Iptables firewall experiment

First, explain the environment , Here are four hosts , In the middle of the Centos Acting as a firewall . In the top right corner of the win XP And the one in the lower right corner Rhel7 Acting as a server , The leftmost win7 Act as a host . The network cards between the four have been configured . And we are already Centos6.5 Port forwarding function is enabled on .

• echo  1 > /proc/sys/net/ipv4/ip_forward
• sysctl  -w  net.ipv4.ip_forward=1
• vim  /etc/sysctl.conf  ,  take net.ipv4.ip_forward=0  Change it to =1, then  sysctl -p   /etc/sysctl.conf

The firewall is on IP After forwarding function , And then empty iptables All the rules in it , Release all .win7、winXP、Rhel7 Turn off the firewall , Then the four can communicate with each other .

Configure the firewall to prohibit access ftp service

We are win xp Upper opening ftp service , adopt win7  and Rhel7 Sure  ftp WinXP.

Now we need to configure the firewall , Make it forbidden FTP The traffic of the service goes through . because Win7 If you want to FTP visit WinXP, The traffic passes through the firewall first , Then forward by firewall . So we're on the firewall filter Tabular FORWARD Chain configuration , Make it refuse FTP Flow through

      
      

       
       iptables 
       
       -
       
       t 
       
       filter 
       
       -
       
       A 
       
       FORWARD 
       
       -
       
       p 
       
       tcp 
       
       --
       
       dport 
       
       21 
       
       -
       
       j 
       
       DROP
      
      
      
      

       
       
1.
      
      

You can see ,filter In the table FORWARD A rejection has been added to the chain TCP Of 21 Port No   Rules . And then we start with Win7 FTP WinXP, You can see , No longer FTP 了 .

Configure the firewall so that the specified network segment can be accessed FTP service

We configure on the firewall , bring Rhel7 Can access FTP service , and Win7 Cannot access FTP service .

      
      

       
       iptables -t filter -A FORWARD -s 10.0.0.2  -p tcp --dport 21  -j ACCEPT   //filter Tabular FORWARD The chain allows source addresses 10.0.0.2 The host , Destination port 21 Flow of No 
       
       
iptables -t filter -A FORWARD -s 192.168.1.2 -p tcp --dport 21 -j DROP  //filter Tabular FORWAARD Chain reject source address 192.168.1.2 The main sentence of , Destination port 21 Flow of No 
      
      
      
      

       
       
1.
       
       
2.
      
      

You can see ,filter In the table FORWARD The chain rejects all traffic by default , The release source addresses are 10.0.0.0/24 and 20.0.0.0/24 Of ftp service .

prohibit PING

Configure discard on the firewall  icmp Agreed request  package , That is to say icmp-type by 8 My bag

      
      

       
       iptables 
       
       -
       
       A 
       
       FORWARD 
       
       -
       
       p 
       
       icmp 
       
       -
       
       -
       
       icmp
       
       -
       
       type 
       
       8 
       
       -
       
       j 
       
       DROP
      
      
      
      

       
       
1.
      
      

You can see , already ping It doesn't work ,Windows The system displays that the request timed out , and Linux The system cannot send packages

And when we configure rejection icmp The package of the agreement passed

      
      

       
       iptables -A FORWARD -p icmp --icmp-type 8 -j REJECT
      
      
      
      

       
       
1.
      
      

If you refuse ,windows Systems and Linux The system shows that the target port is unreachable .

Prohibit by network segment Ping

Configure firewall , discarded 192.168.1.0/24 The network segment icmp Request package , allow 10.0.0.0/24 The network segment icmp Request package

      
      

       
       iptables -A FORWARD -s 192.168.1.0/24 -p icmp --icmp-type 8 -j DROP
       
       
iptables -A FORWARD -s 10.0.0.0/24 -p icmp --icmp-type 8 -j ACCEPT
      
      
      
      

       
       
1.
       
       
2.
      
      

You can see ,Win7 No longer ping 了 , and Rhel7 Sure ping

prohibit Telnet service

The others are exactly the same as those above , Only the port of the filter rule has been changed

      
      

       
       iptables -A FORWARD -p tcp --dport 23 -j DROP
      
      
      
      

       
       
1.
      
      

Prohibit by network segment Telnet service

      
      

       
       iptables -A FORWARD  -s  192.168.1.0/24  -p tcp --dport 23  -j DROP
       
       
iptables -A FORWARD  -s  20.0.0.0/24  -p  tcp  --dport 24 -j ACCEPT
      
      
      
      

       
       
1.
       
       
2.