📄 0250simple_firewall.htm
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
>
<html lang="zh-TW">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312" >
<meta name="Author" content="VBird, 鸟哥" >
<meta name="Description" content="利用简单的 iptables 规则来说明防火墙，另外也会提到 NAT 主机这个 IP 分享的咚咚！" >
<title>鸟哥的 Linux 私房菜 -- Linux 防火墙与 NAT 主机</title>
<style type="text/css">
body {
background-color: #D3D3D3;
color: #000000;
background-attachment:fixed ;
}
body,th,td,input,select,textarea,select,checkbox {
font-family: '新细明体', 'Times New Roman', serif;
font-size: 11pt ;
}
a:link {text-decoration: none; color: blue}
a:visited {text-decoration: none; color: blue}
a:active {text-decoration: none; color: blue}
a:hover {text-decoration: underline; color: #ff0000}
table.head1 {width:100%; background-color: #FFCCCC;
border-style:groove;border-width:5px;border-color: #FFCCCC; margin:0;
padding: 5px 5px}
td.head1 {font: 10pt "新细明体", serif; color: #000099; }
td.info1 {font: 11pt "新细明体", serif; color: #000066; text-align:center; width:14%}
td.info2 {font: 11pt "新细明体", serif; color: #000066; text-align:center; width:12%}
*.info21 {font: 11pt "新细明体", serif; color: #000066; }
*.info22 {font: 11pt "新细明体", serif; color: blue ; }
*.info23 {font: 11pt "新细明体", serif; color: green ; }
td.info3 {font: 11pt "新细明体", serif; color: #000066; text-align:justify}
*.text_head0 {font-size:18pt; font-family:'标楷体','Times New Roman','Times', serif; }
*.text_head_en {font-size:18pt; font-family:'Times New Roman','Times', serif; }
*.text_h1 {font: 15pt "新细明体", serif; color: #0000BB; font-weight: bold }
*.text_h2 {font: 13pt "新细明体", serif; color: #0000BB; font-weight: bold }
*.text_import1 {font: 11pt "新细明体", serif; color: #000088; font-weight: bold }
*.text_import2 {font: 11pt "新细明体", serif; color: #000088; font-weight: normal}
*.text_vbird {font: 11pt "新细明体", serif; color: #000088; font-weight: normal;
font-style: italic;}
*.text_history {font: 10pt "新细明体", serif; color: #000066; }
*.text_date {font: 10pt "新细明体", serif; color: #3333FF; }
*.block1 {padding: 10px 20px 10px 25px; text-align:left }
*.block2 {padding: 10px 0px 10px 25px; text-align:left }
table.term2 {width: 350px; background-color: #000000;
border-style:groove;border-width:3px;border-color: #FFCCCC; margin:10px 0px;}
table.term {width: 580px; background-color: #000000;
border-style:groove;border-width:3px;border-color: #FFCCCC; margin:10px 0px;}
td.term {font: 10pt "细明体", Fixedsys, serif; color: #FFFFFF; }
*.term_hd {font: 10pt "细明体", Fixedsys, serif; color: #BBBBBB; }
*.term_note {font: 10pt "细明体", Fixedsys, serif; color: #777777; font-weight: normal }
*.term_note_b {font: 10pt "细明体", Fixedsys, serif; color: #FF77FF; font-weight: bolder }
*.term_command {font: 10pt "细明体", Fixedsys, serif; color: yellow ; font-weight: bolder }
*.term_write {font: 10pt "细明体", Fixedsys, serif; color: yellow ; font-weight: normal }
*.term_say {font: 10pt "细明体", Fixedsys, serif; color: #FF6666; font-weight: normal }
</style>
<script language="JaveScript" type="text/javascript" src="/include/java.js"></script>
