iptables、共享上网SNAT、端口转发DNAT
iptables、共享上网SNAT、端口转发DNAT
1.防火墙概述
封端⼝,封ip
实现NAT功能
共享上⽹
端⼝映射(端⼝转发),ip映射
2.防火墙
2.1防火墙种类以及使用说明
硬件：整个企业入口
软件：开源软件 网站内部 封ip
iptables
云防火墙
安全组
NAT网关
waf应用防火墙
2.2专有名词
容器、表、链、规则
2.3iptables执行过程
1.防⽕墙是层层过滤的，实际是按照配置规则的顺序从上到下，从前到后进⾏过滤的。
2.如果匹配成功规则，即明确表示是拒绝(DROP)还是接收(ACCEPT)，数据包就不再向下匹配新的规则。
3.如果规则中没有明确表明是阻⽌还是通过的，也就是没有匹配规则，向下进⾏匹配，直到匹配默认规则得到明确的阻⽌还是通过。
4.防⽕墙的默认规则是所有规则都匹配完才会匹配的。
2.4表与链
iptables 是 4表伍链
4表: filter 表 nat表 raw表 mangle表
伍链: INPUT OUTPUT FORWARD PREROUTING POSTROUTING
1.filter表
实现防火墙功能：屏蔽或准许端口ip
2.nat表
实现nat功能：实现共享上网 端口映射和ip映射
2.5环境准备及命令
先关闭防火墙
systmectl stop firewalld
systemctl disable firewalld
1.安装并启动
yum install iptables-services
systemctl enable iptables
systemctl start iptables
2.设置开机自启防火墙相关模块
cat >>/etc/rc.local<<EOF
modprobe ip_tables
modprobe iptable_filter
modprobe iptable_nat
modprobe ip_conntrack
modprobe ip_conntrack_ftp
modprobe ip_nat_ftp
modprobe ipt_state
EOF
lsmod | egrep 'filter|nat|ipt'
3.查看规则
iptables -nL 默认filter -n不要把端⼝ 或ip反向解析为名字 -L 列出规则
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
查看指定表的规则 iptables -t nat -nL
[root@localhost ~]# iptables -t nat -nL
Chain PREROUTING (policy ACCEPT)
target prot opt source destination
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
配置filter表规则
| -A | 添加防火墙规则(尾部追加) |
|---|---|
| -D | 删除防火墙规则 |
| -I | 插入防火墙规则(首部插入) |
| -F | 清空防火墙规则 |
| -X | 删除用户自定义的链 |
| -L | 列出添加防火墙规则 |
| -R | 替换防火墙规则 |
| -Z | 清空防火墙数据表统计信息 |
| -P | 设置链默认规则 |
| -p | 协议 protocal tcp/udp/icmp/all 指定端口的时候需要用到指定协议 |
| --dport | 目标端口 |
| -j | 满足条件后的动作 DROP/ACCEPT/REJECT drop 把数据丢掉不会返回给用户 reject 返回拒绝信息 |
| -s | --source 源ip |
| -d | --destination ⽬标ip |
1.先清空规则
[root@localhost ~]# iptables -F
[root@localhost ~]# iptables -X
[root@localhost ~]# iptables -Z
[root@localhost ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
2.添加规则
iptables -t filter -I INPUT -p tcp --dport 22122 -j drop
3.删除规则
iptables -t filter -D INPUT 1 //1是行号 上述添加的规则的行号
1：封ip
1.192.168.70.133机器 ping 192.168.70.136机器
[root@web2 ~]# ping 192.168.70.136
PING 192.168.70.136 (192.168.70.136) 56(84) bytes of data.
