^_^

9.5.4 bݤA DNAT ]w

JMiH SNAT IP ɥ\Aڭ̷MiHϥ iptables X DMZ աI OAӡAPAʥ]ǿ骺觋i঳ItA]Aijs⤣noөNNI _hܮeɭPYǪAȵLkQ Internet ѪDC

ӽͤ@͡ApGڷQnBz DNAT \ɡA iptables npUFOH t~AAnDOA DNAT Ψ쪺O nat table Prerouting IndFC

DG
]D IP 192.168.1.210 AӥDOi Internet } WWW ACAӦpzL NAT AN WWW ʥ]ǨӥDWH
G
] public IP Ҧb eth1 AAWhNOG 
iptables -t nat -A PREROUTING -i eth1 -p tcp --dport 80 \
     -j DNAT --to-destination 192.168.1.210:80

ӡy -j DNAT --to-destination IP[:port] zNOաINq eth1 oӤǤJABQnϥ port 80 AȮɡA Nӫʥ]sǾɨ 192.168.1.210:80 IP port WIiHPɭק IP P port OIuKC L٦@Ǹi iptables ϥΤ觋ApUҥܡG

-j REDIRECT --to-ports <port number>
# oӤ]`A򥻤WANOi楻W port ഫNOFI
# LASOdNOAoӰʧ@ȯb nat table  PREROUTING H
# OUTPUT WӤwI

dҡGNnDP 80 suʥ]໼ 8080 o port
[root@www ~]# iptables -t nat -A PREROUTING -p tcp  --dport 80 \
> -j REDIRECT --to-ports 8080
# oN̮ebAϥΤFDW port ӶiY well known wA
# Ҧpϥ 8080 o port ӱҰ WWW AOOHH port 80 ӳsuA
# ҥHAANiHϥΤW觋ӱNADsuǻ 8080 oI

ܩhγ~ANݧAۤvooI ^_^

9.6 I^U
9.7 D
9.8 ѦҸƻP\Ū
2002/08/20GĤ@I
2003/08/25Gs]peAg@ǫOСAPe@gy{Ѻwz @II
2006/09/06GNª峹ʨB
2006/09/11GFwgb¦gйL {ѪAȤ TCP WrappersC
2006/09/13G[J NAT FANª NAT Dʨ BC
2006/09/15GN iptables.rule sKWhFIeѰOקɮפF
2006/11/08G] PPPoE P Ethernet MTU PAibYDZpU|ɭPϥΪ̵LksuAsF iptables.rule FC
2010/10/27GNª CentOS 4.x ʨB
2011/02/08GקFܦhϥܡAåBNy@ӾzAjVèSSקI