</head>
<body style="margin:0; padding:0">
<center>
<!-- 这里是关于页首按钮处的按钮程式 -->
<div style="text-align:center">
<span style="font-weight:bolder; color:#3333FF"><span class="text_head0">鸟哥的<span class="text_head_en">
Linux </span>私房菜</span></span><br />
<span style="color:#000080">为取得较佳浏览结果，请爱用 <a href="http://moztw.org" target="_blank">firefox</a>
浏览本网页</span><br />
<a href="http://linux.vbird.org/" target="_blank"
onmouseover="document.head_icon1.src='../images/icon_VBird_on.jpg'"
onfocus="document.head_icon1.src='../images/icon_VBird_on.jpg'"
onmouseout="document.head_icon1.src='../images/icon_VBird_off.jpg'">
<img alt="前往鸟哥的 Linux 私房菜馆首页" title="前往鸟哥的 Linux 私房菜馆首页" name="head_icon1"
src="../images/icon_VBird_off.jpg" border="0" /></a>
<a target="_blank" href="http://linux.vbird.org/linux_basic"
onmouseover="document.head_icon2.src='../images/icon_basic_on.jpg'"
onfocus="document.head_icon2.src='../images/icon_basic_on.jpg'"
onmouseout="document.head_icon2.src='../images/icon_basic_off.jpg'">
<img src="../images/icon_basic_off.jpg" border="0"
alt="前往 Linux 基础文件，新手请从头学起"
title="前往 Linux 基础文件，新手请从头学起" name="head_icon2" /></a>
<a target="_blank" href="http://linux.vbird.org/linux_server"
onmouseover="document.head_icon3.src='../images/icon_server_on.jpg'"
onfocus="document.head_icon3.src='../images/icon_server_on.jpg'"
onmouseout="document.head_icon3.src='../images/icon_server_off.jpg'">
<img src="../images/icon_server_off.jpg" border="0"
alt="前往 Linux 架站文件，网路基础那章节请务必参考！"
title="前往 Linux 架站文件，网路基础那章节请务必参考！" name="head_icon3" /></a>
<a target="_blank" href="http://linux.vbird.org/linux_security"
onmouseover="document.head_icon4.src='../images/icon_security_on.jpg'"
onfocus="document.head_icon4.src='../images/icon_security_on.jpg'"
onmouseout="document.head_icon4.src='../images/icon_security_off.jpg'">
<img src="../images/icon_security_off.jpg" border="0"
alt="前往『网路安全』相关文件网页" title="前往『网路安全』相关文件网页" name="head_icon4" /></a>
<a href="http://phorum.vbird.org" target="_blank"
onmouseover="document.head_icon5.src='../images/icon_forum_on.jpg'"
onfocus="document.head_icon5.src='../images/icon_forum_on.jpg'"
onmouseout="document.head_icon5.src='../images/icon_forum_off.jpg'">
<img src="../images/icon_forum_off.jpg" border="0"
alt="前往 Linux 新手讨论区，发问前务必查阅发文规则"
title="前往 Linux 新手讨论区，发问前务必查阅发文规则" name="head_icon5" /></a>
<a target="_blank" href="http://linux.vbird.org/adsl"
onmouseover="document.head_icon6.src='../images/icon_adsl_on.jpg'"
onfocus="document.head_icon6.src='../images/icon_adsl_on.jpg'"
onmouseout="document.head_icon6.src='../images/icon_adsl_off.jpg'">
<img src="../images/icon_adsl_off.jpg" border="0"
alt="前往『ADSL连线分享』相关文件网页" title="前往『ADSL连线分享』相关文件网页" name="head_icon6" /></a>
<a href="http://www.study-area.org" target="_blank"
onmouseover="document.head_icon7.src='../images/icon_study-area.jpg'"
onfocus="document.head_icon7.src='../images/icon_study-area.jpg'"
onmouseout="document.head_icon7.src='../images/icon_study-area.jpg'">
<img src="../images/icon_study-area.jpg" border="0"
