iptables能够做什么

Posted 2020-06-30 crazy_thb

前言

在这两篇博文中已经具体分析了iptable的原理和在openwrt里面的实例

http://www.cnblogs.com/tanhangbo/p/4550455.html
http://www.cnblogs.com/tanhangbo/p/4518254.html

可以概括出iptables/Netfilter 这一套系统就是用户空间可控的在内核空间的一套钩子
下面看看iptables究竟能做什么。

NAT

• 使用SNAT功能可以将内网IP转换为公网IP，实现在外部的Ethernet口上面
  • 封包出在post routing上面将内网ip转换为公网ip
  • 封包进在pre routing上面将公网ip转换为内网的ip
  • 注意到Netfilter会标记这个状态，不然回来的包会找不到源头。
• 使用DNAT功能可以实现DMZ主机的功能，实现在外部的Ethernet口上面
  • 封包进在pre routing上面将公网ip转换为内网指定的DMZ主机的ip
  • 封包出去时在post routing上面将内网的数据包发送到对应的源主机。

防火墙

• 可以根据ip、MAC地址、端口、协议来丢弃某些数据包，比如internet上面有人想连接到本机的SSH，那么对外部接口关闭SSH的端口22就可以起到一些作用。

负载均衡

注意到下面的选项：

1. Thismodule matches every \'n\'th packet
2. --every value
3. Match every \'value\' packet
4. [--counter num]
5. Useinternal counter number \'num\'.Defaultis\'0\'.
6. [--start num]
7. Initialize the counter at the number \'num\' insetad of \'0\'.Most between \'0\'and\'value\'-1.
8. [--packet num]
9. Match on \'num\' packet.Most be between \'0\'and\'value\'-1.
11. 来源： http://linux.die.net/man/8/iptables

1. BALANCE
2. This allows you to DNAT connections in a round-robin way over a given range of destination addresses.
3. --to-destination ipaddr-ipaddr
4. Address range to round-robin over.

这里有两个做法不同的例子：
http://www.cnblogs.com/silenceli/p/3569849.html
http://wjw465150.iteye.com/blog/423704

防止DDOS攻击

参考此文：
http://sookk8.blog.51cto.com/455855/321242

日志功能

用户空间日志：

1. ULOG
2. This target provides userspace logging of matching packets.Whenthis target issetfor a rule, the Linux kernel will multicast this packet through a netlink socket.Oneor more userspace processes may then subscribe to various multicast groups and receive the packets.Like LOG,thisis a "non-terminating target", i.e. rule traversal continues at the next rule.

内核日志：

1. LOG
2. Turn on kernel logging of matching packets.Whenthis option issetfor a rule, the Linux kernel will print some information on all matching packets (like most IP header fields) via the kernel log (where it can be read with dmesg or syslogd(8)).Thisis a "non-terminating target", i.e. rule traversal continues at the next rule.Soif you want to LOG the packets you refuse,use two separate rules with the same matching criteria, first using target LOG then DROP (or REJECT).

参考资料：
http://linux.die.net/man/8/iptables

来自为知笔记(Wiz)