7-3 10 網絡 防火牆 netfilter iptables

時間  2019-11-24
標籤 網絡 防火牆 netfilter iptables 欄目 系統網絡 简体版
原文   原文鏈接

10.11 Linux網絡相關html

10.12 firewalld和netfilterlinux

10.13 netfilter5表5鏈介紹vim

10.14 iptables語法windows

擴展（selinux瞭解便可）centos

  1. selinux教程 http://os.51cto.com/art/201209/355490.htm
  2. selinux pdf電子書 http://pan.baidu.com/s/1jGGdExK

10.11 Linux網絡相關

查看網卡信息bash

[root@axiang ~]# yum provides "/*/ifconfig"
[root@axiang-02 ~]# yum install -y net-tools ^C
[root@axiang-02 ~]# ifconfig -a
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.83.138  netmask 255.255.255.0  broadcast 192.168.83.255
        inet6 fe80::20c:29ff:fe18:95e9  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:18:95:e9  txqueuelen 1000  (Ethernet)
        RX packets 19800  bytes 23610097 (22.5 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 9223  bytes 889247 (868.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 92  bytes 295860 (288.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 92  bytes 295860 (288.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
  • ifconfig -a查看未啓動網卡信息

如何啓動/關閉網卡網絡

  • 注意別把正在遠程的網卡down了！
ifdown ens33 && ifup ens33   //慎用風險

**建立虛擬網卡 **dom

  1. 複製網卡文件
  2. 修改IP、名稱（ens33:0）
  3. 刪除DNS、網關
  4. 重啓物理網卡
[root@axiang-03 ~]# cd /etc/sysconfig/network-scripts/
[root@axiang-03 network-scripts]# cp ifcfg-ens33 ifcfg-ens33:0
[root@axiang-03 network-scripts]# vim ifcfg-ens33:0
[root@axiang-03 network-scripts]# ifdown ens33 && ifup ens33
成功斷開設備 'ens33'。
成功激活的鏈接（D-Bus 激活路徑：/org/freedesktop/NetworkManager/ActiveConnection/3）
[root@axiang-03 network-scripts]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.83.139  netmask 255.255.255.0  broadcast 192.168.83.255
        inet6 fe80::20c:29ff:fec0:f76c  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:c0:f7:6c  txqueuelen 1000  (Ethernet)
        RX packets 7554  bytes 711123 (694.4 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5411  bytes 681362 (665.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens33:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.83.149  netmask 255.255.255.0  broadcast 192.168.83.255
        ether 00:0c:29:c0:f7:6c  txqueuelen 1000  (Ethernet)

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 92  bytes 7564 (7.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 92  bytes 7564 (7.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

windows ping一下tcp

  • LVS keepalived會用到虛擬網卡ide

  • 查看網卡鏈接狀態

    • mii-tool ens33
    • ethtool ens33
[root@axiang ~]# mii-tool ens33
ens33: negotiated 1000baseT-FD flow-control, link ok
[root@axiang ~]# ethtool ens33
Settings for ens33:
	Supported ports: [ TP ]
	Supported link modes:   10baseT/Half 10baseT/Full 
	                        100baseT/Half 100baseT/Full 
	                        1000baseT/Full 
	Supported pause frame use: No
	Supports auto-negotiation: Yes
	Advertised link modes:  10baseT/Half 10baseT/Full 
	                        100baseT/Half 100baseT/Full 
	                        1000baseT/Full 
	Advertised pause frame use: No
	Advertised auto-negotiation: Yes
	Speed: 1000Mb/s
	Duplex: Full
	Port: Twisted Pair
	PHYAD: 0
	Transceiver: internal
	Auto-negotiation: on
	MDI-X: off (auto)
	Supports Wake-on: d
	Wake-on: d
	Current message level: 0x00000007 (7)
			       drv probe link
	Link detected: yes  //看這裏
  • 修改主機名
    • hostnamectl set-hostname xxx
[root@axiang ~]# hostnamectl set-hostname axiang-007
[root@axiang ~]# hostname
axiang.localdomain
[root@axiang ~]# bash
[root@axiang ~]# exit
exit
[root@axiang ~]# cat /etc/hostname
axiang-007
[root@axiang ~]# hostname
axiang.localdomain
  • DNS
    • DNS配置文件/etc/resolv.conf
[root@axiang ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 119.29.29.29

  • 更改網卡配置便可更改DNS配置文件，更改後須要重啓網卡（ifdown/ifup）後生效，也可編輯‘/etc/resolv.conf’臨時更改DNS配置，該辦法在重啓網卡後會被網卡配置文件中的DNS覆蓋！

  • 訪問自定義域名

    • /etc/hosts
[root@axiang-03 ~]# ping www.qq123.com
PING www.qq123.com (202.91.250.93) 56(84) bytes of data.
64 bytes from 202.91.250.93 (202.91.250.93): icmp_seq=1 ttl=128 time=60.9 ms
64 bytes from 202.91.250.93 (202.91.250.93): icmp_seq=2 ttl=128 time=66.1 ms
64 bytes from 202.91.250.93 (202.91.250.93): icmp_seq=3 ttl=128 time=61.3 ms
^C
--- www.qq123.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 60.960/62.821/66.127/2.361 ms
[root@axiang-03 ~]# vim /etc/hosts
[root@axiang-03 ~]# ping www.qq123.com
PING www.qq123.com (192.168.83.149) 56(84) bytes of data.
64 bytes from www.qq123.com (192.168.83.149): icmp_seq=1 ttl=64 time=0.061 ms
64 bytes from www.qq123.com (192.168.83.149): icmp_seq=2 ttl=64 time=0.108 ms
^C
--- www.qq123.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.061/0.084/0.108/0.025 ms

