iptables

 

리눅스 패킷 필터링 도구

설치 시 :
dnf install -y iptables-services

적용 시 :
vi /etc/sysconfig/iptables
service iptables restart 
(이래야 iptables 에 주석한 내용이 풀리지 않음, iptables-save 사용X)

예시 : 

*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:TESTFILTER - [0:0]

-A INPUT -j TESTFILTER
-A FORWARD -j TESTFILTER
-A TESTFILTER -i lo -j ACCEPT

# DNS Port
-A TESTFILTER -p udp --sport 53 -j ACCEPT

# SYSLOG
-A TESTFILTER -p udp -m udp -s [SYSLOG서버IP]/32 --sport 514 -j ACCEPT

# Ping Port
-A TESTFILTER -p icmp --icmp-type 8 -j ACCEPT
-A TESTFILTER -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT

# Time
-A TESTFILTER -p udp -s [NTP서버아이피]/32 --dport 123 -j ACCEPT
-A TESTFILTER -p udp -s [NTP서버아이피]/32 --sport 123 -j ACCEPT
-A TESTFILTER -p udp -s [NTP서버아이피]/32 --dport 323 -j ACCEPT
-A TESTFILTER -p udp -s [NTP서버아이피]/32 --sport 323 -j ACCEPT

# nagios log SVR
-A TESTFILTER -p tcp -m multiport -s [NGLOG서버IP]/32 --sport 5544,5444,5144,5546,5547 -j ACCEPT
-A TESTFILTER -p tcp -m multiport -s [NGLOG서버IP]/32 --dport 5544,5444,5144,5546,5547 -j ACCEPT

COMMIT