When DesdeLinux Ndakanga ndingori nemwedzi mishoma yekuzvarwa uye ndakanyora yakanyanya nyore kunzwisisa tutori nezve iptables: iptables enewbies, anoda kuziva, anofarira (chikamu chekutanga) . Ndichishandisa madimikira akadai sekuenzanisa komputa yedu neimba yedu, yedu yekudzivirira moto nemusuwo wemba, pamwe nemimwe mienzaniso, ndakatsanangura nenzira yekuvaraidza, pasina hunyanzvi hwakawanda kana pfungwa dzakaomarara, chii chinonzi firewall, chii iptables uye kuti ungatanga kuishandisa sei uye gadzirisa. Uku ndiko kuenderera, chikamu chechipiri cheakadarika iptables dzidziso 🙂
Zvinoitika kuti mazuva mashoma apfuura ndichishandisa Linksys AP (Access Point) ndakaisa Wifi kumba kwemusikana wangu, kunyangwe nzvimbo yacho isiri iyo inozivikanwa zvakanyanya maererano nehunyanzvi, ndiko kuti, hazvisi zvekuti kune njodzi zhinji dzekupaza, zvinogara Pfungwa yakanaka kuve neyakachengeteka kwazvo zvese muWifi uye mumakomputa.
Ini handizotaure nezvekuchengetedzwa kweWi-Fi pano, sezvo isiri iyo chinangwa cheiyo posvo, ini ndichatarisa pane iptables kumisikidza iyo yandinoshandisa parizvino palaptop yangu.
Mune yapfuura posvo ini ndanga ndatsanangura kuti zvakafanira mu firewall kutanga kuramba zvese zvinouya traffic, yeizvi:
sudo iptables -P INPUT DROP
Ipapo isu tinofanirwa kubvumira yedu komputa kuve nemvumo yekupinda data:
sudo iptables -A INPUT -i lo -j ACCEPT
Zvakare nekugamuchira mapakeji ezvikumbiro zvinotangira kubva kumakomputa edu:
sudo iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
Parizvino komputa yedu inogona kufamba neinternet isina matambudziko, asi hapana munhu anobva kune imwe nharaunda (LAN, internet, Wifi, nezvimwewo) anozokwanisa kuwana komputa yedu neimwe nzira. Tichatanga kumisikidza iptables zvinoenderana nezvatinoda.
Uchishandisa ulogd kuburitsa mateti eptables kune imwe faira:
Nokusingaperi iyo iptables matanda anoenda mune kernel log, iyo system log, kana chimwe chinhu chakadai ... muArch nekumira, izvozvi ini handitombo rangarira kwavanoenda, ndosaka ndichishandisa ulogd kuitira kuti iptables matanda ari mune imwe faira.
sudo iptables -A INPUT -p tcp -m tcp --tcp-flags FIN,SYN,RST,ACK SYN -j ULOG
Kupa mukana kune yangu yakavanzika server:
Ini handishandise VirtualBox kana chero chinhu chakafanana nekugadzirisa, ini ndine yangu yakavanzika server yakagadzirirwa ne Qemu + KVM iyo inofanirwa kukwanisa kubatanidza kune yangu laputopu saizvozvo, nemitemo ye iptables iyo yandangodoma pamusoro apa haizokwanisi, ndosaka ndichifanira kupa mvumo kune iyo IP ye server yangu chaiyo kuti ikwanise kuwana yangu laptop:
sudo iptables -A INPUT -i virbr0 -p tcp -s 192.168.122.88 -j ACCEPT
Tiri kuenda kujekesa uyu mutsetse, zvakakosha kuti unzwisise zvinoreva paramende imwe neimwe, nekuti zvichadzokororwa zvakawanda kubva zvino zvichienda mberi:
-I CHIITI : Ndiri kuti ndiri kuenda kunozivisa mutemo weinbound traffic
-ini virbr0 : Ini ndinozivisa kuti iyo interface yandinozobvuma traffic haisi etho (LAN) kana wlan0 (Wifi), ndinonyatsotaura kuti ndiyo yangu virbr0 interface, ndiko kuti, iyo chaiyo network network (yemukati) kuburikidza iyo yangu laptop inotaurirana nayo yangu chaiyo server (uye zvinopesana)
-p tcp : Ini ndinodoma protocol, yakanyanya kushandiswa iUDP neTCP, apa zvanga zvakaringana kusaisa izvi asi ... itsika kutsanangura rudzi rweprotocol kutambira
-s 192.168.122.88 Iyo sosi, sosi yemapakeji. Mune mamwe mazwi, mutemo unoreva mapakeji anouya chaizvo kubva kuIP 192.168.122.88
-j Bvuma : Tatova pano ndinotaura zvandiri kuda kuita nemapakeji anoenderana nezviri pamusoro, mune iyi nyaya gamuchira.