64 bytes from 192.168.70.136: icmp_seq=1 ttl=64 time=0.937 ms
2.136机器添加规则
iptables -t filter -I INPUT -s 192.168.70.134 -j DROP
3.删除规则
iptables -D INPUT 1 //删除后可以发现又继续ping了
2：禁止网段访问指定端口
iptables -t filter -I INPUT -s 192.168.70.0/24 -p tcp --dport 8888 -j DROP
3：只允许指定网段连入
iptables -I INPUT ! -S 192.168.70.0/24 -j DROP
4：指定多端口
iptables -I INPUT -m multiport -p tcp --dport 80,433 -j DROP //禁止80和433端口
iptables -I INPUT -p tcp --dport 1:10 -j DROP //禁止1-10端口
5：控制是否能ping
iptables -I INPUT -p icmp -j DROP
另一种方法
vim /etc/sysctl.conf //添加如下一条指令
net.ipv4.icmp_echo_ignore_all = 1
sysctl -p //生效
6:匹配⽹络状态（TCP/IP连接状态）
NEW：已经或将启动新的连接
ESTABLISHED：已建⽴的连接
RELATED：正在启动的新连接INVALID：⾮法或⽆法识别的
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
7:限制并发及速率
-m limit --limit 10/minute #每分钟只能有10个数据包 每6秒⽣成
8:防⽕墙规则的保存与恢复
iptables-save 默认输出到屏幕
iptables-restore 加上⽂件
写⼊到/etc/sysconfig/iptables
iptables-save > /etc/sysconfig/iptables
iptables-restore < /etc/sysconfig/iptables
3.实际⽣产⽤法
iptables -F
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -s 允许的IP地址 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -P INPUT DROP
iptables-save
4.共享上网SNAT
实现：内部网络的服务器通过可访问外网的机器访问到外网
环境准备
server01设置为VMnet2 192.168.100.18
server02设置为NAT 192.168.70.134 网络再添加一个网卡VMnet2 192.168.100.16
1.设置好server01的ip
[root@server01 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33
BOOTPROTO="none"
IPADDR=192.168.100.18
NETMASK=255.255.255.0
NAME="ens33"
DEVICE="ens33"
DNS1=114.114.114.114
2.设置好server02的ip
[root@server02 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:eb:13:88 brd ff:ff:ff:ff:ff:ff
inet 192.168.70.134/24 brd 192.168.70.255 scope global noprefixroute dynamic ens33
valid_lft 5270229sec preferred_lft 5270229sec
inet6 fe80::725c:49ee:6f78:42a0/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: ens37: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000
link/ether 00:0c:29:eb:13:92 brd ff:ff:ff:ff:ff:ff
[root@server02 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens37
BOOTPROTO="none"
IPADDR=192.168.100.16
NETMASK=255.255.255.0
NAME="ens37"
DEVICE="ens37"
DNS1=114.114.114.114
[root@server02 ~]# systemctl restart network
[root@server02 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:eb:13:88 brd ff:ff:ff:ff:ff:ff
inet 192.168.70.134/24 brd 192.168.70.255 scope global noprefixroute dynamic ens33
valid_lft 5269237sec preferred_lft 5269237sec
inet6 fe80::725c:49ee:6f78:42a0/64 scope link noprefixroute
valid_lft forever preferred_lft forever
3: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:eb:13:92 brd ff:ff:ff:ff:ff:ff
inet 192.168.100.16/24 brd 192.168.100.255 scope global noprefixroute ens37
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:feeb:1392/64 scope link
valid_lft forever preferred_lft forever
3.测试ping相互下一
[root@server01 ~]# ping 192.168.100.16
4.server02开启转发功能
[root@serve02 ~]# echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf
[root@serve02 ~]# sysctl -p
5.server02设置iptables
[root@serve02 ~]# iptables -t nat -A POSTROUTING -s 192.168.100.0/24 -j SNAT --to-source 192.168.70.134
6.测试
[root@server01 ~]# ping baidu.com //能通则成功了
[root@server02 ~]# iptables -t nat -D POSTROUTING 1 //再试着关闭规则 再试试ping
5.端口转发DNAT
在上述snat基础上增加一台机器server03
1.server02添加prerouting规则
iptables -t nat -A PREROUTING -d 192.168.70.134 -p tcp --dport 9000 -j DNAT --to-destination 192.168.100.18:22
2.server03测试
[root@localhost ~]# ssh 192.168.70.134 -p 9000
[email protected]'s password:
Last login: Fri Sep 1 20:37:06 2023
[root@localhost ~]# ip a //查看端口可以发现连上的是server01
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether 00:0c:29:18:39:18 brd ff:ff:ff:ff:ff:ff
inet 192.168.100.18/24 brd 192.168.100.255 scope global noprefixroute ens33
valid_lft forever preferred_lft forever
inet6 fe80::725c:49ee:6f78:42a0/64 scope link noprefixroute
valid_lft forever preferred_lft forever