Linux学习笔记(八)--RedHat 7.0之Iptables、Firewalld防火墙设置与Xshell远程连接
2018-03-28 21:53
671 查看
本章节所讲都是在网卡配置成功的基础上,其中网卡配置及测试请移步我的上一篇博客: Linux学习笔记(七)--RedHatEnterpriseLinux 7.0之管道符、重定向、环境变量、Vim编辑器与Shell命令脚本
一、iptables基本的命令参数 iptables中常用的参数以及作用
(1)基于我自己的虚拟机进行的设置:(这部分都是相同的,只是涉及到的ip需要根据自己情况做修改)在iptables命令后添加-L参数查看已有的防火墙规则链:[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
INPUT_direct all -- anywhere anywhere
INPUT_ZONES_SOURCE all -- anywhere anywhere
INPUT_ZONES all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
………………省略部分输出信息………………在iptables命令后添加-F参数清空已有的防火墙规则链:[root@linuxprobe ~]# iptables -F
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
………………省略部分输出信息………………把INPUT规则链的默认策略设置为拒绝:[root@linuxprobe ~]# iptables -P INPUT DROP
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
…………省略部分输出信息………………向INPUT链中添加允许ICMP流量进入的策略规则:在日常运维工作中,经常会使用ping命令来检查对方主机是否在线,而向防火墙的INPUT规则链中添加一条允许ICMP流量进入的策略规则就默认允许了这种ping命令检测行为。[root@linuxprobe ~]# iptables -I INPUT -p icmp -j ACCEPT
[root@linuxprobe ~]# ping -c 4 192.168.21.112(自己的ip地址)
PING 192.168.21.112 (192.168.21.112) 56(84) bytes of data.
64 bytes from 192.168.10.10: icmp_seq=1 ttl=64 time=0.156 ms
64 bytes from 192.168.10.10: icmp_seq=2 ttl=64 time=0.117 ms
64 bytes from 192.168.10.10: icmp_seq=3 ttl=64 time=0.099 ms
64 bytes from 192.168.10.10: icmp_seq=4 ttl=64 time=0.090 ms
--- 192.168.10.10 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 2999ms
rtt min/avg/max/mdev = 0.090/0.115/0.156/0.027 ms
删除INPUT规则链中刚刚加入的那条策略(允许ICMP流量),并把默认策略设置为允许:[root@linuxprobe ~]# iptables -D INPUT 1
[root@linuxprobe ~]# iptables -P INPUT ACCEPT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
………………省略部分输出信息………………将INPUT规则链设置为只允许指定网段的主机访问本机的22端口,拒绝来自其他所有主机的流量:[root@linuxprobe ~]# iptables -I INPUT -s 192.168.21.0/24 -p tcp --dport 22 -j ACCEPT
[root@linuxprobe ~]# iptables -A INPUT -p tcp --dport 22 -j REJECT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- 192.168.21.0/24 anywhere tcp dpt:ssh
REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
………………省略部分输出信息………………
再次重申,防火墙策略规则是按照从上到下的顺序匹配的,因此一定要把允许动作放到拒绝动作前面,否则所有的流量就将被拒绝掉,从而导致任何主机都无法访问我们的服务。另外,这里提到的22号端口是ssh服务使用的。在设置完上述INPUT规则链之后,我们使用IP地址在192.168.21.0/24网段内的主机访问服务器(即前面提到的设置了INPUT规则链的主机)的22端口,效果如下:[root@Client A ~]# ssh 192.168.21.112
The authenticity of host '192.168.21.112 (192.168.21.112)' can't be established.
ECDSA key fingerprint is 70:3b:5d:37:96:7b:2e:a5:28:0d:7e:dc:47:6a:fe:5c.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.21.112' (ECDSA) to the list of known hosts.
