User Tools
сервис_firewall
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision Next revision Both sides next revision | ||
|
сервис_firewall [2020/11/12 11:30] val [Linux (iptables)] |
сервис_firewall [2024/04/26 12:08] val [CentOS] |
||
|---|---|---|---|
| Line 5: | Line 5: | ||
| ===== Конфигурация для рабочей станции ===== | ===== Конфигурация для рабочей станции ===== | ||
| + | |||
| + | ==== nftables ==== | ||
| + | |||
| + | * [[https://habr.com/ru/companies/ruvds/articles/580648/|Переход с iptables на nftables. Краткий справочник]] | ||
| + | * [[https://cryptoworld.su/kak-perejti-s-iptables-na-nftables-polnaya-istrukciya/|Как перейти с iptables на Nftables — полная инструкция]] | ||
| ==== Linux (iptables) ==== | ==== Linux (iptables) ==== | ||
| - | * [[https://help.ubuntu.com/community/IptablesHowTo]] | + | |
| - | * [[http://ru.wikibooks.org/wiki/Iptables]] | + | * [[https://help.ubuntu.com/community/IptablesHowTo|ubuntu.com community IptablesHowTo]] |
| - | * [[https://ru.wikipedia.org/wiki/Netfilter]] | + | * [[https://ru.wikibooks.org/wiki/Iptables|Материал из Викиучебника iptables — утилита командной строки]] |
| + | * [[https://ru.wikipedia.org/wiki/Netfilter|Материал из Википедии netfilter — межсетевой экран]] | ||
| === Настройка фильтра === | === Настройка фильтра === | ||
| Line 30: | Line 36: | ||
| # iptables -n -L -v --line-numbers | # iptables -n -L -v --line-numbers | ||
| </code> | </code> | ||
| + | === Удаление правил фильтра === | ||
| + | <code> | ||
| + | iptables -t ТАБЛИЦА -D ЦЕПОЧКА НОМЕР_ПРАВИЛА | ||
| + | </code> | ||
| === Работа с таблицей состояний === | === Работа с таблицей состояний === | ||
| Line 41: | Line 50: | ||
| </code> | </code> | ||
| - | === Сохранение состояния iptables === | + | === Управление состоянием iptables === |
| + | |||
| + | == Вариант 1 == | ||
| + | |||
| + | == Сохранение состояния iptables == | ||
| <code> | <code> | ||
| - | # iptables-save > /etc/iptables.rules | + | root@gate:~# iptables-save > /etc/iptables.rules |
| </code> | </code> | ||
| - | === Восстановление состояния iptables === | + | == Восстановление состояния iptables == |
| <code> | <code> | ||
| - | # iptables-restore < /etc/iptables.rules | + | root@gate:~# iptables-restore < /etc/iptables.rules |
| </code> | </code> | ||
| - | === Восстановление состояния iptables при загрузке === | + | == Восстановление состояния iptables при загрузке == |
| - | + | ||
| - | == Debian/Ubuntu == | + | |
| <code> | <code> | ||
| - | # cat /etc/network/interfaces | + | root@gate:~# cat /etc/network/interfaces |
| </code><code> | </code><code> | ||
| ... | ... | ||
| Line 62: | Line 73: | ||
| pre-up iptables-restore < /etc/iptables.rules | pre-up iptables-restore < /etc/iptables.rules | ||
| ... | ... | ||
| + | </code> | ||
| + | |||
| + | == Вариант 2 == | ||
| + | <code> | ||
| + | # apt install iptables-persistent | ||
| + | |||
| + | # netfilter-persistent save | ||
| </code> | </code> | ||
| ==== CentOS ==== | ==== CentOS ==== | ||
| - | === CentOS 7 === | + | === CentOS 7, AlmaLinux 9 === |
| * [[https://bozza.ru/art-259.html|Настройка firewalld CentOS 7 с примерами команд]] | * [[https://bozza.ru/art-259.html|Настройка firewalld CentOS 7 с примерами команд]] | ||
| Line 166: | Line 184: | ||
| #iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 25 -j REJECT | #iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 25 -j REJECT | ||
| #iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 25 -j ACCEPT | #iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 25 -j ACCEPT | ||
| - | iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 465 -j ACCEPT | + | #iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 465 -j ACCEPT |
| - | iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 587 -j ACCEPT | + | #iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 587 -j ACCEPT |
| + | #iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 143 -j ACCEPT | ||
| iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 80 -j ACCEPT | iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 80 -j ACCEPT | ||
| - | iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 143 -j ACCEPT | + | iptables -A FORWARD -i eth1 -p tcp -d 192.168.X.10 --dport 5222 -j ACCEPT |
| #iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 5060 -j ACCEPT | #iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 5060 -j ACCEPT | ||
| #iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 4569 -j ACCEPT | #iptables -A FORWARD -i eth1 -p udp -d 192.168.X.10 --dport 4569 -j ACCEPT | ||
| Line 187: | Line 207: | ||
| conntrack -F | conntrack -F | ||
| </code><code> | </code><code> | ||
| + | root@gate:~# apt install conntrack | ||
| + | |||
| root@gate:~# sh firewall.sh | root@gate:~# sh firewall.sh | ||
| Line 420: | Line 442: | ||
| # pfctl -t fail2ban -T add 172.16.1.254 | # pfctl -t fail2ban -T add 172.16.1.254 | ||
| + | # pfctl -k 172.16.1.254 | ||
| # pfctl -t fail2ban -T flush | # pfctl -t fail2ban -T flush | ||
| Line 437: | Line 460: | ||
| <code> | <code> | ||
| [gate:~] # pfctl -vs state | [gate:~] # pfctl -vs state | ||
| + | |||
| + | [gate:~] # pfctl -k 0.0.0.0/0 -k 172.16.1.254 | ||
| [gate:~] # pfctl -F states | [gate:~] # pfctl -F states | ||
сервис_firewall.txt · Last modified: 2024/05/07 16:18 by val
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
