Differences

This shows you the differences between two versions of the page.

--- сервис_firewall [2018/10/23 09:23]
val [CentOS]
+++ сервис_firewall [2021/12/23 16:34]
val
@@ Line 8: / Line 8: @@
 ==== Linux (iptables) ====
-  * [[https://help.ubuntu.com/community/IptablesHowTo]]
+  * [[https://cryptoworld.su/kak-perejti-s-iptables-na-nftables-polnaya-istrukciya/|Как перейти с iptables на Nftables — полная инструкция]]
-  * [[http://ru.wikibooks.org/wiki/Iptables]]
+  * [[https://help.ubuntu.com/community/IptablesHowTo|ubuntu.com community IptablesHowTo]]
-  * [[https://ru.wikipedia.org/wiki/Netfilter]]
+  * [[https://ru.wikibooks.org/wiki/Iptables|Материал из Викиучебника iptables — утилита командной строки]]
+  * [[https://ru.wikipedia.org/wiki/Netfilter|Материал из Википедии netfilter — межсетевой экран]]
 === Настройка фильтра ===
 <code>
-root@gate:~# cat firewall.sh
+root@clientN:~# cat firewall.sh
 </code><code>
 iptables --flush
@@ Line 21: / Line 22: @@
 iptables -A INPUT -j DROP
 </code><code>
-root@gate:~# sh firewall.sh
+root@clientN:~# sh firewall.sh
 </code>
 === Просмотр правил фильтра ===
 <code>
-root@gate:~# iptables -t filter -n -L -v --line-numbers
+# iptables -t filter -n -L -v --line-numbers
 или
-root@gate:~# iptables -n -L -v --line-numbers
+# iptables -n -L -v --line-numbers
+</code>
+=== Удаление правил фильтра ===
+<code>
+iptables -t ТАБЛИЦА -D ЦЕПОЧКА НОМЕР_ПРАВИЛА
 </code>
 === Работа с таблицей состояний ===
@@ Line 36: / Line 40: @@
 <code>
-# cat /proc/net/ip_conntrack
 # apt install conntrack
@@ Line 45: / Line 47: @@
 === Сохранение состояния iptables ===
 <code>
-root@gate:~# iptables-save > /etc/iptables.rules
+# iptables-save > /etc/iptables.rules
 </code>
 === Восстановление состояния iptables ===
 <code>
-root@gate:~# iptables-restore < /etc/iptables.rules
+# iptables-restore < /etc/iptables.rules
 </code>
@@ Line 57: / Line 59: @@
 == Debian/Ubuntu ==
 <code>
-root@gate:~# cat /etc/network/interfaces
+# cat /etc/network/interfaces
 </code><code>
 ...
@@ Line 80: / Line 82: @@
 # firewall-cmd --get-active-zones
+!!! даже, если пусто, похоже, в этом случае используется public
-# firewall-cmd --zone=public --list-all
+# firewall-cmd --get-zone-of-interface=enp0s3
+no zone   !!!похоже, в этом случае используется public
-client1# firewall-cmd --change-interface=enp0s3 --zone=drop
+# firewall-cmd --list-all
+# firewall-cmd --change-interface=enp0s3 --zone=public
 # firewall-cmd --get-services | tr " " "\n"
@@ Line 90: / Line 96: @@
 server# firewall-cmd --zone=public --add-service=http
 server# firewall-cmd --zone=public --remove-service=http
 gate# firewall-cmd --zone=public --add-port=2222/tcp
 gate# firewall-cmd --zone=public --remove-port=2222/tcp
@@ Line 165: / Line 169: @@
 iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 53 -j ACCEPT
 #iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 25 -j REJECT
-iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 25 -j ACCEPT
+#iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 25 -j ACCEPT
+#iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 465 -j ACCEPT
+#iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 587 -j ACCEPT
+#iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 143 -j ACCEPT
 iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 80 -j ACCEPT
-iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 143 -j ACCEPT
+iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 5222 -j ACCEPT
-#iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 5006 -j ACCEPT
+#iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 5060 -j ACCEPT
 #iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 4569 -j ACCEPT
 #iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 10000:20000 -j ACCEPT
@@ Line 185: / Line 193: @@
 conntrack -F
 </code><code>
+root@gate:~# apt install conntrack
 root@gate:~# sh firewall.sh
@@ Line 289: / Line 299: @@
 </code><code>
 ...
-iptables -A FORWARD -j LOG --log-prefix "iptables denied: " --log-level 7
+iptables -A ... -j LOG --log-prefix "iptables denied: " --log-level 7
+iptables -A ... -j DROP
-iptables -A FORWARD -j DROP
 </code><code>
 root@gate:~# sh firewall.sh
@@ Line 385: / Line 394: @@
 </code><code>
 iptables --flush
-#### for brute force ####
-iptables -I FORWARD -p tcp --dport 22 -i eth1 -m conntrack --ctstate NEW -m recent --set
-iptables -I FORWARD -p tcp --dport 22 -i eth1 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
 ...
+iptables -A FORWARD -p tcp --dport 80 -i eth1 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j LOG
+iptables -A FORWARD -p tcp --dport 80 -i eth1 -m conntrack --ctstate NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
+iptables -A FORWARD -p tcp --dport 80 -i eth1 -m conntrack --ctstate NEW -m recent --set
+...
+</code><code>
+root@gate:~# tail -f /var/log/syslog
+root@gate:~# cat /proc/net/xt_recent/DEFAULT
+root@gate:~# echo -10.5.7.1 >/proc/net/xt_recent/DEFAULT
+root@gate:~# echo / >/proc/net/xt_recent/DEFAULT
 </code>
 ==== FreeBSD (pf) ====
@@ Line 410: / Line 428: @@
 # pfctl -t fail2ban -T add 172.16.1.254
+# pfctl -k 172.16.1.254
 # pfctl -t fail2ban -T flush
@@ Line 428: / Line 447: @@
 [gate:~] # pfctl -vs state
-[gate:~] # pkg_add -r pftop
+[gate:~] # pfctl -k 0.0.0.0/0 -k 172.16.1.254
+[gate:~] # pfctl -F states
-[gate:~] # rehash
+[gate:~] # pkg install pftop
 [gate:~] # pftop

Методические материалы Лохтурова Вячеслава

User Tools

Site Tools

Differences

Page Tools