root@192.168.10.10's password:
Last login: Sun Feb 12 01:50:25 2017
[root@Client A ~]#
向INPUT规则链中添加拒绝所有人访问本机12345端口的策略规则:[root@linuxprobe ~]# iptables -I INPUT -p tcp --dport 12345 -j REJECT
[root@linuxprobe ~]# iptables -I INPUT -p udp --dport 12345 -j REJECT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable
ACCEPT tcp -- 192.168.10.0/24 anywhere tcp dpt:ssh
REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
………………省略部分输出信息………………向INPUT规则链中添加拒绝192.168.21.1主机访问本机80端口(Web服务)的策略规则:[root@linuxprobe ~]# iptables -I INPUT -p tcp -s 192.168.21.1 --dport 80 -j REJECT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- 192.168.21.1 anywhere tcp dpt:http reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable
ACCEPT tcp -- 192.168.21.0/24 anywhere tcp dpt:ssh
REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
………………省略部分输出信息………………
向INPUT规则链中添加拒绝所有主
bdfa
机访问本机1000~1024端口的策略规则:[root@linuxprobe ~]# iptables -A INPUT -p tcp --dport 1000:1024 -j REJECT
[root@linuxprobe ~]# iptables -A INPUT -p udp --dport 1000:1024 -j REJECT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- 192.168.21.112 anywhere tcp dpt:http reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable
ACCEPT tcp -- 192.168.21.0/24 anywhere tcp dpt:ssh
REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpts:cadlock2:1024 reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpts:cadlock2:1024 reject-with icmp-port-unreachable
………………省略部分输出信息………………但是请特别注意,使用iptables命令配置的防火墙规则默认会在系统下一次重启时失效,如果想让配置的防火墙策略永久生效,还要执行保存命令:[root@linuxprobe ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]二、Firewalld查看firewalld服务当前所使用的区域:[root@linuxprobe ~]# firewall-cmd --get-default-zone
public查询eno16777736网卡在firewalld服务中的区域:[root@linuxprobe ~]# firewall-cmd --get-zone-of-interface=eno16777736
public把firewalld服务中eno16777736网卡的默认区域修改为external,并在系统重启后生效。分别查看当前与永久模式下的区域名称:[root@linuxprobe ~]# firewall-cmd --permanent --zone=external --change-interface=eno16777736
success
[root@linuxprobe ~]# firewall-cmd --get-zone-of-interface=eno16777736
public
[root@linuxprobe ~]# firewall-cmd --permanent --get-zone-of-interface=eno16777736
external把firewalld服务的当前默认区域设置为public:[root@linuxprobe ~]# firewall-cmd --set-default-zone=public
success
[root@linuxprobe ~]# firewall-cmd --get-default-zone
public查询public区域是否允许请求SSH和HTTPS协议的流量:[root@linuxprobe ~]# firewall-cmd --zone=public --query-service=ssh
yes
[root@linuxprobe ~]# firewall-cmd --zone=public --query-service=https
no把firewalld服务中请求HTTPS协议的流量设置为永久允许,并立即生效:[root@linuxprobe ~]# firewall-cmd --zone=public --add-service=https
success
[root@linuxprobe ~]# firewall-cmd --permanent --zone=public --add-service=https
success
[root@linuxprobe ~]# firewall-cmd --reload
success把firewalld服务中请求HTTP协议的流量设置为永久拒绝,并立即生效:[root@linuxprobe ~]# firewall-cmd --permanent --zone=public --remove-service=http
success
[root@linuxprobe ~]# firewall-cmd --reload
success把在firewalld服务中访问8080和8081端口的流量策略设置为允许,但仅限当前生效:[root@linuxprobe ~]# firewall-cmd --zone=public --add-port=8080-8081/tcp
success
[root@linuxprobe ~]# firewall-cmd --zone=public --list-ports
8080-8081/tcp在客户端使用ssh命令尝试访问192.168.21.112主机的22端口:[root@client A ~]# ssh -p 22 192.168.21.112
The authenticity of host '[192.168.10.10]:22 ([192.168.21.112]:888)' can't be established.
ECDSA key fingerprint is b8:25:88:89:5c:05:b6:dd:ef:76:63:ff:1a:54:02:1a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[192.168.10.10]:888' (ECDSA) to the list of known hosts.
root@192.168.21.112's password:此处输入远程root管理员的密码
Last login: Sun Jul 19 21:43:48 2017 from 192.168.21.112三、Xshell 5此时就可以进行远程连接了
一、iptables基本的命令参数 iptables中常用的参数以及作用
参数 | 作用 |
-P | 设置默认策略 |
-F | 清空规则链 |
-L | 查看规则链 |
-A | 在规则链的末尾加入新规则 |
-I num | 在规则链的头部加入新规则 |
-D num | 删除某一条规则 |
-s | 匹配来源地址IP/MASK,加叹号“!”表示除这个IP外 |
-d | 匹配目标地址 |
-i 网卡名称 | 匹配从这块网卡流入的数据 |
-o 网卡名称 | 匹配从这块网卡流出的数据 |
-p | 匹配协议,如TCP、UDP、ICMP |
--dport num | 匹配目标端口号 |
--sport num | 匹配来源端口号 |
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT all -- anywhere anywhere
INPUT_direct all -- anywhere anywhere
INPUT_ZONES_SOURCE all -- anywhere anywhere
INPUT_ZONES all -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
………………省略部分输出信息………………在iptables命令后添加-F参数清空已有的防火墙规则链:[root@linuxprobe ~]# iptables -F
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
………………省略部分输出信息………………把INPUT规则链的默认策略设置为拒绝:[root@linuxprobe ~]# iptables -P INPUT DROP
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
…………省略部分输出信息………………向INPUT链中添加允许ICMP流量进入的策略规则:在日常运维工作中,经常会使用ping命令来检查对方主机是否在线,而向防火墙的INPUT规则链中添加一条允许ICMP流量进入的策略规则就默认允许了这种ping命令检测行为。[root@linuxprobe ~]# iptables -I INPUT -p icmp -j ACCEPT
[root@linuxprobe ~]# ping -c 4 192.168.21.112(自己的ip地址)
PING 192.168.21.112 (192.168.21.112) 56(84) bytes of data.
