Linux note0x02

最新推荐文章于 2025-12-04 16:38:42 发布

原创最新推荐文章于 2025-12-04 16:38:42 发布 · 305 阅读

CC 4.0 BY-SA版权

文章标签：

6 篇文章

订阅专栏

本文详细介绍了iptables与Firewalld的配置方法，包括iptables的规则链、参数及其使用方式，以及Firewalld的不同区域及其默认规则策略。此外还提供了服务访问控制列表的设置方法。

PreRouting, Input, Output, Forward, PostRouting

iptables -L View existing iptables rule
iptables -F Empty the rules
iptables -P INPUT DROP Default set DROP
iptables -I INPUT -p icmp -j ACCEPT allow ping(icmp)
iptables -I INPUT -s 192.168.10.0/24 -p tcp --dport 22 -j ACCEPT Only allow appoint network segment access 22.
iptables -A INPUT -p tcp --dport 22 -j REJECT Forbidden others host flow
service iptables save Make it effect permanently

区域	默认规则策略
trusted	允许所有的数据包
home	拒绝流入的流量，除非与流出的流量相关；而如果流量与ssh、mdns、ipp-client、
internal	等同于home区域
work	拒绝流入的流量，除非与流出的流量数相关；而如果流量与ssh、ipp-client与dhcpv6-client
public	拒绝流入的流量，除非与流出的流量相关；而如果流量与ssh、dhcpv6-client服务相关，则允许
external	拒绝流入的流量，除非与流出的流量相关；而如果流量与ssh服务相关，则允许流量
dmz	拒绝流入的流量，除非与流出的流量相关；而如果流量与ssh服务相关，则允许流量
block	拒绝流入的流量，除非与流出的流量相关
drop	拒绝流入的流量，除非与流出的流量相关

firewall-cmd --get-default-zone View current using area
firewall-cmd --get-zone-of-interface=eno16728 View eno netCard wroking area
firewall-cmd --permanent --zone=external --change-interface=eno16278 Set area as external and take effect after restarting system.
firewall-cmd --panic-on Meet an emergency, stop all connections.
firewall-cmd --znoe=public --query-service=https View whether could pass https flow, u can also use –add-service=https(protocol name) to add pass power and –remove-service=https(protocol name) to reject it.
firewall-cmd --reload Take permanent effect immediately.
firewall-cmd --zone-=public --add-forward-port=port=888:proto=tcp:toport=22:toaddr=192.168.10.10 Forward access 888 port flow to 22 port.

# Rules
Match /etc/hosts.allow?pass
    :Match /etc/hosts.deny?forbidden
        :pass

Two Principles
- Reject strategy: service name instead protocol
- Reject strategy editting should be first.
hosts.deny sshd:*
hosts.allow sshd:192.168.10.