# iptables表和链
表（Tables）:
– filter: 默认表，用于过滤数据包
– nat: 用于网络地址转换
– mangle: 用于修改数据包头部
– raw: 用于配置连接跟踪

链（Chains）:
– INPUT: 处理进入系统的数据包
– OUTPUT: 处理从系统发出的数据包
– FORWARD: 处理转发的数据包
– PREROUTING: 在路由决策前处理数据包
– POSTROUTING: 在路由决策后处理数据包

# 查看iptables规则
$ sudo iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

# 查看详细规则
$ sudo iptables -L -n -v
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
pkts bytes target prot opt in out source destination

# 查看规则编号
$ sudo iptables -L –line-numbers
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all — 0.0.0.0/0 0.0.0.0/0

# 查看nat表
$ sudo iptables -t nat -L

# 查看mangle表
$ sudo iptables -t mangle -L

# 清除所有规则
$ sudo iptables -F
$ sudo iptables -X
$ sudo iptables -t nat -F
$ sudo iptables -t mangle -F

# 设置默认策略
$ sudo iptables -P INPUT DROP
$ sudo iptables -P FORWARD DROP
$ sudo iptables -P OUTPUT ACCEPT

# 允许本地回环
$ sudo iptables -A INPUT -i lo -j ACCEPT

# 允许已建立的连接
$ sudo iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

# 允许SSH
$ sudo iptables -A INPUT -p tcp –dport 22 -j ACCEPT

# 允许HTTP
$ sudo iptables -A INPUT -p tcp –dport 80 -j ACCEPT

# 允许HTTPS
$ sudo iptables -A INPUT -p tcp –dport 443 -j ACCEPT

# 允许ICMP
$ sudo iptables -A INPUT -p icmp -j ACCEPT

# 拒绝其他所有输入
$ sudo iptables -A INPUT -j DROP

# 查看规则
$ sudo iptables -L -n -v –line-numbers
Chain INPUT (policy DROP 0 packets,from PG视频:www.itpux.com 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all — lo * 0.0.更多视频教程www.fgedu.net.cn0.0/0 0.0.0.0/0
2 100 8000 ACCEPT all — * * 0.0.0.0/0 0.0.0.0/0 state ESTABLISHED,RELATED
3 10 600 ACCEPT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
4 5 300 ACCEPT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
5 3 180 ACCEPT tcp — * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443
6 2 168 ACCEPT icmp — * * 0.0.0.0/0 0.0.0.0/0
7 0 0 DROP all — 学习交流加群风哥QQ113257174 * * 0.0.0.0/0 0.0.0.0/0

# 基于源IP的规则
$ sudo iptables -A INPUT -s 192.168.1.0/24 -j A更多学习教程公众号风哥教程itpux_comCCEPT
$ sudo iptables -A INPUT -s 10.0.0.100 -j DROP

# 基于目标IP的规则
$ sudo iptables -A INPUT -d 192.168.1.100 -j ACCEPT

# 基于网络接口的规则
$ sudo iptables -A INPUT -i eth0 -j ACCEPT
$ sudo iptables -A OUTPUT -o eth1 -j ACCEPT

# 基于协议的规则
$ sudo iptables -A INPUT -p tcp -j ACCEPT
$ sudo iptables -A INPUT -p udp –dport 53 -j ACCEPT

# 基于端口的规则
$ sudo iptables -A INPUT -p tcp –dport 80:443 -j ACCEPT
$ sudo iptables -A INPUT -p tcp –sport 1024:65535 -j ACCEPT

# 基于连接状态的规则
$ sudo iptables -A INPUT -m state –state NEW -j ACCEPT
$ sudo iptables -A INPUT -m state –state INVALID -j DROP

# 限制连接速率
$ sudo iptables -A INPUT -p tcp –dport 22 -m limit –limit 3/min -j ACCEPT

# 防止SYN攻击
$ sudo iptables -A INPUT -p tcp –syn -m limit –limit 1/s –limit-burst 3 -j ACCEPT

# 防止端口扫描
$ sudo iptables -A INPUT -m recent –name portscan –rcheck –seconds 300 -j DROP
$ sudo iptables -A INPUT -m recent –name portscan –remove

# 记录日志
$ sudo iptables -A INPUT -j LOG –log-prefix “IPTables-Input: ”
$ sudo iptables -A INPUT -j DROP

# 自定义链
$ sudo iptables -N LOGGING
$ sudo iptables -A LOGGING -j LOG –log-prefix “IPTables-Logging: ”
$ sudo iptables -A LOGGING -j DROP
$ sudo iptables -A INPUT -j LOGGING

# 配置SNAT（源地址转换）
$ sudo iptables -t nat -A POSTROUTING -o eth0 -j SNAT –to-source 192.168.1.100

# 配置MASQUERADE（动态SNAT）
$ sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

# 配置DNAT（目标地址转换）
$ sudo iptables -t nat -A PREROUTING -i eth0 -p tcp –dport 80 -j DNAT –to-destination 192.168.2.10:8080

# 配置端口转发
$ sudo iptables -t nat -A PREROUTING -p tcp –dport 8080 -j REDIRECT –to-port 80

# 配置负载均衡
$ sudo iptables -t nat -A PREROUTING -p tcp –dport 80 -m statistic –mode random –probability 0.5 -j DNAT –to-destination 192.168.2.10:80
$ sudo iptables -t nat -A PREROUTING -p tcp –dport 80 -j DNAT学习交流加群风哥微信: itpux-com –to-destination 192.168.2.11:80

# 启用IP转发
$ sudo sysctl -w net.ipv4.ip_forward=1
$ echo “net.ipv4.ip_forward = 1” | sudo tee -a /etc/sysctl.conf

# 查看NAT规则
$ sudo iptables -t nat -L -n -v

# 安装iptables-services
$ sudo dnf install -y iptables-services

# 保存规则
$ sudo iptables-save > /etc/iptables/rules.v4
$ sudo ip6tables-save > /etc/iptables/rules.v6

# 恢复规则
$ sudo iptables-restore < /etc/iptables/rules.v4 # 启用iptables服务 $ sudo systemctl enable iptables $ sudo systemctl start iptables # 保存规则到服务 $ sudo service iptables save # 创建规则脚本 $ cat > /etc/iptables/iptables-rules.sh << 'EOF' #!/bin/bash # 清除规则 iptables -F iptables -X iptables -t nat -F iptables -t mangle -F # 设置默认策略 iptables -P INPUT DROP iptables -P FORWARD DROP iptables -P OUTPUT ACCEPT # 允许本地回环 iptables -A INPUT -i lo -j ACCEPT # 允许已建立的连接 iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # 允许SSH iptables -A INPUT -p tcp --dport 22 -j ACCEPT # 允许HTTP和HTTPS iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT # 允许ICMP iptables -A INPUT -p icmp -j ACCEPT # 拒绝其他所有输入 iptables -A INPUT -j DROP # 保存规则 iptables-save > /etc/iptables/rules.v4
EOF

chmod +x /etc/iptables/iptables-rules.sh