Overview
iptables, firewalld, nftables, ufw firewall configuration skills.
iptables
Basic Commands
# 查看规则
iptables -L -n -v
iptables -L -n --line-numbers
iptables -t nat -L -n -v
# 清空规则
iptables -F
iptables -X
iptables -t nat -F
iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT
### 常用规则
```bash
# 允许回环
iptables -A INPUT -i lo -j ACCEPT
# 允许已建立连接
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# 允许 SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# 允许 HTTP/HTTPS
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
# 允许特定 IP
iptables -A INPUT -s 192.168.1.100 -j ACCEPT
# 允许网段
iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 3306 -j ACCEPT
# 拒绝其他
iptables -A INPUT -j DROP
Delete Rules
# 按行号删除
iptables -D INPUT 3
# 按规则删除
iptables -D INPUT -p tcp --dport 80 -j ACCEPT
NAT Configuration
# 开启转发
echo 1 > /proc/sys/net/ipv4/ip_forward
# SNAT
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
# DNAT 端口转发
iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to 192.168.1.10:80
iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 80 -j ACCEPT
Save Rules
# Debian/Ubuntu
iptables-save > /etc/iptables/rules.v4
iptables-restore < /etc/iptables/rules.v4
# CentOS/RHEL
service iptables save
firewalld
Basic Commands
# 状态
systemctl status firewalld
firewall-cmd --state
# 重载
firewall-cmd --reload
# 查看区域
firewall-cmd --get-zones
firewall-cmd --get-default-zone
firewall-cmd --get-active-zones
Service Management
# 查看服务
firewall-cmd --list-services
firewall-cmd --get-services
# 添加服务
firewall-cmd --add-service=http --permanent
firewall-cmd --add-service=https --permanent
# 删除服务
firewall-cmd --remove-service=http --permanent
Port Management
# 查看端口
firewall-cmd --list-ports
# 添加端口
firewall-cmd --add-port=8080/tcp --permanent
firewall-cmd --add-port=5000-5100/tcp --permanent
# 删除端口
firewall-cmd --remove-port=8080/tcp --permanent
Rich Rules
# 允许特定 IP
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.100" accept' --permanent
# 允许网段访问端口
firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="3306" protocol="tcp" accept' --permanent
# 拒绝 IP
firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.100" reject' --permanent
ufw (Ubuntu)
Basic Commands
# 启用/禁用
ufw enable
ufw disable
# 状态
ufw status
ufw status verbose
ufw status numbered
Rule Management
# 允许端口
ufw allow 22
ufw allow 80/tcp
ufw allow 443/tcp
# 允许服务
ufw allow ssh
ufw allow http
# 允许 IP
ufw allow from 192.168.1.100
# 允许网段到端口
ufw allow from 192.168.1.0/24 to any port 3306
# 拒绝
ufw deny 23
# 删除规则
ufw delete allow 80
ufw delete 3
Default Policy
ufw default deny incoming
ufw default allow outgoing
Common Scenarios
Scenario 1: Web Server
# iptables
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -j DROP
# firewalld
firewall-cmd --add-service=ssh --permanent
firewall-cmd --add-service=http --permanent
firewall-cmd --add-service=https --permanent
firewall-cmd --reload
Scenario 2: Database Server
# 只允许应用服务器访问
iptables -A INPUT -s 192.168.1.10 -p tcp --dport 3306 -j ACCEPT
iptables -A INPUT -s 192.168.1.11 -p tcp --dport 3306 -j ACCEPT
iptables -A INPUT -p tcp --dport 3306 -j DROP
Scenario 3: Rate Limiting Protection
# 限制 SSH 连接频率
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP
Troubleshooting
| Problem | Troubleshooting Method |
|---|---|
| Connection refused | Check rule order and default policy |
| Rules not taking effect | Check --permanent and reload |
| NAT not working | Check ip_forward and FORWARD chain |
# 查看计数
iptables -L -n -v
# 日志
iptables -A INPUT -j LOG --log-prefix "IPT_DROP: "
tail -f /var/log/messages | grep IPT_DROP
# 连接跟踪
conntrack -L