Mune mamwe mazwi, sekupfupisa, ndiri kuenda kunogamuchira mapaketi anouya kubva kuIP 192.168.122.88, asi kana iwe uchida kuisa mapakeji anobva kune iyo IP BUT! Ivo vanopinda kubva kune interface isiri virbr0, ndiko kuti, ngatiti ivo vanoedza kuisa mapaketi kubva kuIP 192.168.122.88 asi ivo vanobva kukombuta mune yedu Wifi network, kana zvirizvo, mapakeji acharambwa. sei? Nekuti isu tinonyatsotsanangura kuti hongu, tinogamuchira mapaketi kubva 192.168.122.88 hongu, asi uye chete asi, ivo vanofanirwawo kupinda kubva ku virbr0 interface (yemukati, yeinetiweki network interface), kana mapaketi anobva kune imwe interface (LAN, RAS, Wifi, nezvimwewo) ipapo hazvigamuchire. Nekutsanangudza iyo interface sezvaungaona tinogona kudzikamisa zvakanyanya, isu tinogona kuve neiri nani kutonga pane izvo zvinopinda (kana zvisingapinde) komputa yedu.
Kugamuchira ping kubva kune chero IP yemumba Wifi
Kubva kune imwe komputa inobatana neWifi, kana iwe ukaedza kubaya laptop yangu ndinoda kuitendera. chikonzero? Pfungwa iyi zvakare ndeyekuti mumavhiki mashoma anotevera kubatanidza PC iri padyo nepedyo kunetiweki, saka kugovana ruzivo kunenge kusinganetsi, kuwanda kwemvura, pandinotanga kuita bvunzo yekubatanidza iyo desktop kune iyo Wifi, ini ndichafanirwa kubaya yangu Laptop kutarisa kubatana, kana laptop yangu ikasandibatirira kumashure ndinogona kufunga kuti AP iri kukundikana, kana kuti pakanga paine kukanganisa kuwana iyo Wifi, ndosaka ndichida kubvumidza iyo ping.
sudo iptables -A INPUT -i wlo1 -p icmp -s 192.168.1.0/24 -d 192.168.1.51 -j ACCEPT
-I CHIITI : Zvakafanana nepakutanga, ndinoreva kune irikuuya traffic
-ini wlo1 : Zvakafanana nepakutanga. Mune yakapfuura kesi ndakadoma iwo chaiwo interface, mune ino kesi ini ndinodoma imwe interface, iya yeangu wifi: wlo1
-p icmp : Icmp protocol, icmp = ping. Ndokunge, ini handisi kubvumira SSH kana chero chinhu chakafanana, ini ndinongobvumira ping (icmp)
-s 192.168.1.0/24 : Kwayakabva mapakeji, ndiko kuti, sekureba sekunge mapaketi acho abva kune IP 192.168.1.? ichagamuchirwa
-d 192.168.1.51 : Kuenda IP, ndiko kuti, yangu IP.
-j Bvuma : Ini ndinoratidza zvekuita nemapakeji anoenderana nezviri pamusoro, gamuchira.
Ndokunge, uye kutsanangura izvi nenzira inomhanya, ndinobvuma kuti vanondibaya (icmp protocol) vane kwavanoenda iri IP yangu, chero bedzi vachiuya kubva kuIP senge 192.168.1 .__ asi zvakare, havagone kubva kune chero network interface , ivo vanofanirwa kupinda zvakananga kubva kune yangu Wifi network interface (wlo1)
Gamuchira SSH chete kune imwe IP:
Dzimwe nguva ndinofanira kubatana ne SSH kubva ku-smartphone yangu kudzora laptop, ndosaka ndichifanira kubvumidza SSH kupinda palaptop yangu kubva kuIPs yeWifi yangu, yeichi:
sudo iptables -A INPUT -i wlo1 -p tcp -s 192.168.1.0/24 -d 192.168.1.51 --dport 22 -j ACCEPT
Kubva pamutsetse uyu chinhu chega chakasiyana kana chinokodzera kusimbiswa ndechekuti: –Tumira makumi masere (SSH chiteshi ini chandinoshandisa)
Mune mamwe mazwi, ndinogamuchira kuyedza kubatanidza kune yangu laptop kuburikidza nechiteshi chengarava 22, chero bedzi vachiuya kubva kuIP yewifi yangu, ivo vanofanirwawo kuve neIP yangu senzvimbo yekuenda uyezve vanouya kuburikidza neiyo wlo1 interface, ndokuti, iyo yewifi yangu (kwete iyo lan, nezvimwewo)
Kuvabvumira kuona yako webhusaiti:
Haisi nyaya yangu, asi kana mumwe wenyu aine webhusaiti yakachengetwa uye asingade kuramba chero ani, ndiko kuti, kuti munhu wese kubva chero kupi anogona kuwana iyo webhusaiti, zviri nyore kupfuura zvaungafunge.
sudo iptables -A INPUT -p tcp --dport 80 -j ACCEPT
Mune mamwe mazwi, pano ivo vari kubvumidza ese ari kuuya traffic (tcp) kuburikidza nechiteshi 80. Sezvauri kuona, ini handitaure kubva kune IPs kana network zvandinobvumira kupinda, nekusaudza IP renji kubvumidza, iptables inofunga kuti ini ndoda kubvumidza kupinda ese aripo IP maseru, ndiko kuti, kupasirese 🙂
Dzimwe mubatanidzwa:
Ndine mimwe mimwe mitemo yakadai sekuti, semuenzaniso, gamuchira ping yeIPs kubva kumba kwangu LAN (yeiyi iri mutsetse wakafanana neiri pamusoro, ichichinja mitsara yeIP), inova yakafanana yakafanana neyandakangotsanangudza pamusoro ... Laptop seakadaro handishandisi zvinhu zvakaomarara, izvo zvekutadzisa kubatana, anti DDoS, ndinoisiya iyo kumaseva, palaptop yangu ini handidi iyo not
Zvisinei, kusvika zvino chinyorwa.
Sezvauri kuona, kushanda nema iptables hakusi kwakaomarara nenzira dzipi nedzipi, kana iwe uchinge wavaka script iyo iwe yaunonyora yako mitemo zviri nyore kwazvo wobva waigadzirisa, wedzera kana kubvisa mitemo kune yako firewall.
Ini handizvione senge nyanzvi panyaya iyi, kure nazvo, kunyangwe paine mibvunzo iwe yaungave unayo, vanotaura pano, ndichaedza kukubatsira zvakanyanya sezvandinogona.
Reply with quote
Yakanaka kwazvo, yakanyatsotsanangurwa, yakanaka.
Ini ndinoda iyi mhando yepositi.
Ndatenda zvikuru nekupindura 🙂
Iyi posvo yaive chikwereti chandakanga ndiinacho kwenguva yakareba, zvinonakidza uye zvinofadza pakupedzisira kukwanisa kuribhadhara ^ _ ^
Reply with quote
mubvunzo uri muCuba here?
… Zvinoitika kuti mazuva mashoma apfuura ndichishandisa Linksys AP (Access Point) ndakaisa Wifi kumba kwemusikana wangu
Hongu hongu, ndakazvarwa uye ndinogara kuCuba. sei mubvunzo?
@FIXOCONN: Mhoro shamwari uye kanganwira musoro wenyaya wemubvunzo, asi unotsanangura sei Cinnamon kuti iite senzvimbo yedesktop mune mushandisi-mumiriri? Ini ndinoshandisa Mint 13 neCinnamon, asi hapana nzira yandinowana iyo Cinnamon logo kuti ioneke mumushandisi-mumiririri wangu pese pandinotaura pane ino saiti.
Ungave une moyo munyoro here kuti undipfuure yako yemushandisi mumiririri ruzivo kana isiri rakawanda dambudziko? Ndinoda kuziva iyo data kuti ndiise pacharo =)
Ini ndinokusiira peji kuti iwe ugone kuriongorora uye undipe iyo ruzivo. Kutenda uye maAdmin, regerera iyo "trolling" (kana uchikwanisa kuidana izvo) kune ini neruzivo urwu -> http://user-agent-string.info/
Wedzera "Cinnamon" (isina makotesheni) kune chero chikamu cheMushandisiAgent, ipapo logo yacho inofanirwa kuoneka mune zvakataurwa zvinotevera.
Yakanaka kwazvo iyo posvo! zvakajeka 😀
Ndatenda nekuverenga uye ndatenda nekutaura kwako 🙂
Ndatenda! Zvinondibatsira chaizvo!
Mhoroi, kutanga kune vese makorokoto eblog, ini ndinofunga zvakanaka
Chinhu chingave chakanaka kutaura nezvacho ndechekuti sarudzo yekupinda neULOG haishande mune anoshanda masisitimu ane ulogd2, kune iyi kesi mutemo unofanirwa kuve:
sudo iptables -A INPUT -p tcp -m tcp -tcp-mireza FIN, SYN, RST, ACK SYN -j NFLOG
Chekutanga pane zvese, ndinokutendai zvikuru nezvamunotaura nezve blog 🙂
Ndine ulogd v2.0.2-2 yakaiswa muArch, uye mutsetse wandinoisa unoshanda pasina matambudziko (ndaifanira kuisa loglevel = 1 mu /etc/ulogd.conf, asi zvinotora matanda kune rimwe faira pasina matambudziko.
Uri kushandisa ulogd v2 kana yakakwira, mutsara wandakasiira basa hauna kunaka kwauri here?
Zvekutenda nekutenda nekupindura.
Ini ndanga ndichigara ndakamirira chikamu chechipiri, ndinorangarira pandakaverenga yekutanga (kwaive kutanga kwangu mumoto wemoto). Thanks @ KZKG ^ Gaara, nezve reg
Ndatenda nekundiverengera 😀
Uye hehe hongu, zvandataura ... iyi posvo yaive chikwereti chandakanga ndiine nguva refu yapfuura ^ _ ^
Zvido. Yakanaka kwazvo iyo posvo. Ndiri kuyedza kumisikidza iptables mitemo yekudzoreredza traffic kubva ku squid kuenda ku dansguardian uye zvakadaro haizadzise chinangwa. Ndingafarire rubatsiro mune izvi.
iptables yeiyo? Izvo hazvisi izvo zvakaitwa zvakananga nemaACLs muSquid?
"Ndine mimwe mitemo yakawanda yakaita .."
Izvi ndizvo zvandinoti paranoia, mukomana
Zvishoma uye iwe unoisa pakiti yeRotwailer mune yega yega yakavhurika modem yako / router 🙂
HAHAHAHAHAHAHAHAHA Ndiri kufa nekuseka pamwe neve rottwailers hahahaha
Kwaziso shamwari, zvinoitika kuti ini ndoda rubatsiro kumisikidza IPTables kuitira kuti irambe kupinda chete kwechiteshi 80 pandinonyora kero mubrowser reyangu tsika nameservers, ndiko kana semuenzaniso ini ndichinyora ns1.mydomain.com uye ns2.mydomain com (anova mazita angu) IPtables anoramba kupinda kuchiteshi 80 kuitira kuti bhurawuza riedze kurodha peji asi mushure mechinguva rinopera uye haritakure, zvinoitika kuti ini ndatoedza nemirairo yakadai.
