Please enable JavaScript.

Coggle requires JavaScript to display documents.

iptables (:moneybag:术语 (:four:NAT表 (:moneybag:chain (:two:PREROUTING (…

- - - - :explode:iptalbes的表链的容器
      - :recycle:分类
        
        :one:filter(default)
        
        :two:NAT
        
        :three:MANGLE
        
        :four:RAW
      - :moneybag:链
        
        :recycle:分类
        
        :two:OUTPUT
        
        :explode:出主机
        
        :three:FORWARD
        
        :explode:转发
        
        :one:INPUT
        
        :explode:进入主机
        
        :four:PREROUTING
        
        :explode:预路由.进入主机前的路由
        
        :star:到达防火墙时+判断路由前(altering packets as soon as they come in)
        
        :five:POSTROUTING
        
        :explode:出去时的路由
        
        :star:到达防火墙时+判断路由后(altering packets as they are about to go out)
        
        :explode:链是规则的容器
        
        :moneybag:规则
        
        :explode:一条条过滤的语句
        
        :moneybag:处理
        
        :one:drop
        
        :explode:拒绝的话一般都写drop
        
        :two:return
        
        :three:accept
        
        :explode:老师的说法是,如果我去敲门,如果没人回应,就是drop(丢弃);如果有人回应而不开门,就是reject
        
        :warning:如果我回应了,说明我在家里=>攻击风险上升=>drop更好
  - - - :one:INPUT:star:
        
        :explode:INPUT规定过滤进入本机的数据包
      - :two:FORWARD
      - :three:OUTPUT
  - - - :one:OUTPUT
      - :two:PREROUTING
        
        :explode:数据包到达防火墙时,判断路由前修改目的IP和目的PORT=>发送到局域网内主机
      - :three:POSTROUTING
        
        :explode:数据包离开防火墙时,判断路由之后改变源IP和源PORT=>使用外网IP发送数据给其他外网主机
    - - :one:用Linux做网关
        
        :snowflake:思路
        
        :key:在Linux1上用iptables做NAT
        
        iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o eth0 -j SNAT --to-source 10.0.0.7
        
        :link:用iptables实现Linux网关
        
        :explode:网盘课程:12-企业案例2：部署企业及IDC机房上网网关_
        
        :star::fast_forward:网关的一些注意点
      - :two:外网地址及端口映射为内网服务器
        
        :explode:网盘课程(可能要先用Linux做网关):13-企业案例3：外网地址及端口映射到内网服务器_
        
        :pencil2:配置NAT的端口转换
        
        iptables -t nat -A PREROUTING -d 10.0.0.7 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.8:9000
- - - - :moneybag:防火墙
        
        :three:如果匹配不上,就往下走,直到默认规则
        
        :one:从上往下匹配规则
        
        :two:如果匹配上了,要么是匹配了拒绝服务,要么是匹配上了接收服务,都不再往下走
    - - :one:协议
      - :two:端口
      - :three:IP