alt="前往 Study Area 网站" title="前往 Study Area 网站" name="head_icon7" /></a>
<br />
</div>
<table summary="本文内容的排版" style="width:750px;
background-image:url('../images/VBirdLinux.jpg');
background-attachment:fixed;" border="0" cellspacing="0" cellpadding="0">
<tr><td style="width:16px; height:16px; background-image:url('../images/border-top-left.jpg');
font-size:6px"> </td>
<td style="width:718px; height:16px; font-size:6px;
background-image:url('../images/border-top-center.jpg')"> </td>
<td style="width:16px; height:16px; background-image:url('../images/border-top-right.jpg');
font-size:6px"> </td></tr>
<tr><td style="width:16px; font-size:6px;
background-image:url('../images/border-middle-left.jpg')"> </td>
<td width="718">
<!-- 本文的档头部分 -->
<div style="text-align:center">
<a href="0250simple_firewall.php">
<span class="text_head0"><span class="text_head_en">Linux </span>防火墙与<span class="text_head_en"> NAT </span>主机</span></a><br />
</div>
<div style="text-align:left">
<a href="0250simple_firewall.php?thisscreen=800x600"><!--切换解析度为 800x600--></a>
</div>
<div style="text-align:right">
<span class="text_history">最近更新日期∶2006/11/08</span>
</div>
<!-- 本文的档头部分 -->
<table class="head1" summary="排版∶文章档头的说明"><tr><td class="head1">
在谈完了基本的网路安全观念之后，这个章节主要就要针对『防火墙』来进行介绍了！目前的防火墙机制主要是以
Linux Kernel 2.6 版的 iptables 为主的，而 iptables 可以使用指令来下达，也可以透过编写
shell script 来进行指令的整合。鸟哥本人比较习惯使用 scripts 来进行 iptables
的机制规划呢！除了 iptables 之外，事实上，比较简单的还有 TCP Wrappers
这个玩意儿，他则主要是针对某些服务来进行管理的呐！本章的内容主要就是在介绍这两个重要的防火墙软体了！
</td></tr></table><br />
<!-- 本文的连结区部分 -->
<div class=block1>
<span class="text_h1">
1. <a href="#before">本章的行前准备工作</a><br />
2. <a href="#firewall">认识防火墙</a><br />
<span class=text_h2>
2.1 <a href="#firewall_why">为何需要防火墙</a><br />
2.2 <a href="#firewall_type">Linux 系统上防火墙的主要类别</a><br />
2.3 <a href="#firewall_topo">防火墙的一般线路布线与抵挡技巧</a><br />
2.4 <a href="#firewall_limit">防火墙的使用限制</a><br />
</span>
3. <a href="#netfilter">Linux 的封包过滤机制∶ iptables</a><br />
<span class=text_h2>
3.1 <a href="#netfilter_version">不同 Linux 核心版本的防火墙软体</a><br />
3.2 <a href="#netfilter_iptables">iptables 的表格与封包进入流程</a><br />
3.3 <a href="#netfilter_syntax">本机的 iptables 语法</a><br />
<a href="#netfilter_syntax_clean">规则的清除与观察</a><br />
<a href="#netfilter_syntax_policy">定义预设政策 (policy)</a><br />
<a href="#netfilter_syntax_comp">封包的基础比对 IP/netmask I/O 装置</a><br />
<a href="#netfilter_syntax_tcp">TCP, UDP 的规则比对</a><br />
<a href="#netfilter_syntax_state">状态模组∶MAC 与 RELATED</a><br />
<a href="#netfilter_syntax_icmp">ICMP 封包规则的比对</a><br />
3.4 <a href="#netfilter_save">防火墙的记录、回复与测试</a><br />
3.5 <a href="#netfilter_kernel">IPv4 的核心管理功能∶/proc/sys/net/ipv4/*</a><br />
</span>
4. <a href="#local">本机防火墙的一个实例</a><br />
<span class=text_h2>
4.1 <a href="#local_rule">规则草拟</a><br />
4.2 <a href="#local_script">实际设定</a><br />
</span>
5. <a href="#nat">NAT 主机的设定</a><br />
<span class=text_h2>
5.1 <a href="#nat_what">什么是 NAT？ SNAT？ DNAT？</a><br />
5.2 <a href="#nat_ip_share">最阳春 NAT 主机∶ IP 分享功能</a><br />
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -