iptables 語法

存個紀錄

#!/bin/bash

#PATH=/sbin:/bin:/usr/sbin:/usr/bin; export PATH

echo "1" > /proc/sys/net/ipv4/ip_forward

iptables -F

iptables -X

iptables -Z

iptables -P INPUT   ACCEPT

iptables -P OUTPUT  ACCEPT

iptables -P FORWARD ACCEPT

iptables -F -t nat

iptables -X -t nat

iptables -Z -t nat

iptables -t nat -P PREROUTING  ACCEPT

iptables -t nat -P POSTROUTING ACCEPT

iptables -t nat -P OUTPUT      ACCEPT

iptables -A INPUT -i eth0 -j ACCEPT

iptables -A INPUT -i eth1 -j ACCEPT

iptables -A INPUT -p tcp -m state --state NEW,RELATED,ESTABLISHED -m tcp --dport

 1723 -j ACCEPT

iptables -A INPUT -p gre -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT

iptables -t nat -A POSTROUTING -s 163.17.99.0/24 -j MASQUERADE

/etc/init.d/iptables save

/etc/init.d/iptables restart

iptables 內部簡易 NAT

#!/bin/bash
#PATH=/sbin:/bin:/usr/sbin:/usr/bin; export PATH
echo "1" > /proc/sys/net/ipv4/ip_forward
iptables -F
iptables -X
iptables -Z
iptables -P INPUT   ACCEPT
iptables -P OUTPUT  ACCEPT
iptables -P FORWARD ACCEPT
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -t nat -P PREROUTING  ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT      ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.228.0/24 -o eth1 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth1 -s 192.168.228.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
/etc/init.d/iptables save
/etc/init.d/iptables restart
 

備份CentOS 6 的 nat 的 批次檔

系統環境：CentOS 6

#!/bin/bash
#PATH=/sbin:/bin:/usr/sbin:/usr/bin; export PATH
echo "1" > /proc/sys/net/ipv4/ip_forward

iptables -F
iptables -X
iptables -Z
iptables -P INPUT   ACCEPT
iptables -P OUTPUT  ACCEPT
iptables -P FORWARD ACCEPT
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
iptables -t nat -P PREROUTING  ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT      ACCEPT
iptables -A INPUT -i eth0 -j ACCEPT
iptables -A INPUT -i eth1 -j ACCEPT
iptables -t nat -A POSTROUTING -s 192.168.38.0/24 -o eth1 -j MASQUERADE
iptables -t nat -A PREROUTING -i eth1 -s 192.168.228.0/24 -p tcp --dport 80 -j REDIRECT --to-ports 3128
/etc/init.d/iptables save
/etc/init.d/iptables restart

安裝 iptables 防火牆

移除 firewalld 之後，因為有其他功能我們還是需要 防火牆 來幫我們，所以我們來安裝 iptables 吧。



利用 yum 來安裝 iptables

# yum install iptables                                                                            



將 iptables 從開機過程啟用。

# systemctl enable iptables                                                                  



好了，重新開機吧。

# sync;sync;sync;reboot                                                                         





重新開機之後，看看 iptables 有沒有在運作？



# systemctl status iptables