64 bytes from 192.168.10.10: icmp_seq=1 ttl=64 time=0.156 ms
64 bytes from 192.168.10.10: icmp_seq=2 ttl=64 time=0.117 ms
64 bytes from 192.168.10.10: icmp_seq=3 ttl=64 time=0.099 ms
64 bytes from 192.168.10.10: icmp_seq=4 ttl=64 time=0.090 ms
--- 192.168.10.10 ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 2999ms
rtt min/avg/max/mdev = 0.090/0.115/0.156/0.027 ms
删除INPUT规则链中刚刚加入的那条策略(允许ICMP流量),并把默认策略设置为允许:[root@linuxprobe ~]# iptables -D INPUT 1
[root@linuxprobe ~]# iptables -P INPUT ACCEPT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
………………省略部分输出信息………………将INPUT规则链设置为只允许指定网段的主机访问本机的22端口,拒绝来自其他所有主机的流量:[root@linuxprobe ~]# iptables -I INPUT -s 192.168.21.0/24 -p tcp --dport 22 -j ACCEPT
[root@linuxprobe ~]# iptables -A INPUT -p tcp --dport 22 -j REJECT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- 192.168.21.0/24 anywhere tcp dpt:ssh
REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
………………省略部分输出信息………………
再次重申,防火墙策略规则是按照从上到下的顺序匹配的,因此一定要把允许动作放到拒绝动作前面,否则所有的流量就将被拒绝掉,从而导致任何主机都无法访问我们的服务。另外,这里提到的22号端口是ssh服务使用的。在设置完上述INPUT规则链之后,我们使用IP地址在192.168.21.0/24网段内的主机访问服务器(即前面提到的设置了INPUT规则链的主机)的22端口,效果如下:[root@Client A ~]# ssh 192.168.21.112
The authenticity of host '192.168.21.112 (192.168.21.112)' can't be established.
ECDSA key fingerprint is 70:3b:5d:37:96:7b:2e:a5:28:0d:7e:dc:47:6a:fe:5c.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.21.112' (ECDSA) to the list of known hosts.
root@192.168.10.10's password:
Last login: Sun Feb 12 01:50:25 2017
[root@Client A ~]#
向INPUT规则链中添加拒绝所有人访问本机12345端口的策略规则:[root@linuxprobe ~]# iptables -I INPUT -p tcp --dport 12345 -j REJECT
[root@linuxprobe ~]# iptables -I INPUT -p udp --dport 12345 -j REJECT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable
ACCEPT tcp -- 192.168.10.0/24 anywhere tcp dpt:ssh
REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
………………省略部分输出信息………………向INPUT规则链中添加拒绝192.168.21.1主机访问本机80端口(Web服务)的策略规则:[root@linuxprobe ~]# iptables -I INPUT -p tcp -s 192.168.21.1 --dport 80 -j REJECT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- 192.168.21.1 anywhere tcp dpt:http reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable
ACCEPT tcp -- 192.168.21.0/24 anywhere tcp dpt:ssh
REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
………………省略部分输出信息………………
向INPUT规则链中添加拒绝所有主
bdfa
机访问本机1000~1024端口的策略规则:[root@linuxprobe ~]# iptables -A INPUT -p tcp --dport 1000:1024 -j REJECT
[root@linuxprobe ~]# iptables -A INPUT -p udp --dport 1000:1024 -j REJECT
[root@linuxprobe ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- 192.168.21.112 anywhere tcp dpt:http reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpt:italk reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpt:italk reject-with icmp-port-unreachable
ACCEPT tcp -- 192.168.21.0/24 anywhere tcp dpt:ssh
REJECT tcp -- anywhere anywhere tcp dpt:ssh reject-with icmp-port-unreachable
REJECT tcp -- anywhere anywhere tcp dpts:cadlock2:1024 reject-with icmp-port-unreachable
