☰

iptables 阻止网络范围

tag-icon • tag-icon linux iptables firewall redhat
iptables 阻止网络范围

我正在尝试REJECT通过网络连接iptables(8)，但出于某种原因，它没有这样做：

# cat /etc/redhat-release 
Red Hat Enterprise Linux Server release 6.6 (Santiago)
# uname -a
Linux X 2.6.32-504.16.2.el6.x86_64 #1 SMP Tue Mar 10 17:01:00 EDT 2015 x86_64 x86_64 x86_64 GNU/Linux
# rpm -q iptables
iptables-1.4.7-14.el6.x86_64
# service iptables restart
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules:                         [  OK  ]
iptables: Loading additional modules: nf_conntrack_ftp     [  OK  ]
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:nfs 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:memcache 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:memcache 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:5666 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:snmp 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
# iptables -A INPUT -s 172.16.0.0/16 -j REJECT
# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:http 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ftp 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:nfs 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:https 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:memcache 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:memcache 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:5666 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:snmp 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
REJECT     all  --  172.16.0.0/16        anywhere            reject-with icmp-port-unreachable 

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         
#

我究竟做错了什么？

答案1

IPtables 会按列表的上部向下应用规则。如果在拒绝规则之前有允许规则，则允许规则将优先执行。

要阻止网络范围，需要将其添加到 IPTables 规则的开头。

iptables -I INPUT 1 -s 172.16.0.0/16 -j REJECT

将在 IPtables 中插入针对网络 172.16.0.0/16 的拒绝规则作为第一行。

一个好的如何对于 IPTABLES。

相关内容