iptables、共享上网SNAT、端口转发DNAT

  • iptables、共享上网SNAT、端口转发DNAT已关闭评论
  • 106 次浏览
  • A+
所属分类:linux技术
摘要

封端⼝,封ip
实现NAT功能
共享上⽹
端⼝映射(端⼝转发),ip映射硬件:整个企业入口


iptables、共享上网SNAT、端口转发DNAT

1.防火墙概述

封端⼝,封ip
实现NAT功能
共享上⽹
端⼝映射(端⼝转发),ip映射

2.防火墙

2.1防火墙种类以及使用说明

硬件:整个企业入口

软件:开源软件 网站内部 封ip
iptables

云防火墙
安全组
NAT网关
waf应用防火墙

2.2专有名词

容器、表、链、规则

2.3iptables执行过程

1.防⽕墙是层层过滤的,实际是按照配置规则的顺序从上到下,从前到后进⾏过滤的。
2.如果匹配成功规则,即明确表示是拒绝(DROP)还是接收(ACCEPT)数据包就不再向下匹配新的规则
3.如果规则中没有明确表明是阻⽌还是通过的,也就是没有匹配规则,向下进⾏匹配,直到匹配默认规则得到明确的阻⽌还是通过。
4.防⽕墙的默认规则所有规则都匹配完才会匹配的

2.4表与链

iptables 是 4表伍链
4表: filter 表 nat表 raw表 mangle表
伍链: INPUT OUTPUT FORWARD PREROUTING POSTROUTING

1.filter表
实现防火墙功能:屏蔽或准许端口ip

iptables、共享上网SNAT、端口转发DNAT

2.nat表
实现nat功能:实现共享上网 端口映射和ip映射

iptables、共享上网SNAT、端口转发DNAT

2.5环境准备及命令

先关闭防火墙

systmectl stop firewalld systemctl disable firewalld 

1.安装并启动

yum install iptables-services     systemctl enable iptables systemctl start iptables 

2.设置开机自启防火墙相关模块

cat >>/etc/rc.local<<EOF modprobe ip_tables modprobe iptable_filter modprobe iptable_nat modprobe ip_conntrack modprobe ip_conntrack_ftp modprobe ip_nat_ftp modprobe ipt_state  EOF  lsmod | egrep 'filter|nat|ipt' 

3.查看规则

iptables -nL 默认filter -n不要把端⼝ 或ip反向解析为名字 -L 列出规则

[root@localhost ~]# iptables -nL Chain INPUT (policy ACCEPT) target     prot opt source               destination          ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0            ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22 REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited  Chain FORWARD (policy ACCEPT) target     prot opt source               destination          REJECT     all  --  0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited  Chain OUTPUT (policy ACCEPT) target     prot opt source               destination    

查看指定表的规则 iptables -t nat -nL

[root@localhost ~]# iptables -t nat -nL Chain PREROUTING (policy ACCEPT) target     prot opt source               destination           Chain INPUT (policy ACCEPT) target     prot opt source               destination           Chain OUTPUT (policy ACCEPT) target     prot opt source               destination           Chain POSTROUTING (policy ACCEPT) target     prot opt source               destination  

配置filter表规则

-A 添加防火墙规则(尾部追加)
-D 删除防火墙规则
-I 插入防火墙规则(首部插入)
-F 清空防火墙规则
-X 删除用户自定义的链
-L 列出添加防火墙规则
-R 替换防火墙规则
-Z 清空防火墙数据表统计信息
-P 设置链默认规则
-p 协议 protocal tcp/udp/icmp/all 指定端口的时候需要用到指定协议
--dport 目标端口
-j 满足条件后的动作 DROP/ACCEPT/REJECT drop 把数据丢掉不会返回给用户 reject 返回拒绝信息
-s --source 源ip
-d --destination ⽬标ip

1.先清空规则

[root@localhost ~]# iptables -F [root@localhost ~]# iptables -X [root@localhost ~]# iptables -Z [root@localhost ~]# iptables -nL Chain INPUT (policy ACCEPT) target     prot opt source               destination           Chain FORWARD (policy ACCEPT) target     prot opt source               destination           Chain OUTPUT (policy ACCEPT) target     prot opt source               destination     

2.添加规则

iptables -t filter -I INPUT -p tcp --dport 22122 -j drop 

3.删除规则

iptables -t filter -D INPUT 1  //1是行号 上述添加的规则的行号 

1:封ip

1.192.168.70.133机器 ping 192.168.70.136机器

[root@web2 ~]# ping 192.168.70.136 PING 192.168.70.136 (192.168.70.136) 56(84) bytes of data. 64 bytes from 192.168.70.136: icmp_seq=1 ttl=64 time=0.937 ms 

2.136机器添加规则

iptables -t filter -I INPUT -s 192.168.70.134 -j DROP 

3.删除规则

iptables -D INPUT 1  //删除后可以发现又继续ping了 

2:禁止网段访问指定端口

iptables -t filter -I INPUT -s 192.168.70.0/24 -p tcp --dport 8888 -j DROP 

3:只允许指定网段连入

iptables -I INPUT ! -S 192.168.70.0/24 -j DROP 

4:指定多端口

iptables  -I INPUT -m multiport -p tcp --dport 80,433 -j DROP  //禁止80和433端口 
iptables  -I INPUT -p tcp --dport 1:10 -j DROP  //禁止1-10端口 

