iptables工作常用操作

正确的设置iptables命令汇总

---

iptables -P INPUT ACCEPT
iptables -F
iptables -X
iptables -Z
iptables -I INPUT -p tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -i lo  -j ACCEPT
iptables -A INPUT  -j DROP

　　

显示如下，其中lo口的再source列显示成为了0.0.0.0/0  刚开始以为放行了所有IP呢，实际测试是lo口。正常工作

[root@cenos ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
[root@cenos ~]#

　　

前面添加允许的规则，最后追加一条规则拒绝其它所有的，无论什么协议的

链规则默认是ACCEPT，不推荐改成DROP，后面最后会演示隐患

关于上面的一些问题汇总

---

刚开始把lo口放行的改成了如下

iptables -A INPUT -s 127.0.0.1/8  -j ACCEPT　　

这样的话自己去连自己只能通过127.0.0.1去连接了。经过自己的IPV4连接出现不通的情况。如下测试

[root@linux-node1 ~]# telnet 192.168.56.11 9292
Trying 192.168.56.11...
^C
[root@linux-node1 ~]# telnet 127.0.0.1 9292
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
^]
telnet> quit
Connection closed.
[root@linux-node1 ~]#

　　

如果再添加一条命令,也能正常工作了。但是每次针对不同的主机都要修改源地址。觉得麻烦了

iptables -I INPUT -s 192.168.56.11/32 -j ACCEPT　

　

测试如下

[root@linux-node1 ~]# iptables -I INPUT -s 192.168.56.11/32 -j ACCEPT
[root@linux-node1 ~]# telnet 192.168.56.11 9292
Trying 192.168.56.11...
Connected to 192.168.56.11.
Escape character is '^]'.
^C^]
telnet> quit
Connection closed.
[root@linux-node1 ~]#

　　

　

放行自己出去的包回来命令解释

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

　　

测试正常添加，ping百度可以返回

[root@linux-node1 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@linux-node1 ~]# iptables -I INPUT -p tcp --dport 22 -j ACCEPT
[root@linux-node1 ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@linux-node1 ~]# iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@linux-node1 ~]# iptables -A INPUT  -j DROP
[root@linux-node1 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
[root@linux-node1 ~]#
##ping 百度测试下
[root@linux-node1 ~]# ping baidu.com -c 3
PING baidu.com (123.125.115.110) 56(84) bytes of data.
64 bytes from 123.125.115.110 (123.125.115.110): icmp_seq=1 ttl=128 time=37.9 ms
64 bytes from 123.125.115.110 (123.125.115.110): icmp_seq=2 ttl=128 time=35.9 ms
64 bytes from 123.125.115.110 (123.125.115.110): icmp_seq=3 ttl=128 time=35.8 ms

--- baidu.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 35.852/36.593/37.967/0.972 ms
[root@linux-node1 ~]#

　　

测试错误添加方式

注意这个命令要在最终的drop之前

[root@linux-node1 ~]# iptables -F
[root@linux-node1 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@linux-node1 ~]# iptables -I INPUT -p tcp --dport 22 -j ACCEPT
[root@linux-node1 ~]# iptables -A INPUT  -j DROP
[root@linux-node1 ~]# iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@linux-node1 ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@linux-node1 ~]# ping baidu.com -c 3
ping: baidu.com: Name or service not known
[root@linux-node1 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22
DROP       all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
[root@linux-node1 ~]# 

所以
注意这个命令要在最终的drop之前

　　

禁止别人ping自己，ACCEPT就允许了

禁止ping
[root@data-1-1 ~]# iptables -A INPUT -p icmp --icmp-type 8 -j DROP
[root@data-1-1 ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       icmp --  0.0.0.0/0            0.0.0.0/0            icmptype 8

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
[root@data-1-1 ~]# 

测试别的机器无法ping通它
[root@linux-node1 ~]# ping 10.0.2.11 -c 3
PING 10.0.2.11 (10.0.2.11) 56(84) bytes of data.

--- 10.0.2.11 ping statistics ---
3 packets transmitted, 0 received, 100% packet loss, time 2000ms

[root@linux-node1 ~]#

　　

注意iptables -I 和iptables -A是有区别的

-A和-I参数分别为添加到规则末尾和规则最前面

看到有些人使用-P改了默认的链的规则。我极其不推荐

---

比如下面方式、最后把链默认的改成了DROP方式

iptables -P INPUT ACCEPT
iptables -F
iptables -X
iptables -Z
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP

　　

我来演示下隐患

后期如果调整iptables时不小心执行了iptables -F时机器就无法连接了

xshell连接不上机器了
就是因为防火墙的INPUT 链默认被改成了DROP的规则
我执行iptables -F 清除了所有规则，也就无法连接22端口了

通过控制台登录查看下

修复问题

[root@linux-node1 ~]# iptables -P FORWARD ACCEPT
[root@linux-node1 ~]# iptables -P INPUT ACCEPT

　　

补充部分2

---

centos最小化安装默认没iptables。当执行下面命令如下提示

[root@linux-node1 ~]# service iptables save
The service command supports only basic LSB actions (start, stop, restart, try-restart, reload, force-reload, status). For other actions, please try to use systemctl.
[root@linux-node1 ~]# systemctl restart iptables.service
Failed to restart iptables.service: Unit not found.

　　

需要安装iptables-services

yum install iptables-services

iptables-services 和 iptables 是不一样的

安装了 services才有/etc/sysconfig/iptables