How to implement rhel iptables to allow only limited IP access to a certain port and a specific website
This article introduces how rhel iptables can only allow IP access to a certain port and a specific website. The content is very detailed. Interested friends can use it for reference. I hope it will be helpful to you.
1. Back up iptables first
# cp / etc/sysconfig/iptables / var/tmp
Need to open 80 ports, specify IP and LAN
The following three lines mean:
Close all ports 80 first.
Open the 80 ports of the 192.168.1.0 / 24 end of the ip segment
Open 80 ports of ip segment at the end of 211.123.16.123 / 24 of ip segment
# iptables-I INPUT-p tcp-- dport 80-j DROP
# iptables-I INPUT-s 192.168.1.0 24-p tcp-- dport 80-j ACCEPT
# iptables-I INPUT-s 211.123.16.123 max 24-p tcp-- dport 80-j ACCEPT
The above are temporary settings.
two。 Then save the iptables
For more details, please refer to http://www.weiruoyu.cn/?p=530
= the following is reproduced =
Here are the ports. Seal them all and then open some IP.
Iptables-I INPUT-p tcp-- dport 9889-j DROP
Iptables-I INPUT-s 192.168.1.0 INPUT 24-p tcp-- dport 9889-j ACCEPT
If NAT forwarding is used, remember to cooperate with the following to take effect.
Iptables-I FORWARD-p tcp-- dport 80-j DROP
Iptables-I FORWARD-s 192.168.1.0 FORWARD 24-p tcp-- dport 80-j ACCEPT
The common IPTABLES rules are as follows:
Can only send and receive email, everything else is closed.
Iptables-I Filter-m mac--mac-source 00:0F:EA:25:51:37-j DROP
Iptables-I Filter-m mac--mac-source 00:0F:EA:25:51:37-p udp-- dport 53-j ACCEPT
Iptables-I Filter-m mac--mac-source 00:0F:EA:25:51:37-p tcp-- dport 25-j ACCEPT
Iptables-I Filter-m mac--mac-source 00:0F:EA:25:51:37-p tcp-- dport 110j ACCEPT
IPSEC NAT strategy
Iptables-I PFWanPriv-d 192.168.100.2-j ACCEPT
Iptables-t nat-A PREROUTING-p tcp-- dport 80-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.100.2 PREROUTING 80
Iptables-t nat-A PREROUTING-p tcp-- dport 1723-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.100.2 PREROUTING 1723
Iptables-t nat-A PREROUTING-p udp-- dport 1723-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.100.2 PREROUTING 1723
Iptables-t nat-A PREROUTING-p udp-- dport 500-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.100.2
Iptables-t nat-A PREROUTING-p udp-- dport 4500-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.100.2
NAT of the FTP server
Iptables-I PFWanPriv-p tcp-- dport 21-d 192.168.100.200-j ACCEPT
Iptables-t nat-A PREROUTING-p tcp-- dport 21-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.100.200
Only access to the specified URL is allowed
Iptables-A Filter-p udp-- dport 53-j ACCEPT
Iptables-A Filter-p tcp-- dport 53-j ACCEPT
Iptables-A Filter-d www.3322.org-j ACCEPT
Iptables-A Filter-d img.cn99.com-j ACCEPT
Iptables-A Filter-j DROP
Open some ports of an IP, others are closed
Iptables-A Filter-p tcp-- dport 80-s 192.168.100.200-d www.pconline.com.cn-j ACCEPT
Iptables-A Filter-p tcp-- dport 25-s 192.168.100.200-j ACCEPT
Iptables-A Filter-p tcp-- dport 109-s 192.168.100.200-j ACCEPT
Iptables-A Filter-p tcp-- dport 110-s 192.168.100.200-j ACCEPT
Iptables-A Filter-p tcp-- dport 53-j ACCEPT
Iptables-A Filter-p udp-- dport 53-j ACCEPT
Iptables-A Filter-j DROP
Multiple port
Iptables-A Filter-p tcp-m multiport-- destination-port 22, 53 REJECT 80110-s 192.168.20.3-j REJECT
Continuous port
Iptables-A Filter-p tcp-m multiport-- source-port 22 source-port 22 53Power80110-s 192.168.20.3-j REJECT iptables-A Filter-p tcp-- source-port 2:80-s 192.168.20.3-j REJECT