iptables -A INPUT -d ns1.midomini.com -p tcp -dport 80 -j DROP
iptables -A INPUT -d ns2.midomini.com -p tcp -dport 80 -j DROP
Asi chinhu choga chazvinoita kuramba kupinda kuchiteshi 80 munzvimbo dzangu dzese (sezvo ivo vachigovana iyo imwechete IP seVirtual Host), ini ndinoda kuti ive chete muiyo url yemazita angu mazita uye iyo IP kune ayo nameservers inonongedza, ndokuti, IP matafura anoramba kupinda kwechiteshi 80 mu:
ns1.midomini.com (Kunongedza A) -> 102.887.23.33
ns2.midomini.com (Kunongedza A) -> 102.887.23.34
uye iyo IPs iyo iyo nameservers inonongedza
102.887.23.33
102.887.23.34
Muenzaniso wekambani ine ino system ndeiyi: Dreamhost
Mazita avo mazita: ns1.dreamhost.com uye ns2.dreamhost.com uye maIPs avanonongedzera kuti havapindure kana vanyorwa mubhu rekero rebrowser.
Ndatenda kwazvo pamberi pekutarisa kwako, ndingade kwazvo kuti undipe ruoko neizvi, ndinonyatsoida uye nekukurumidza !!
Zuva rakanaka !!
Mhoro Ivan,
Ndibatei neemail (kzkggaara[at]desdelinux[dot]net) kutaura nezvazvo wakadzikama nekutsanangura zvirinani, mangwana pasina kukundikana ndichakupindura (nhasi ndiri kupfuura)
Izvo iwe zvaunoda kuita zviri nyore, ini handizive kuti nei mitsara iwe yaunondiudza isingashande iwe, inofanirwa, asi iwe unofanirwa kutarisa matanda uye zvimwe zvinhu zvingave zvakareba kureba kutenderedza pano.
Kwaziso uye ndinomirira yako email
fungidziro nema iptables ini ndinogona kudzivirira kutumirwa kunonoka kukumbira kubva kuzvirongwa senge aircrack. Ndiri right ??? Zvakanaka ndichaita bvunzo asi kana iwe ukandiudza izvo iwe ungandifadza kwazvo XDDD
Pfungwa ndinofunga kudaro, ikozvino, handizive kuti zvingaitwe sei, handisati ndambozviita ... asi ndinodzokorora, nepfungwa, ndinofunga zvaigona.
Mushure mekushandisa iyo iptables mitemo, hazviite kuti ini ndiwane akagovaniswa windows maforodha pane yemuno network. Ndeupi mutemo wandinofanira kushandisa kuti ndigadzirise?
Ndinokutendai.
Ndeapi iptables mitemo yawakashandisa?
Ichi chikamu chechipiri che "iptables ye newbies", wakaverenga yekutanga here? Ini ndinobvunza izvi kuti uzive kana iwe wakashandisa iyo mirawo yaive mune yapfuura posvo
Ehe, ndakaverenga ese mativi. Zve script ini ndinozvitsigira pane imwe posvo iwe yawakatumira nezve kutanga mitemo ne systemd.
