在Ubuntu Server 10.10上简单配置iptables

系统 Linux
本文介绍了如何在Linux上简单架设防火墙路由器。操作基于Ubuntu Server 10.10,配置iptables.ip转换.mac的过滤功能。iptables是Linux上最常使用的防火墙工具。一共就七个步骤,很适合新手一步一步跟着学习。

操作基于ubuntu server10.10 上进行安装配置.进行配置iptables.ip转换.mac过滤功能.

1.建iptables

root@ptubuntufirewall:/# vi /etc/init.d/iptables

#fLUSH THE FILTER,NAT,Mangle chain! /sbin/iptables -F -t filter /sbin/iptables -F -t nat /sbin/iptables -F -t mangle
#Flush the user's chain /sbin/iptables -t filter -X /sbin/iptables -t nat -X /sbin/iptables -t mangle -X #Set default policies to DROP /sbin/iptables -P INPUT ACCEPT /sbin/iptables -P OUTPUT ACCEPT /sbin/iptables -P FORWARD ACCEPT #LAN NAT /sbin/iptables -A POSTROUTING -t nat -s 192.168.0.0/255.255.255.0 -o eth1 -j MASQUERADE #/sbin/iptables -A POSTROUTING -t nat -s 192.168.0.0/255.255.255.0 -o eth0 -j MASQUERADE if [ -f /etc/access_mac.conf ] then for i in `cat /etc/access_mac.conf | grep "^[^#]" | tr -s "[12]" | cut -c1-17` ; do /sbin/iptables -A FORWARD -m mac --mac-source $i -i eth0 -j ACCEPT done fi /sbin/iptables -A FORWARD -i eth0 -j DROP

#VNC View Ptubuntu 这下面两条指:访问外网ip可以转换到内网ip:端口

/sbin/iptables -A PREROUTING -t nat -p tcp -m tcp -i eth1 --dport 5888 -j DNAT --to-destination 192.168.0.110:5888 /sbin/iptables -A PREROUTING -t nat -p tcp -m tcp -i eth1 --dport 5988 -j DNAT --to-destination 192.168.0.110:5988
2.设置要过虑的网卡:access_mac.conf
 
root@ptubuntufirewall:/#vi /etc/access_mac.conf
#MAC address            Employee Name OR SERVER Name
#Server Netcard Mac Address
00:e0:4c:39:00:00       System Server eth0
00:e0:4c:39:00:00       System Server eth1
00:e0:4c:39:00:00      ptubuntu Server eth0 在这里添加你需要上网的网卡mac地址
3.sysctl设置参数.能用sysctl来设置或重新设置连网功能,如IP转发、IP碎片去除及源路由检查等
root@ptubuntufirewall:/# cat /etc/sysctl.conf
net.ipv4.ip_forward=1 #把0改为1就可以了
4.设置让它自动启动iptables.

root@ptubuntufirewall:/# update-rc.d iptables defaults 99

显示如下表示成功.

update-rc.d: warning: /etc/init.d/iptables missing LSB information
update-rc.d: see <http://wiki.debian.org/LSBInitScripts>
Adding system startup for /etc/init.d/iptables …
/etc/rc0.d/K99iptables -> ../init.d/iptables
/etc/rc1.d/K99iptables -> ../init.d/iptables
/etc/rc6.d/K99iptables -> ../init.d/iptables
/etc/rc2.d/S99iptables -> ../init.d/iptables
/etc/rc3.d/S99iptables -> ../init.d/iptables
/etc/rc4.d/S99iptables -> ../init.d/iptables
/etc/rc5.d/S99iptables -> ../init.d/iptables
5.还需要安装dhcp服务器.
root@ptubuntufirewall:/#aptitude install dhcp3-server
root@ptubuntufirewall:/#vi /etc/dhcp3/dhcpd.conf
文档内容:
option domain-name “ptubuntufirewall.com”;
option domain-name-servers 8.8.4.4, 8.8.8.8;
default-lease-time 18000;
max-lease-time 36000;
subnet 192.168.0.0 netmask 255.255.255.0 {
range dynamic-bootp 192.168.0.100 192.168.0.255;
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.0.255;
option routers 192.168.0.252;
option time-offset -18000;
}

完后需要重启计算机才可以使用.

6.测试:ping

root@ptubuntufirewall:/# ping 192.168.0.252
root@ptubuntufirewall:/#ping 8.8.8.8外网IP都可以正常.

7.设置客户端.

现在就可以自动获取ip地址.如果你需要手动设置IP那么你的默认网关就是你路由的IP地址.192.168.0.252

via{http://www.ptubuntu.com/2011/01/4076.html}

【编辑推荐】

  1. Linux安全性和netfilter/iptables
  2. Iptables作网关时一种简单的NAT使用方式
  3. 自动分析黑名单及白名单的iptables脚本
责任编辑:yangsai 来源: ptubuntu.com
相关推荐

2011-09-07 13:33:51

ubuntuUbuntu Twea

2011-03-17 15:44:21

2010-11-18 09:40:08

2010-12-15 13:48:01

Ubuntu 10.1JDKEclipse

2018-04-03 13:31:53

LinuxUbuntu 16.0msmtp

2017-08-09 13:13:25

LinuxUbuntuZabbix

2011-08-29 15:52:12

2011-08-30 15:53:07

Ubuntussh

2011-09-07 14:01:34

ubuntuPHP

2011-05-24 09:33:40

UbuntuOpenStackNova

2011-03-15 16:12:45

iptablesRed Hat

2011-09-02 17:12:42

UbuntuGNOME 3

2011-05-23 17:21:38

Ubuntu 10.1Unity 2D

2011-09-02 15:31:00

ubuntu路由器路由

2011-09-06 11:11:29

ubuntu3D效果

2015-09-06 09:55:51

UbuntuHHVM

2010-08-12 15:41:12

MySQL集群

2011-03-10 10:09:13

Ubuntu搭建LAMP

2011-01-10 10:29:27

Ubuntu 10.1Gnome-Shell

2011-03-10 11:06:02

Ubuntu搭建LAMP
点赞
收藏

51CTO技术栈公众号