Home | 简体中文 | 繁体中文 | 杂文 | Github | 知乎专栏 | Facebook | Linkedin | Youtube | 打赏(Donations) | About
知乎专栏

第 37 章 Firewall

摘要

Linux Firewall 安装与配置

目录

37.1. TCP/IP 相关内核配置项
37.1.1. net.ipv4.ip_forward
37.1.2. net.ipv4.icmp_echo_ignore_all
37.2. iptables - administration tools for packet filtering and NAT
37.2.1. Getting Started
37.2.2. 用户自定义规则连
37.2.3. Protocols 协议
37.2.4. Interfaces 网络适配器接口
37.2.5. 源IP地址
37.2.6. Ports 端口
37.2.7. NAT
37.2.8. Module(模块)
37.2.9. IPV6
37.2.10. iptables-xml - Convert iptables-save format to XML
37.2.11. access.log IP封锁脚本
37.2.12. Example
37.3. ulogd - The Netfilter Userspace Logging Daemon
37.4. ufw - program for managing a netfilter firewall
37.4.1. /etc/default/ufw
37.4.2. ip_forward
37.4.3. DHCP
37.4.4. Samba
37.5. CentOS 7/8 Firewalld
37.5.1. 如果你不习惯使用firewalld想用回Iptables
37.5.2. 安装 firewalld
37.5.3. firewalld 配置文件
37.5.4. firewall-cmd
37.5.5. 区域
37.5.6. 端口操作
37.5.7. 服务
37.5.8. IP 伪装
37.5.9. 端口转发
37.5.10. 富规则
37.6. Shorewall
37.6.1. Installation Instructions
37.6.2. Configuring Shorewall
37.7. Firewall GUI Tools
37.8. Endian Firewall
37.9. Smooth Firewall
37.10. Sphirewall

37.1. TCP/IP 相关内核配置项

checking status

$ sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0
		

or just checking out the value in the /proc system

$ cat /proc/sys/net/ipv4/ip_forward
0
		

enable

sysctl -w net.ipv4.ip_forward=1
		

or

		
#redhat
echo 1 > /proc/sys/net/ipv4/ip_forward
#debian/ubuntu
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward;
		
		

disable

sysctl -w net.ipv4.ip_forward=0
		

or

		
echo 0 > /proc/sys/net/ipv4/ip_forward
		
		

without rebooting the system

37.1.1. net.ipv4.ip_forward

表 37.1. net.ipv4.ip_forward

userroutewan
192.168.0.2eth0:192.168.0.1 eth1:172.16.0.1172.16.0.254

			
$ sysctl net.ipv4.ip_forward
net.ipv4.ip_forward = 0
			
			

try out ping host from 192.168.0.2 to 192.168.0.1 , 172.16.0.1 and 172.16.0.254

you can access 192.168.0.1 , 172.16.0.1, but 172.16.0.254 time out

sysctl -w net.ipv4.ip_forward=1

try again ping 172.16.0.254

37.1.2. net.ipv4.icmp_echo_ignore_all

如果希望屏蔽别人 ping 你的主机,则加入以下代码:

# Disable ping requests
net.ipv4.icmp_echo_ignore_all = 1