Linux网络，防火墙，netfilter，iptables语法

时间 2019-11-24

标签 linux 网络防火墙 netfilter iptables 语法栏目 Linux 繁體版

原文原文链接

10.11 Linux网络相关html

10.12 firewalld和netfilterlinux

10.13 netfilter5表5链介绍vim

10.14 iptables语法windows

扩展（selinux了解便可）centos

selinux教程 http://os.51cto.com/art/201209/355490.htm
selinux pdf电子书 http://pan.baidu.com/s/1jGGdExK

10.11 Linux网络相关

查看网卡信息bash

[root@axiang ~]# yum provides "/*/ifconfig"
[root@axiang-02 ~]# yum install -y net-tools ^C
[root@axiang-02 ~]# ifconfig -a
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.83.138  netmask 255.255.255.0  broadcast 192.168.83.255
        inet6 fe80::20c:29ff:fe18:95e9  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:18:95:e9  txqueuelen 1000  (Ethernet)
        RX packets 19800  bytes 23610097 (22.5 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 9223  bytes 889247 (868.4 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 92  bytes 295860 (288.9 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 92  bytes 295860 (288.9 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ifconfig -a查看未启动网卡信息

如何启动/关闭网卡网络

注意别把正在远程的网卡down了！

ifdown ens33 && ifup ens33   //慎用风险

**建立虚拟网卡 **dom

复制网卡文件
修改IP、名称（ens33:0）
删除DNS、网关
重启物理网卡

[root@axiang-03 ~]# cd /etc/sysconfig/network-scripts/
[root@axiang-03 network-scripts]# cp ifcfg-ens33 ifcfg-ens33:0
[root@axiang-03 network-scripts]# vim ifcfg-ens33:0
[root@axiang-03 network-scripts]# ifdown ens33 && ifup ens33
成功断开设备 'ens33'。
成功激活的链接（D-Bus 激活路径：/org/freedesktop/NetworkManager/ActiveConnection/3）
[root@axiang-03 network-scripts]# ifconfig
ens33: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.83.139  netmask 255.255.255.0  broadcast 192.168.83.255
        inet6 fe80::20c:29ff:fec0:f76c  prefixlen 64  scopeid 0x20<link>
        ether 00:0c:29:c0:f7:6c  txqueuelen 1000  (Ethernet)
        RX packets 7554  bytes 711123 (694.4 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 5411  bytes 681362 (665.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

ens33:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 192.168.83.149  netmask 255.255.255.0  broadcast 192.168.83.255
        ether 00:0c:29:c0:f7:6c  txqueuelen 1000  (Ethernet)

lo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536
        inet 127.0.0.1  netmask 255.0.0.0
        inet6 ::1  prefixlen 128  scopeid 0x10<host>
        loop  txqueuelen 1  (Local Loopback)
        RX packets 92  bytes 7564 (7.3 KiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 92  bytes 7564 (7.3 KiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

windows ping一下tcp

LVS keepalived会用到虚拟网卡ide
查看网卡链接状态
- mii-tool ens33
- ethtool ens33

[root@axiang ~]# mii-tool ens33
ens33: negotiated 1000baseT-FD flow-control, link ok
[root@axiang ~]# ethtool ens33
Settings for ens33:
	Supported ports: [ TP ]
	Supported link modes:   10baseT/Half 10baseT/Full 
	                        100baseT/Half 100baseT/Full 
	                        1000baseT/Full 
	Supported pause frame use: No
	Supports auto-negotiation: Yes
	Advertised link modes:  10baseT/Half 10baseT/Full 
	                        100baseT/Half 100baseT/Full 
	                        1000baseT/Full 
	Advertised pause frame use: No
	Advertised auto-negotiation: Yes
	Speed: 1000Mb/s
	Duplex: Full
	Port: Twisted Pair
	PHYAD: 0
	Transceiver: internal
	Auto-negotiation: on
	MDI-X: off (auto)
	Supports Wake-on: d
	Wake-on: d
	Current message level: 0x00000007 (7)
			       drv probe link
	Link detected: yes  //看这里

修改主机名
- hostnamectl set-hostname xxx

[root@axiang ~]# hostnamectl set-hostname axiang-007
[root@axiang ~]# hostname
axiang.localdomain
[root@axiang ~]# bash
[root@axiang ~]# exit
exit
[root@axiang ~]# cat /etc/hostname
axiang-007
[root@axiang ~]# hostname
axiang.localdomain

DNS
- DNS配置文件/etc/resolv.conf

[root@axiang ~]# cat /etc/resolv.conf 
# Generated by NetworkManager
nameserver 119.29.29.29

更改网卡配置便可更改DNS配置文件，更改后须要重启网卡（ifdown/ifup）后生效，也可编辑‘/etc/resolv.conf’临时更改DNS配置，该办法在重启网卡后会被网卡配置文件中的DNS覆盖！
访问自定义域名
- /etc/hosts

