1. 实现ftp的功能！
第一种方法;需要4步：
[root@gjp99 ~]# iptables -t filter -A FORWARD -m iprange --src-range 192.168.2.10-192.168.2.20 -m time --timestart 08:00 --timestop 20:00 --weekdays Mon,Tue,Wed,Thu,Fri -p tcp --dport 21 -j ACCEPT
[root@gjp99 ~]# iptables -L -t filter
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- 192.168.2.2 anywhere tcp dpt:ssh
Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere source IP range 192.168.2.10-192.168.2.20 TIME from 08:00:00 to 20:00:00 on Mon,Tue,Wed,Thu,Fri tcp dpt:ftp
Chain OUTPUT (policy DROP)
target prot opt source destination
ACCEPT tcp -- anywhere 192.168.2.2 tcp spt:ssh
[root@gjp99 ~]# iptables -t filter -A FORWARD -p tcp --sport 21 -j ACCEPT
[root@gjp99 ~]# iptables -t filter -A FORWARD -p tcp --sport 20 -j ACCEPT
[root@gjp99 ~]# iptables -t filter -A FORWARD -p tcp --dport 20 -j ACCEPT
内网客户机测试：
仅有ip 在192.168.2.10-20才能ftp上！但不能上网，只有这一个服务
[root@gjp99 ~]# iptables -L -v -n --line-number 查看是否有匹配的包！
Chain INPUT (policy DROP 11668 packets, 1093K bytes)
num pkts bytes target prot opt in out source destination
1 1254 86152 ACCEPT tcp -- * * 192.168.2.2 0.0.0.0/0 tcp dpt:22
Chain FORWARD (policy DROP 36 packets, 2242 bytes)
num pkts bytes target prot opt in out source destination
1 14 631 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 source IP range 192.168.2.10-192.168.2.20 TIME from 08:00:00 to 20:00:00 on Mon,Tue,Wed,Thu,Fri tcp dpt:21
2 37 2522 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:21
3 15 858 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp spt:20
4 9 396 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:20
Chain OUTPUT (policy DROP 46 packets, 3016 bytes)
num pkts bytes target prot opt in out source destination
1 796 83084 ACCEPT tcp -- * * 0.0.0.0/0 192.168.2.2 tcp spt:22
第二种方法：需要2步！
state模块： （记录你流出的轨迹，自动让你返回！）
标准为 syn ack fin rst
请求 1 0 0 0 ＮＥＷ
响应 1 1 × × ＥＳＴＡＢＬＩＳＨＥＤ
二次特性：我去访问你，后来你又来连接我了 ＲＥＬＡＴＥＤ
[root@gjp99 ~]# iptables -F FORWARD 下游规则清掉，默认规则是清不掉的！
[root@gjp99 ~]# iptables -L -v -n --line-number
Chain INPUT (policy DROP 11736 packets, 1102K bytes)
num pkts bytes target prot opt in out source destination
1 1316 90336 ACCEPT tcp -- * * 192.168.2.2 0.0.0.0/0 tcp dpt:22
Chain FORWARD (policy DROP 36 packets, 2242 bytes) 规则已清除!