  • 只在本機生效

10.12 firewalld和netfilter

  • selinux
    • 臨時關閉 setenforce 0
    • 永久關閉 vi /etc/selinux/config
    • 狀態查看 getenforce
[root@axiang ~]# vim /etc/selinux/config  	永久關閉須要重啓
[root@axiang ~]# setenforce 0				臨時中止
[root@axiang ~]# getenforce 				查看
Permissive									策略變爲記錄
[root@axiang ~]# reboot
...
Last login: Sat Jul 15 11:36:05 2017 from 192.168.83.1
[root@axiang ~]# getenforce 
Disabled									重啓後變爲關閉
[root@axiang ~]#
  • 注意不要改SELINUXTYPE=targeted！不然啓動不了
  • 不少服務受限與Selinux，通常會關閉

NetFilter

  • Centos7中默認將原來（centos5/6）的防火牆netfilter升級爲了firewalld。都使用iptables工具管理， 如今大量公司仍然使用netfilter。

  • 關閉firewalld、開啓netfilter

[root@axiang-03 ~]# systemctl stop firewalld
[root@axiang-03 ~]# systemctl disable firewalld
[root@axiang-03 ~]# yum install -y iptables-services  
[root@axiang-03 ~]# systemctl enable iptables
[root@axiang-03 ~]# systemctl start iptables
[root@axiang-03 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   37  2588 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 25 packets, 2484 bytes)
 pkts bytes target     prot opt in     out     source               destination         
[root@axiang-03 ~]# iptables -F  //關閉默認規則方便測試
[root@axiang-03 ~]# service iptables save  //保存規則，重啓依然有效
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  肯定  ]
  • 能夠看到保存規則的提示：/etc/sysconfig/iptables也能夠查看規則
  • iptables是工具。防火牆叫netfilter
  • 雖然默認有iptables命令（工具），但並無安裝iptables服務，須要安裝

10.13 netfilter 5表及鏈的介紹

netfilter的5表5鏈

  • filter表，最經常使用，做用是濾包，有三個鏈：
    • INPUT 進入本機的包
    • FORWARD 無關本機的包
    • OUTPUT 本機送出的包
[root@axiang-03 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 378 packets, 32227 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 389 packets, 34744 bytes)
 pkts bytes target     prot opt in     out     source               destination
  • nat表，用於網絡地址轉換
[root@axiang-03 ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

  • managle表用於給數據包作標記

  • raw表能夠實現不追蹤某些數據包

  • security表在centos6中並無，用於強制訪問控制（MAC）的網絡規則

  • 參考文章 http://www.cnblogs.com/metoy/p/4320813.html

  • 數據包流向與netfilter的5個鏈

    • PREROUTING：數據包進入路由表以前
    • INPUT：經過路由表後目的地爲本機
    • FORWARD：經過路由表後，目的地不爲本機
    • OUTPUT：由本機產生，向外發出
    • POSTROUTING：發送到網卡接口以前

10.14 iptables語法

  • 查看filter/NAT規則
[root@axiang-03 ~]# iptables -nvL ^C
[root@axiang-03 ~]# iptables -t nat -nvL
  • 清空規則，清空計數器，存規則，重啓服務，存放位置
[root@axiang-03 ~]# iptables -F 
[root@axiang-03 ~]# iptables -Z
[root@axiang-03 ~]# service iptables save 
[root@axiang-03 ~]# service iptables restart 
[root@axiang-03 ~]# /etc/sysconfig/iptables

  • iptables -Z 經常使用於監控腳本判斷

  • TCP拋包舉例，源IP指定網卡接收舉例

[root@axiang-03 ~]#  iptables -p tcp -A INPUT -s 192.168.83.1 --sport 1234 -d 192.168.83.139 --dport 80 -j DROP
[root@axiang-03 ~]# iptables -I INPUT -s 192.168.83.0/24 -i eth0 -j ACCEPT

  • -I：前排插入規則

  • -A：是在後面加入規則

  • -D：是刪除規則

  • 根據編號刪除規則

[root@axiang-03 ~]# iptables -nvL --line-numbers
Chain INPUT (policy ACCEPT 8 packets, 628 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     all  --  eth0   *       192.168.83.0/24      0.0.0.0/0           
2        0     0 DROP       tcp  --  *      *       192.168.83.1         192.168.83.139       tcp spt:1234 dpt:80
[root@axiang-03 ~]# iptables -D INPUT 1
[root@axiang-03 ~]# iptables -nvL --line-numbers
Chain INPUT (policy ACCEPT 6 packets, 428 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       tcp  --  *      *       192.168.83.1         192.168.83.139       tcp spt:1234 dpt:80
  • 預設規則爲(policy)爲ACCEPT，能夠經過命令 iptables -P INPUT 修改，可是注意若是進出改成DROP則不能遠程，同時本機清空操做-F不會恢復
相關文章
相關標籤/搜索
每日一句
    每一个你不满意的现在，都有一个你没有努力的曾经。
本站公眾號
   歡迎關注本站公眾號,獲取更多信息
聯繫我們 最近搜索 最新文章 沪ICP备13005482号-10 MyBatis教程 SQL 教程 MySQL教程 Java 教程 Thymeleaf 教程 Hibernate教程 Spring教程 Redis教程