[root@axiang-03 ~]# ping www.qq123.com
PING www.qq123.com (202.91.250.93) 56(84) bytes of data.
64 bytes from 202.91.250.93 (202.91.250.93): icmp_seq=1 ttl=128 time=60.9 ms
64 bytes from 202.91.250.93 (202.91.250.93): icmp_seq=2 ttl=128 time=66.1 ms
64 bytes from 202.91.250.93 (202.91.250.93): icmp_seq=3 ttl=128 time=61.3 ms
^C
--- www.qq123.com ping statistics ---
3 packets transmitted, 3 received, 0% packet loss, time 2003ms
rtt min/avg/max/mdev = 60.960/62.821/66.127/2.361 ms
[root@axiang-03 ~]# vim /etc/hosts
[root@axiang-03 ~]# ping www.qq123.com
PING www.qq123.com (192.168.83.149) 56(84) bytes of data.
64 bytes from www.qq123.com (192.168.83.149): icmp_seq=1 ttl=64 time=0.061 ms
64 bytes from www.qq123.com (192.168.83.149): icmp_seq=2 ttl=64 time=0.108 ms
^C
--- www.qq123.com ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 999ms
rtt min/avg/max/mdev = 0.061/0.084/0.108/0.025 ms

只在本机生效

10.12 firewalld和netfilter

selinux
- 临时关闭 setenforce 0
- 永久关闭 vi /etc/selinux/config
- 状态查看 getenforce

[root@axiang ~]# vim /etc/selinux/config  	永久关闭须要重启
[root@axiang ~]# setenforce 0				临时中止
[root@axiang ~]# getenforce 				查看
Permissive									策略变为记录
[root@axiang ~]# reboot
...
Last login: Sat Jul 15 11:36:05 2017 from 192.168.83.1
[root@axiang ~]# getenforce 
Disabled									重启后变为关闭
[root@axiang ~]#

注意不要改SELINUXTYPE=targeted！不然启动不了
不少服务受限与Selinux，通常会关闭

NetFilter

Centos7中默认将原来（centos5/6）的防火墙netfilter升级为了firewalld。都使用iptables工具管理，如今大量公司仍然使用netfilter。
关闭firewalld、开启netfilter

[root@axiang-03 ~]# systemctl stop firewalld
[root@axiang-03 ~]# systemctl disable firewalld
[root@axiang-03 ~]# yum install -y iptables-services  
[root@axiang-03 ~]# systemctl enable iptables
[root@axiang-03 ~]# systemctl start iptables
[root@axiang-03 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   37  2588 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 25 packets, 2484 bytes)
 pkts bytes target     prot opt in     out     source               destination         
[root@axiang-03 ~]# iptables -F  //关闭默认规则方便测试
[root@axiang-03 ~]# service iptables save  //保存规则，重启依然有效
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  肯定  ]

能够看到保存规则的提示：/etc/sysconfig/iptables也能够查看规则
iptables是工具。防火墙叫netfilter
虽然默认有iptables命令（工具），但并无安装iptables服务，须要安装

10.13 netfilter 5表及链的介绍

netfilter的5表5链

filter表，最经常使用，做用是滤包，有三个链：
- INPUT 进入本机的包
- FORWARD 无关本机的包
- OUTPUT 本机送出的包

[root@axiang-03 ~]# iptables -nvL
Chain INPUT (policy ACCEPT 378 packets, 32227 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 389 packets, 34744 bytes)
 pkts bytes target     prot opt in     out     source               destination

nat表，用于网络地址转换

[root@axiang-03 ~]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

managle表用于给数据包作标记
raw表能够实现不追踪某些数据包
security表在centos6中并无，用于强制访问控制（MAC）的网络规则
参考文章 http://www.cnblogs.com/metoy/p/4320813.html
数据包流向与netfilter的5个链
- PREROUTING：数据包进入路由表以前
- INPUT：经过路由表后目的地为本机
- FORWARD：经过路由表后，目的地不为本机
- OUTPUT：由本机产生，向外发出
- POSTROUTING：发送到网卡接口以前

10.14 iptables语法

查看filter/NAT规则

[root@axiang-03 ~]# iptables -nvL ^C
[root@axiang-03 ~]# iptables -t nat -nvL

清空规则，清空计数器，存规则，重启服务，存放位置

[root@axiang-03 ~]# iptables -F 
[root@axiang-03 ~]# iptables -Z
[root@axiang-03 ~]# service iptables save 
[root@axiang-03 ~]# service iptables restart 
[root@axiang-03 ~]# /etc/sysconfig/iptables

iptables -Z 经常使用于监控脚本判断
TCP抛包举例，源IP指定网卡接收举例

[root@axiang-03 ~]#  iptables -p tcp -A INPUT -s 192.168.83.1 --sport 1234 -d 192.168.83.139 --dport 80 -j DROP
[root@axiang-03 ~]# iptables -I INPUT -s 192.168.83.0/24 -i eth0 -j ACCEPT

-I：前排插入规则
-A：是在后面加入规则
-D：是删除规则
根据编号删除规则

[root@axiang-03 ~]# iptables -nvL --line-numbers
Chain INPUT (policy ACCEPT 8 packets, 628 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 ACCEPT     all  --  eth0   *       192.168.83.0/24      0.0.0.0/0           
2        0     0 DROP       tcp  --  *      *       192.168.83.1         192.168.83.139       tcp spt:1234 dpt:80
[root@axiang-03 ~]# iptables -D INPUT 1
[root@axiang-03 ~]# iptables -nvL --line-numbers
Chain INPUT (policy ACCEPT 6 packets, 428 bytes)
num   pkts bytes target     prot opt in     out     source               destination         
1        0     0 DROP       tcp  --  *      *       192.168.83.1         192.168.83.139       tcp spt:1234 dpt:80

预设规则为(policy)为ACCEPT，能够经过命令 iptables -P INPUT 修改，可是注意若是进出改成DROP则不能远程，同时本机清空操做-F不会恢复