5:控制是否能ping

iptables -I INPUT -p icmp -j DROP 

另一种方法

vim /etc/sysctl.conf  //添加如下一条指令 net.ipv4.icmp_echo_ignore_all = 1  sysctl -p  //生效 

6:匹配⽹络状态(TCP/IP连接状态)

NEW:已经或将启动新的连接
ESTABLISHED:已建⽴的连接
RELATED:正在启动的新连接INVALID:⾮法或⽆法识别的

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 

7:限制并发及速率

-m limit --limit 10/minute #每分钟只能有10个数据包 每6秒⽣成 

8:防⽕墙规则的保存与恢复

iptables-save 默认输出到屏幕
iptables-restore 加上⽂件
写⼊到/etc/sysconfig/iptables

iptables-save > /etc/sysconfig/iptables  iptables-restore < /etc/sysconfig/iptables 

3.实际⽣产⽤法

iptables -F iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT iptables -A INPUT -s 允许的IP地址 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -P INPUT DROP iptables-save 

4.共享上网SNAT

实现:内部网络的服务器通过可访问外网的机器访问到外网

环境准备

server01设置为VMnet2 192.168.100.18
server02设置为NAT 192.168.70.134 网络再添加一个网卡VMnet2 192.168.100.16

1.设置好server01的ip

[root@server01 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens33 BOOTPROTO="none" IPADDR=192.168.100.18 NETMASK=255.255.255.0 NAME="ens33" DEVICE="ens33" DNS1=114.114.114.114 

2.设置好server02的ip

[root@server02 ~]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00     inet 127.0.0.1/8 scope host lo        valid_lft forever preferred_lft forever     inet6 ::1/128 scope host         valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000     link/ether 00:0c:29:eb:13:88 brd ff:ff:ff:ff:ff:ff     inet 192.168.70.134/24 brd 192.168.70.255 scope global noprefixroute dynamic ens33        valid_lft 5270229sec preferred_lft 5270229sec     inet6 fe80::725c:49ee:6f78:42a0/64 scope link noprefixroute         valid_lft forever preferred_lft forever 3: ens37: <BROADCAST,MULTICAST> mtu 1500 qdisc pfifo_fast state DOWN group default qlen 1000     link/ether 00:0c:29:eb:13:92 brd ff:ff:ff:ff:ff:ff      [root@server02 ~]# vim /etc/sysconfig/network-scripts/ifcfg-ens37 BOOTPROTO="none" IPADDR=192.168.100.16 NETMASK=255.255.255.0 NAME="ens37" DEVICE="ens37" DNS1=114.114.114.114  [root@server02 ~]# systemctl restart network [root@server02 ~]# ip a 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00     inet 127.0.0.1/8 scope host lo        valid_lft forever preferred_lft forever     inet6 ::1/128 scope host         valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000     link/ether 00:0c:29:eb:13:88 brd ff:ff:ff:ff:ff:ff     inet 192.168.70.134/24 brd 192.168.70.255 scope global noprefixroute dynamic ens33        valid_lft 5269237sec preferred_lft 5269237sec     inet6 fe80::725c:49ee:6f78:42a0/64 scope link noprefixroute         valid_lft forever preferred_lft forever 3: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000     link/ether 00:0c:29:eb:13:92 brd ff:ff:ff:ff:ff:ff     inet 192.168.100.16/24 brd 192.168.100.255 scope global noprefixroute ens37        valid_lft forever preferred_lft forever     inet6 fe80::20c:29ff:feeb:1392/64 scope link         valid_lft forever preferred_lft forever 

3.测试ping相互下一

[root@server01 ~]# ping 192.168.100.16 

4.server02开启转发功能

[root@serve02 ~]# echo 'net.ipv4.ip_forward = 1' >> /etc/sysctl.conf [root@serve02 ~]# sysctl -p 

5.server02设置iptables

[root@serve02 ~]# iptables  -t  nat  -A POSTROUTING  -s  192.168.100.0/24 -j SNAT --to-source 192.168.70.134 

6.测试

[root@server01 ~]# ping baidu.com  //能通则成功了  [root@server02 ~]# iptables  -t  nat  -D POSTROUTING 1  //再试着关闭规则 再试试ping 

5.端口转发DNAT

在上述snat基础上增加一台机器server03

1.server02添加prerouting规则

iptables -t nat -A PREROUTING -d 192.168.70.134 -p tcp --dport 9000 -j DNAT --to-destination 192.168.100.18:22 

2.server03测试

[root@localhost ~]# ssh 192.168.70.134 -p 9000 root@192.168.70.134's password:  Last login: Fri Sep  1 20:37:06 2023  [root@localhost ~]# ip a  //查看端口可以发现连上的是server01 1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000     link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00     inet 127.0.0.1/8 scope host lo        valid_lft forever preferred_lft forever     inet6 ::1/128 scope host         valid_lft forever preferred_lft forever 2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000     link/ether 00:0c:29:18:39:18 brd ff:ff:ff:ff:ff:ff     inet 192.168.100.18/24 brd 192.168.100.255 scope global noprefixroute ens33        valid_lft forever preferred_lft forever     inet6 fe80::725c:49ee:6f78:42a0/64 scope link noprefixroute         valid_lft forever preferred_lft forever