用CentOS架设了一台pptpd vpn服务器,信息如下:
服务器IP 192.168.100.1 /24
网关 192.168.100.254(NAT防火墙,将 <外网IP>:1723 映射到 192.168.100.1:1723)
客户端IP地址分配范围 192.168.100.101 ~ 250
基本iptables设置:
-A INPUT -p gre -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 1723 -j ACCEPT
但我还希望用iptables做一些包过滤,允许所有客户端IP访问内网80端口,但只允许某些客户端IP访问其他端口。
看了好多网文,基本确定需要使用 FORWAD CHAIN,但尝试了很多配置方法后,效果或者是全部IP 能访问全部端口,或者是全部端口都无法访问。
在全部端口都无法访问的情况下,使用 'iptables -L -v -n' 指令发现,好多包符合要求通过了,但最后都被DROP,恍悟:只配置了入站,没有配出站,数据包有去无回呀 O_O
以下是完整的iptables
[root@vpnserver ~]# cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -p gre -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 1723 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-I FORWARD -p icmp -j ACCEPT
-I FORWARD -i ppp+ -o eth0 -p tcp -s 192.168.100.0/24 -d 192.168.100.0/24 --dport 80 -j ACCEPT
-I FORWARD -o ppp+ -i eth0 -p tcp -d 192.168.100.0/24 -s 192.168.100.0/24 --sport 80 -j ACCEPT
-I FORWARD -i ppp+ -o eth0 -p tcp -s 192.168.100.201/32 -d 192.168.100.0/24 -m multiport --dport 22,80,1433,3306,3389,8080 -j ACCEPT
-I FORWARD -o ppp+ -i eth0 -p tcp -d 192.168.100.201/32 -s 192.168.100.0/24 -m multiport --sport 22,80,1433,3306,3389,8080 -j ACCEPT
-I FORWARD -i ppp+ -o eth0 -p tcp -s 192.168.100.202/32 -d 192.168.100.0/24 -m multiport --dport 22,80,1433,3306,3389,8080 -j ACCEPT
-I FORWARD -o ppp+ -i eth0 -p tcp -d 192.168.100.202/32 -s 192.168.100.0/24 -m multiport --sport 22,80,1433,3306,3389,8080 -j ACCEPT
-I FORWARD -i ppp+ -o eth0 -p tcp -s 192.168.100.203/32 -d 192.168.100.0/24 -m multiport --dport 22,80,1433,3306,3389,8080 -j ACCEPT
-I FORWARD -o ppp+ -i eth0 -p tcp -d 192.168.100.203/32 -s 192.168.100.0/24 -m multiport --sport 22,80,1433,3306,3389,8080 -j ACCEPT
-I FORWARD -i ppp+ -o eth0 -p tcp -s 192.168.100.204/32 -d 192.168.100.0/24 -m multiport --dport 22,80,1433,3306,3389,8080 -j ACCEPT
-I FORWARD -o ppp+ -i eth0 -p tcp -d 192.168.100.204/32 -s 192.168.100.0/24 -m multiport --sport 22,80,1433,3306,3389,8080 -j ACCEPT
-I FORWARD -i ppp+ -o eth0 -p tcp -s 192.168.100.205/32 -d 192.168.100.0/24 -m multiport --dport 1433,3389 -j ACCEPT
-I FORWARD -o ppp+ -i eth0 -p tcp -d 192.168.100.205/32 -s 192.168.100.0/24 -m multiport --sport 1433,3389 -j ACCEPT
-P FORWARD DROP
COMMIT
--------------------------------------分割线 --------------------------------------
iptables使用范例详解 http://www.linuxidc.com/Linux/2014-03/99159.htm
iptables—包过滤(网络层)防火墙 http://www.linuxidc.com/Linux/2013-08/88423.htm
Linux防火墙iptables详细教程 http://www.linuxidc.com/Linux/2013-07/87045.htm
iptables+L7+Squid实现完善的软件防火墙 http://www.linuxidc.com/Linux/2013-05/84802.htm
iptables的备份、恢复及防火墙脚本的基本使用 http://www.linuxidc.com/Linux/2013-08/88535.htm
Linux下防火墙iptables用法规则详解 http://www.linuxidc.com/Linux/2012-08/67952.htm
--------------------------------------分割线 --------------------------------------
本文永久更新链接地址:http://www.linuxidc.com/Linux/2014-09/107369.htm