Specify the time to surf the Internet
Iptables-A Filter-s 10.10.10.253-m time-- timestart 6:00-- timestop 11:00-- days Mon,Tue,Wed,Thu,Fri,Sat,Sun-j DROP
Iptables-A Filter-m time-- timestart 12:00-- timestop 13:00-- days Mon,Tue,Wed,Thu,Fri,Sat,Sun-j ACCEPT
Iptables-A Filter-m time-- timestart 17:30-- timestop 8:30-- days Mon,Tue,Wed,Thu,Fri,Sat,Sun-j ACCEPT
Disable multiple port services
Iptables-A Filter-m multiport-p tcp-- dport 21 women 23 people 80-j ACCEPT
NAT the WAN port to PC
Iptables-t nat-A PREROUTING-I $INTERNET_IF-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.0.1
NAT the WAN port 8000 to 192. one hundred and sixty eight. one hundred. Port 80 of 200
Iptables-t nat-A PREROUTING-p tcp-- dport 8000-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.100.200
The port to be transferred to the MAIL server
Iptables-t nat-A PREROUTING-p tcp-- dport 110-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.100.200
Iptables-t nat-A PREROUTING-p tcp-- dport 25-d $INTERNET_ADDR-j DNAT-- to-destination 192.168.100.200
Only PING 202is allowed. ninety-six. one hundred and thirty four. 133, all other services are prohibited
Iptables-A Filter-p icmp-s 192.168.100.200-d 202.96.134.133-j ACCEPT
Iptables-A Filter-j DROP
Disable BT configuration
Iptables-A Filter-p tcp-dport 6000 tcp 20000-j DROP
Disable QQ Firewall configuration
Iptables-A Filter-p udp-- dport! 53-j DROP
Iptables-A Filter-d 218.17.209.0 Filter 24-j DROP
Iptables-A Filter-d 218.18.95.0 Filter 24-j DROP
Iptables-A Filter-d 219.133.40.177-j DROP
Based on MAC, you can only send and receive email, and reject everything else.
Iptables-I Filter-m mac--mac-source 00:0A:EB:97:79:A1-j DROP
Iptables-I Filter-m mac--mac-source 00:0A:EB:97:79:A1-p tcp-- dport 25-j ACCEPT
Iptables-I Filter-m mac--mac-source 00:0A:EB:97:79:A1-p tcp-- dport 110j ACCEPT
Disable MSN configuration
Iptables-A Filter-p udp-- dport 9-j DROP
Iptables-A Filter-p tcp-- dport 1863-j DROP
Iptables-A Filter-p tcp-- dport 80-d 207.68.178.238-j DROP
Iptables-A Filter-p tcp-- dport 80-d 207.46.110.0 max 24-j DROP
Only PING 202is allowed. ninety-six. one hundred and thirty four. 133 PING is not allowed in other public network IP
Iptables-A Filter-p icmp-s 192.168.100.200-d 202.96.134.133-j ACCEPT
Iptables-A Filter-p icmp-j DROP
Disable a MAC address from accessing internet:
Iptables-I Filter-m mac--mac-source 00:20:18:8F:72:F8-j DROP
Disable PING for an IP address:
Iptables-A Filter-p icmp-s 192.168.0.1-j DROP
Disable an IP address service:
Iptables-A Filter-p tcp-s 192.168.0.1-- dport 80-j DROP
Iptables-A Filter-p udp-s 192.168.0.1-- dport 53-j DROP
Only some services are allowed, others are denied (2 rules)
Iptables-A Filter-p tcp-s 192.168.0.1-- dport 1000-j ACCEPT
Iptables-A Filter-j DROP
Disable a port service for a certain IP address
Iptables-A Filter-p tcp-s 10.10.10.253-- dport 80-j ACCEPT
Iptables-A Filter-p tcp-s 10.10.10.253-- dport 80-j DROP
Disable a port service for a certain MAC address
Iptables-I Filter-p tcp-m mac--mac-source 00:20:18:8F:72:F8-- dport 80-j DROP
Disable a MAC address from accessing internet:
Iptables-I Filter-m mac--mac-source 00VOG 11VOV 2233MULTIZOUR 44MAV 55-j DROP
Disable PING for an IP address:
Iptables-A Filter-p icmp-s 192.168.0.1-j DROP
About how rhel iptables allows only limited IP access to a certain port, a specific website is shared here. I hope the above content can be helpful to everyone and learn more knowledge. If you think the article is good, you can share it for more people to see.
