iptable防火墙配置

/etc/sysconfig/iptables

/etc/init.d/iptables {start|stop|restart|condrestart|status|panic|save}

iptables -L

iptables -t nat -L

单网卡

/etc/sysconfig/iptables

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A FORWARD -m state --state NEW -p TCP ! --syn -j DROP
-A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT
-A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
COMMIT

双网卡

内网接口em1, 外网接口em2 内网允许任意访问

/etc/sysconfig/iptables

*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A FORWARD -m state --state NEW -p TCP ! --syn -j DROP
-A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT
-A FORWARD -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT
# 开放em1 INPUT&FORWARD
-A INPUT -i em1 -j ACCEPT
-A FORWARD -i em1 -j ACCEPT
COMMIT

双网卡nat 内网接口em1, 外网接口em2 内网允许任意访问*

/etc/sysconfig/iptables

# Generated by iptables-save v1.4.7 on Wed Feb  3 15:39:19 2016
*nat
:PREROUTING ACCEPT [73:5089]
:POSTROUTING ACCEPT [368:18857]
:OUTPUT ACCEPT [368:18857]
-A POSTROUTING -s 10.150.1.0/24 -o em2 -j SNAT --to-source 69.x.x.25
COMMIT
# Completed on Wed Feb  3 15:39:19 2016
# Generated by iptables-save v1.4.7 on Wed Feb  3 15:39:19 2016
*filter
:INPUT DROP [70:4724]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [3643:836416]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 29922 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -i em1 -j ACCEPT
-A FORWARD -p tcp -m state --state NEW -m tcp ! --tcp-flags FIN,SYN,RST,ACK SYN -j DROP
-A FORWARD -f -m limit --limit 100/sec --limit-burst 100 -j ACCEPT
-A FORWARD -p icmp -m limit --limit 1/sec --limit-burst 10 -j ACCEPT
-A FORWARD -i em1 -j ACCEPT
COMMIT
# Completed on Wed Feb  3 15:39:19 2016