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy DROP 46 packets, 3016 bytes)
num pkts bytes target prot opt in out source destination
1 848 88772 ACCEPT tcp -- * * 0.0.0.0/0 192.168.2.2 tcp spt:22
配置命令：
[root@gjp99 ~]# iptables -t filter -A FORWARD -m iprange --src-range 192.168.2.10-192.168.2.20 -m time --timestart 08:00 --timestop 20:00 --weekdays Mon,Tue,Wed,Thu,Fri -p tcp --dport 21 -j ACCEPT
[root@gjp99 ~]# iptables -t filter -A FORWARD -m state --state ESTABLISHED,RELATED -j ACCEPT
查看有数据包匹配！
[root@gjp99 ~]# iptables -L -v -n --line-number
Chain INPUT (policy DROP 12092 packets, 1142K bytes)
num pkts bytes target prot opt in out source destination
1 1531 104K ACCEPT tcp -- * * 192.168.2.2 0.0.0.0/0 tcp dpt:22
Chain FORWARD (policy DROP 36 packets, 2242 bytes)
num pkts bytes target prot opt in out source destination
1 20 906 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 source IP range 192.168.2.10-192.168.2.20 TIME from 08:00:00 to 20:00:00 on Mon,Tue,Wed,Thu,Fri tcp dpt:21
2 21 1480 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
Chain OUTPUT (policy DROP 46 packets, 3016 bytes)
num pkts bytes target prot opt in out source destination
1 1026 107K ACCEPT tcp -- * * 0.0.0.0/0 192.168.2.2 tcp spt:22
2.由于FORWARD默认拒绝了，所以默认情况，内部成员是无法上网的，所以，不允许http qq 迅雷就可以不做了，默认即可！
3.下班时间无限制
[root@gjp99 ~]# iptables -t filter -A FORWARD -s 192.168.2.0/24 -o eth1 -m time --timestart 20:01 --timestop 07:59 -j ACCEPT
[root@gjp99 ~]# date
Tue Sep 18 10:34:27 CST 2012
[root@gjp99 ~]# date 091820012012 调整为下班时间测试
Tue Sep 18 20:01:00 CST 2012
内网主机已可以正常上网！
四、软件部门 ： http 不允许非法站点sina ，不允许使用迅雷 ，连接数 最多3个 不允许聊天 不允许使用pplive ，下班后无限制
1.允许http 不允许非法站点sina的 配置命令：
[root@gjp99 ~]# iptables -t filter -A FORWARD -m iprange --src-range 192.168.2.21-192.168.2.30 -m time --timestart 08:00 --timestop 20:00 --weekdays Mon,Tue,Wed,Thu,Fri -m string --string "sina" --algo bm -j DROP
//网址包含sina的，禁止访问！
[root@gjp99 ~]# iptables -t filter -A FORWARD -m iprange --src-range 192.168.2.21-192.168.2.30 -m time --timestart 08:00 --timestop 20:00 --weekdays Mon,Tue,Wed,Thu,Fri -p tcp --dport 80 -j ACCEPT
//允许访问http
[root@gjp99 ~]# iptables -t filter -A FORWARD -m iprange --src-range 192.168.2.21-192.168.2.30 -m time --timestart 08:00 --timestop 20:00 --weekdays Mon,Tue,Wed,Thu,Fri -p udp --dport 53 -j ACCEPT
//访问http时，需要dns解析！
查看
[root@gjp99 ~]# iptables -L -v -n --line-number
Chain INPUT (policy DROP 13204 packets, 1275K bytes)
num pkts bytes target prot opt in out source destination
1 2672 189K ACCEPT tcp -- * * 192.168.2.2 0.0.0.0/0 tcp dpt:22
Chain FORWARD (policy DROP 46 packets, 2887 bytes)
num pkts bytes target prot opt in out source destination
1 20 906 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 source IP range 192.168.2.10-192.168.2.20 TIME from 08:00:00 to 20:00:00 on Mon,Tue,Wed,Thu,Fri tcp dpt:21
2 33 2775 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
3 12 723 ACCEPT all -- * eth1 192.168.2.0/24 0.0.0.0/0 TIME from 20:01:00 to 07:59:00
4 0 0 DROP all -- * * 0.0.0.0/0 0.0.0.0/0 source IP range 192.168.2.21-192.168.2.30 TIME from 08:00:00 to 20:00:00 on Mon,Tue,Wed,Thu,Fri STRING match "sina" ALGO name bm TO 65535
5 0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 source IP range 192.168.2.21-192.168.2.30 TIME from 08:00:00 to 20:00:00 on Mon,Tue,Wed,Thu,Fri tcp dpt:80
6 0 0 ACCEPT udp -- * * 0.0.0.0/0 0.0.0.0/0 source IP range 192.168.2.21-192.168.2.30 TIME from 08:00:00 to 20:00:00 on Mon,Tue,Wed,Thu,Fri udp dpt:53
Chain OUTPUT (policy DROP 46 packets, 3016 bytes)
num pkts bytes target prot opt in out source destination
1 1829 194K ACCEPT tcp -- * * 0.0.0.0/0 192.168.2.2 tcp spt:22
ip 要在软件部门ip范围之内！
