Iptalbes练习题（一）

实验环境：

KVM 虚拟机 centos6.7

test1：192.168.124.87 test2:192.168.124.94

场景一：

要求：1.对所有地址开放本机的tcp(80、22、10-21)端口的访问。

2.对所有主机开放本机的基于ICMP协议的数据包访问

　　　3.其他未被访问 的端口禁止访问

答：2表达的意思是禁止ping

步骤：

（1）查看iptables 版本

[root@test1 ~]# iptables -v
iptables v1.4.7: no command specified

（2）查看test1机器的端口开放情况

[root@test1 ~]# netstat -luntp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1141/sshd
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1220/master
tcp        0      0 :::22                       :::*                        LISTEN      1141/sshd
tcp        0      0 ::1:25                      :::*                        LISTEN      1220/master
udp        0      0 0.0.0.0:68                  0.0.0.0:*                               1368/dhclient

（3）查看iptables之前设置的规则

[root@test1 ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

加n表示源地址和目的地址用数字的形式表示

（4）清除之前设置过的规则

[root@test1 ~]# iptables -F
[root@test1 ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

（5）设置好开放的端口

[root@test1 ~]# iptables -I INPUT -p tcp --dport 80 -j ACCEPT
[root@test1 ~]# iptables -I INPUT -p tcp --dport 22 -j ACCEPT
[root@test1 ~]# iptables -I INPUT -p tcp --dport 10:21 -j ACCEPT
[root@test1 ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpts:10:21
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

-I 插入规则 -p 指定协议 --dport 目的端口 -j 制定动作

（6）允许icmp访问

iptables -I INPUT -p icmp -j ACCEPT
[root@test1 ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpts:10:21
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

（7）设置拒绝规则

iptables -A INPUT -j REJECT
root@test1 ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpts:10:21
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:80
REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

bingo，至此结束。。。

如果想要删除某条规则：

[root@test1 ~]# iptables -I INPUT -p tcp --dport 80 -j ACCEPT

-D 表示删除

拓展一下，设置一下，不允许其他机器ping本机

（1）设置规则

[root@test1 ~]# iptables -I INPUT -p icmp -j REJECT
[root@test1 ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
REJECT     icmp --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

（2）另外一台机子测试

[root@test2 ~]# ping 192.168.124.87
PING 192.168.124.87 (192.168.124.87) 56(84) bytes of data.
From 192.168.124.87 icmp_seq=1 Destination Port Unreachable
From 192.168.124.87 icmp_seq=2 Destination Port Unreachable
From 192.168.124.87 icmp_seq=3 Destination Port Unreachable
From 192.168.124.87 icmp_seq=4 Destination Port Unreachable
From 192.168.124.87 icmp_seq=5 Destination Port Unreachable