#! / bin / bash
# - UTF 8 -
# Iptables binary
iptables = »/ usr / bin / iptables»
wakanda kunze ""
# # Yakachena matafura ##
$ iptables -F
$ iptables -X
$ iptables -Z
#echo »- Yakagadzirwa FLUS kune iptables» && echo »»
# # Kugadzira matanda neUOGOG # #
$ iptables -A INPUT -p tcp -m tcp -tcp-mireza FIN, SYN, RST, ACK SYN -j ULOG
# # Tsanangura default DROP mutemo ##
$ iptables -P INPUT DROP
$ iptables -P PAMUSORO DROP
#echo »- DROP mutemo unotsanangurwa nekumisikidza» && echo »»
# # Bvumira zvese kune localhost ##
$ iptables -A INPUT -i lo -j Bvuma
$ iptables -A CHITSAUKO -o lo -j Bvuma
#echo »- Zvese zvinotenderwa zvemunohost & && echo» »
## Bvumidza kuisa mapakeji ekubatanidza andinotanga ##
$ iptables -A INPUT -m mamiriro -state YAKASIMBISWA, RELATED -j Bvuma
#echo »- Inobvumidzwa mapaketi ekubatanidza anotangwa neyangu» && echo »»
akarasa kunze "# # # # # # # # # # # # # # # # # # # # # # # # # #
echo »## IPTABLES YAKASANGANISWA OK! ## »
akarasa kunze "# # # # # # # # # # # # # # # # # # # # # # # # # #
Ndakaverenga pane internet kuti kune samba iwe unofanirwa kuve nemitemo inotevera mune script:
$ iptables -A INPUT -p tcp -port 139 -j Bvuma
$ iptables -A INPUT -p tcp -port 445 -j Bvuma
$ iptables -A INPUT -p udp -sport 137 -j Bvuma
$ iptables -A INPUT -p udp -port 137 -j Bvuma
$ iptables -A INPUT -p udp -port 138 -j Bvuma
Nekudaro, kana kunyangwe navo handisi kuona windows mapoka eboka. : S
Dambudziko rakagadziriswa. Chinja iro boka rebasa uye mauto anotendera paramende mune iyo samba yekumisikidza faira.
Yakanaka chinyorwa, zvakangonaka !!!!
Ini ndinongo verenga uye ini ndinoda zvese nzira yaunotsanangudza nayo uye nekushandisa chaiko kushandiswa kwe iptables, ini ndingade chaizvo kudzidza kudzidza kuishandisa zvakadzama.
Kwaziso uye chakanakisa chinyorwa, ndinotarisira kuti uchaburitsa zvakawanda nezveIptable! ^^
Anodiwa;
Ndine proxy ine iptables uye imwe yemambure angu haigone ping http://www.google.cl nekuda kweichi chikonzero ini ndine madoko akavharirwa uye ndichiedza chiuru nzira dzekuvhura zviteshi uye hapana chinoitika. Kana ndisingakwanise ping handikwanise kubatanidza maonero
Makorokoto pane iyo posvo! Kugona chose. Asi ini ndine mubvunzo. Dzimwe nguva iyo IP kero iyo iwe yaunopihwa iwe mu network inogona kuchinja (kana ichokwadi kuti tinogona kupa IP kune yedu MAC Addres), asi pane mukana here neIptables kubvumidza kupinda kune server yedu kuburikidza neSSH neMAC Kero?
Ndinovimba ndazvitsanangura mushe.
Regards, uye ndinokutendai zvikuru!
Mhoroi, iwe unoziva ini ndaive ne linux server yakagadzirirwa uye mushure mekuisa iyi mirairo ndakavharira zvese ndikatadza kuwana, ndinogona kupora chero zvese asi ini ndiri kushaya zvinhu zviviri * Ini handichakwanise kuwana kubva pawebhusaiti kuburikidza nezita rekuti «server» kana neip, 2 uye kune rimwe divi ini handione zviwanikwa zvakagovaniswa kubva kumahwindo ekutsvagisa pane network, ndisati ndaisa \\ server ndikaona zvese vakagovana zviwanikwa. Ndinovimba munogona kundibatsira, ndinoziva kupusa asi handisi kukwanisa kuzvigadzirisa, ndatenda
Ini ndinodudza mazwi.
'
Icmp protocol, icmp = ping. Ndokunge, ini handisi kubvumira SSH kana chero chinhu chakafanana, ini ndinongobvumira ping (icmp)
'
ICMP nePING hazvina kufanana. Pinging chikamu cheiyo ICMP protocol, asi hazvisi zvese. Iyo ICMP (Internet Control Message Protocol) protocol ine zvimwe zvakawanda zvinoshandiswa, zvimwe zvacho zvine dzimwe njodzi. Uye urikutambira traffic yese yeICMP. Iwe unotofanira kudzora chete kune ping.
Kwaziso!
Ini ndinofanira kuita internship asi ini handinzwisise zvakawanda nezve iptables, unogona iwe ndokumbirawo undibatsire….
ndatenda!!!!!!!