扩展匹配查看帮助
iptables -t filter -m icmp -h
user1 通过 user2 ping user2 拒绝 user1 ping
iptables -t filter -A INPUT -s 172.16.1.11 -p icmp -m icmp --icmp-type echo-request -j DROP
拒绝多端口
iptables -t filter -A INPUT -s 172.16.1.11 -p tcp -m multiport --dport 80,22,21 -j DROP
拒绝一个网段
iptables -t filter -A INPUT -m iprange --src-range 192.168.1.1-192.168.1.100 -j DROP
拒绝mac通过
iptables -t filter -A INPUT -m mac --mac-source 00:0C:29:7F:54:B5 -j DROP
允许ssh拒绝scp
iptables -t filter -A INPUT -s 172.16.1.11 -p tcp --dport 22 -m tos --tos 8 -j DROP
TOS match v1.3.5 options:
[!] --tos value Match Type of Service field from one of the
following numeric or descriptive values:
Minimize-Delay 16 (0x10) 最小延迟
Maximize-Throughput 8 (0x08) 最大吞吐量
Maximize-Reliability 4 (0x04) 最大可靠性
Minimize-Cost 2 (0x02) 最小开销
Normal-Service 0 (0x00) 一般服务
state 状态防火墙
--state NEW 建立新的连接
--state ESTABLISHED 已建立连接
--state RELATED 相关的
--state INVALID 无效的
icmp 实验
通 NEW ESTABLISHED
不通 NEW ESTABLISHED RELATED INVALID
出去
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-request -m state --state NEW -j LOG --log-prefix "OUT_ICMP_NEW"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-request -m state --state ESTABLISHED -j LOG --log-prefix "OUT_ICMP_ESTABLISHED"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-request -m state --state RELATED -j LOG --log-prefix "OUT_ICMP_RELATED"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-request -m state --state INVALID -j LOG --log-prefix "OUT_ICMP_INVALID"
进入
iptables -t filter -A INPUT -p icmp -m icmp --icmp-type echo-reply -m state --state NEW -j LOG --log-prefix "IN_ICMP_NEW"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -m state --state ESTABLISHED -j LOG --log-prefix "IN_ICMP_ESTABLISHED"
iptables -t filter -A OUTPUT -p icmp -m icmp --icmp-type echo-reply -m state --state RELATED -j LOG --log-prefix "IN_ICMP_RELATED"
iptables -t filter -A INPUT -p icmp -m icmp --icmp-type echo-reply -m state --state INVALID -j LOG --log-prefix "IN_ICMP_INVALID"
tcp协议 http实验
出口
iptables -t filter -A UOTPUT -p tcp --dport 80 -m state --state NEW -j LOG --log-prefix " OUT_80_NEW"
iptables -t filter -A UOTPUT -p tcp --dport 80 -m state --state ESTABLISHED -j LOG --log-prefix " OUT_80_ES"
iptables -t filter -A UOTPUT -p tcp --dport 80 -m state --state RELATED -j LOG --log-prefix " OUT_80_RE"
iptables -t filter -A UOTPUT -p tcp --dport 80 -m state --state INVALID -j LOG --log-prefix " OUT_80_IN"
进口
iptables -t filter -A INPUT -p tcp --sport 80 -m state --state NEW -j LOG --log-prefix " IN_80_NEW"
iptables -t filter -A INPUT -p tcp --sport 80 -m state --state ESTABLISHED -j LOG --log-prefix " IN_80_ES"
iptables -t filter -A INPUT -p tcp --sport 80 -m state --state RELATED -j LOG --log-prefix " IN_80_RE"
iptables -t filter -A INPUT -p tcp --sport 80 -m state --state INVALID -j LOG --log-prefix " IN_80_IN"
一共10个包 第一个包是new 其他9个是ESTABLISHED
ftp协议 tcp实验 有 NEW ESTABLISHED RELATED 3种状态
控制链路 产生2个NEW
出口
iptables -t filter -A OUTPUT -p tcp --dport 21 -m state --state NEW -j LOG --log-prefix "OUT_21_NEW"
iptables -t filter -A OUTPUT -p tcp --dport 21 -m state --state ESTABLISHED -j LOG --log-prefix "OUT_21_ES"
iptables -t filter -A OUTPUT -p tcp --dport 21 -m state --state RELATED -j LOG --log-prefix "OUT_21_RE"
iptables -t filter -A OUTPUT -p tcp --dport 21 -m state --state INVALID -j LOG --log-prefix "OUT_21_IN"
进口
iptables -t filter -A INPUT -p tcp --sport 21 -m state --state NEW -j LOG --log-prefix "IN_21_NEW"
iptables -t filter -A INPUT -p tcp --sport 21 -m state --state ESTABLISHED -j LOG --log-prefix "IN_21_ES"
iptables -t filter -A INPUT -p tcp --sport 21 -m state --state RELATED -j LOG --log-prefix "IN_21_RE"
iptables -t filter -A INPUT -p tcp --sport 21 -m state --state INVALID -j LOG --log-prefix "IN_21_IN"
数据链路
进口
iptabels -t filter -A INPUT -p tcp --sport 20 -m state --state NEW -j LOG --log-prefix "IN_20_NEW"
iptables -t filter -A INPUT -p tcp --sport 20 -m state --state ESTABLISHED -j LOG --log-prefix " IN_20_ES"
iptables -t filter -A INPUT -p tcp --sport 20 -m state --state RELATED -j LOG --log-prefix " IN_20_RE"
iptables -t filter -A INPUT -p tcp --sport 20 -m state --state INVALID -j LOG --log-prefix "IN_20_IN"