iptables 관련
Describe iptables 관련 자료 here
- 체인 생성 (-N).
- 체인 제거 (-X).
- 체인 정책 변경 (-P)
- 체인 규칙 나열 (-L)
- 체인 규칙들 삭제 (-F)
- 체인 규칙 패킷과 바이트 카운드 0 (-Z)
세부 내용
- 127.0.0.1 은 'loopback' 인터페이스
- 테스트에 유용
byoungguk@linuxtip:~$ ping -c 1 127.0.0.1 PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data. 64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.040 ms --- 127.0.0.1 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 0.040/0.040/0.040/0.000 ms
[root@localhost ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
- ping 막기
[root@localhost ~]# iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP [root@localhost ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination DROP icmp -- 127.0.0.1 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@localhost ~]# ping -c 1 127.0.0.1 PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data. --- 127.0.0.1 ping statistics --- 1 packets transmitted, 0 received, 100% packet loss, time 0ms
- 규칙 제거
[root@localhost ~]# iptables -D INPUT 1 [root@localhost ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
[root@localhost ~]# iptables -D INPUT -s 127.0.0.1 -p icmp -j DROP [root@localhost ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
- 옵션
'-s', '--source', '--src'
'-d', '--destination', '--dst'
'-s ! localhost' => localhost 로 부터 오는 패킷 아닌 경우
'-p ! TCP'
'-i'('--in-interface')와 '-o'('--out-interface')
- 체인 생성
[root@localhost ~]# iptables -N byoungguk [root@localhost ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination Chain byoungguk (0 references) target prot opt source destination
- 체인 삭제
[root@localhost ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
- 체인 세부 내용 비우기
[root@localhost ~]# iptables -F FORWARD
- 모든 체인 내용 비우기
[root@localhost ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination DROP icmp -- 127.0.0.1 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination DROP icmp -- 127.0.0.1 0.0.0.0/0 Chain OUTPUT (policy ACCEPT) target prot opt source destination DROP icmp -- 127.0.0.1 0.0.0.0/0 [root@localhost ~]# iptables -F [root@localhost ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
|
댓글을 작성하시려면 로그인이 필요합니다.