包過濾防火墻和靈巧網(wǎng)關(guān)設(shè)置(存儲(chǔ)版)
【正文】 table 200 普通對(duì)外的路由，分流 gateway= ip route add $gateway table 210 ip route add $gateway table 210 ip route add 0/0 via table 210 51 設(shè)置步驟 策略路由 ip rule add from 0/0 table main pref 100 ip rule add from table 100 pref 200 ip rule add from table 100 pref 200 ip rule add from 0/0 table 210 pref 300 DHCP服務(wù)器 dhcpd eth3 52 設(shè)置步驟 清除以前的設(shè)置 iptables t nat F iptables –F 地址轉(zhuǎn)換 對(duì)服務(wù)器訪問的轉(zhuǎn)換 iptables t nat A PREROUTING j DNAT d p tcp dport 9090 to iptables t nat A PREROUTING j DNAT d to 53 設(shè)置步驟 內(nèi)網(wǎng)對(duì)服務(wù)器訪問的轉(zhuǎn)換成從網(wǎng)關(guān)出去 iptables t nat A POSTROUTING j SNAT s 服務(wù)器出去的轉(zhuǎn)換， eth2接網(wǎng)通 iptables t nat A POSTROUTING j SNAT s to o eth2 54 設(shè)置步驟 普通機(jī)器出去的轉(zhuǎn)換， eth1是教育網(wǎng)接口，eth2是網(wǎng)通接口 iptables t nat A POSTROUTING j SNAT to o eth2 s iptables t nat A POSTROUTING j SNAT to o eth1 s 55 設(shè)置步驟 包過慮設(shè)置 允許已經(jīng)建立的連接 iptables A FORWARD j ACCEPT m state state ESTABLISHED,RELATED 禁止 113 ident服務(wù)， ftp登陸會(huì)快一些 iptables A FORWARD j REJECT rejectwith tcpreset p tcp dport 113 56 設(shè)置步驟 允許內(nèi)部訪問 SQL Server iptables A FORWARD j ACCEPT p tcp dport 1433 s iptables A FORWARD j ACCEPT d p icmp iptables A FORWARD j ACCEPT d p tcp dport 8999:65535 s 57 設(shè)置步驟 其它訪問服務(wù)器的被拒絕 iptables A FORWARD j LOG o eth0 m limit limit 100/min iptables A FORWARD j REJECT o eth0 iptables A FORWARD j DROP p icmp 其它內(nèi)部用戶的被拒絕 iptables A FORWARD j REJECT o eth3 58 設(shè)置步驟 防止病毒掃描 iptables A FORWARD j DROP p udp dport 135:139 iptables A FORWARD j DROP p tcp dport 135:139 iptables A FORWARD j DROP p tcp dport 445 iptables A FORWARD j ACCEPT p icmp m limit limit 10/sec 59 設(shè)置步驟 網(wǎng)
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1