REJECT udp -- anywhere anywhere udp dpts:cadlock2:1024 reject-with icmp-port-unreachable
………………省略部分输出信息………………但是请特别注意,使用iptables命令配置的防火墙规则默认会在系统下一次重启时失效,如果想让配置的防火墙策略永久生效,还要执行保存命令:[root@linuxprobe ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]二、Firewalld查看firewalld服务当前所使用的区域:[root@linuxprobe ~]# firewall-cmd --get-default-zone
public查询eno16777736网卡在firewalld服务中的区域:[root@linuxprobe ~]# firewall-cmd --get-zone-of-interface=eno16777736
public把firewalld服务中eno16777736网卡的默认区域修改为external,并在系统重启后生效。分别查看当前与永久模式下的区域名称:[root@linuxprobe ~]# firewall-cmd --permanent --zone=external --change-interface=eno16777736
success
[root@linuxprobe ~]# firewall-cmd --get-zone-of-interface=eno16777736
public
[root@linuxprobe ~]# firewall-cmd --permanent --get-zone-of-interface=eno16777736
external把firewalld服务的当前默认区域设置为public:[root@linuxprobe ~]# firewall-cmd --set-default-zone=public
success
[root@linuxprobe ~]# firewall-cmd --get-default-zone
public查询public区域是否允许请求SSH和HTTPS协议的流量:[root@linuxprobe ~]# firewall-cmd --zone=public --query-service=ssh
yes
[root@linuxprobe ~]# firewall-cmd --zone=public --query-service=https
no把firewalld服务中请求HTTPS协议的流量设置为永久允许,并立即生效:[root@linuxprobe ~]# firewall-cmd --zone=public --add-service=https
success
[root@linuxprobe ~]# firewall-cmd --permanent --zone=public --add-service=https
success
[root@linuxprobe ~]# firewall-cmd --reload
success把firewalld服务中请求HTTP协议的流量设置为永久拒绝,并立即生效:[root@linuxprobe ~]# firewall-cmd --permanent --zone=public --remove-service=http
success
[root@linuxprobe ~]# firewall-cmd --reload
success把在firewalld服务中访问8080和8081端口的流量策略设置为允许,但仅限当前生效:[root@linuxprobe ~]# firewall-cmd --zone=public --add-port=8080-8081/tcp
success
[root@linuxprobe ~]# firewall-cmd --zone=public --list-ports
8080-8081/tcp在客户端使用ssh命令尝试访问192.168.21.112主机的22端口:[root@client A ~]# ssh -p 22 192.168.21.112
The authenticity of host '[192.168.10.10]:22 ([192.168.21.112]:888)' can't be established.
ECDSA key fingerprint is b8:25:88:89:5c:05:b6:dd:ef:76:63:ff:1a:54:02:1a.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[192.168.10.10]:888' (ECDSA) to the list of known hosts.
root@192.168.21.112's password:此处输入远程root管理员的密码
Last login: Sun Jul 19 21:43:48 2017 from 192.168.21.112三、Xshell 5此时就可以进行远程连接了
相关文章推荐
- vmware redhat远程连接设置
- vmware redhat远程连接设置
- linux--Firewalld、Iptables防火墙的设置
- linux下ssh远程连接工具SecureCRT和xshell编码设置
- Ubuntu防火墙设置及开启SSHD服务,同时使用putty远程连接到ubuntu
- CentOS 7.0 设置iptables防火墙
- linux 防火墙IPTABLES 设置IP连接限制
- 在Linux系统要远程连接Oracle的防火墙设置方法
- linux下ssh远程连接工具SecureCRT和xshell编码设置
- 远程连接mysql数据库以及防火墙端口设置
- xshell远程连接设置
- centos7.0 远程连接mysql关闭防火墙的不同
- CentOS 7.0关闭默认防火墙firewalld,使用iptables
- 设置防火墙使mysql可以远程连接的方法
- Windows跨域远程连接防火墙设置
- CentOS 7.0 升级之防火墙 firewalld 取代 iptables
- CentOS 7.0 关闭firewalld防火墙指令 及更换Iptables防火墙
- 在Linux系统下远程连接oracle的防火墙设置
- CentOS 7.0关闭默认防火墙启用iptables防火墙的设置方法
- Centos安装自定义布局才能自己划分各个区的大小ctrl+z ,fg ,route -n ,cat !$ ,!cat ,XShell 设置, ifconfig CentOS远程连接 第一节课