在ubuntu server配置iptables防火墙（在Ubuntu服务器配置iptables防火墙）.doc

在ubuntu server配置iptables防火墙（在Ubuntu服务器配置iptables防火墙） Iptables is a default firewall installed on Ubuntu Server. In the normal Ubuntu installation process, iptables is installed, but it defaults to allowing all traffic (regardless of whether the firewall is invalid) Theres a lot of valuable information about iptables, but most of them are very complicated. If you want to do some basic configuration, the How To below fits you well. The basic commands Type: # iptables -L List the rules in your current iptables. If you have just created your server, then there may be no rules at this point, and you should see the following: Chain INPUT (policy ACCEPT) Target, prot, opt, source, destination Chain FORWARD (policy ACCEPT) Target, prot, opt, source, destination Chain OUTPUT (policy ACCEPT) Target, prot, opt, source, destination Allow the establishment of a session We can allow the establishment of sessions to accept traffic: Iptables -A INPUT -m state # --state ESTABLISHED, RELATED -j ACCEPT In the designated port to allow incoming traffic By blocking all traffic, you can also start the system, but you may be working through SSH, all of which need to allow SSH traffic before you block other traffic. To allow traffic on the 22 port number (the default SSH port), you can tell iptables to allow your network card to accept all of the TCP traffic at the destination port of 22. -A INPUT -p TCP # iptables -i eth0 --dport SSH -j ACCEPT In particular, this will append the (-A) INPUT rule to all the traffic in the table that allows the destination port number SSH to enter the interface (-i) eth0 so that the iptables completes the jump (-j) or action: ACCEPT Lets check these rules: (there are only a few lines shown here, and you should see more) # iptables -L Chain INPUT (policy ACCEPT) Target, prot, opt, source, destination ACCEPT all - anywhere, anywhere, state, RELATED, ESTABLISHED ACCEPT TCP - anywhere, anywhere, TCP, dpt:ssh Now, lets allow all web traffic Iptables -A INPUT -p TC