Iptables

Iptables

การติดตั้ง Firewall แบบง่ายๆที่สุด (เอามาจาก Newbie for Newbie)

[root@one root]# iptables -t nat -A POSTROUTING -d ! 192.168.1.0/24 -o ppp0 -j MASQUERADE
[root@one root]# iptables -A FORWARD -s 192.168.1.0/24 -j ACCEPT
[root@one root]# iptables -A FORWARD -d 192.168.1.0/24 -j ACCEPT
[root@one root]# iptables -A FORWARD -j DROP
[root@one root]# /etc/init.d/iptables save
Saving current rules to /etc/sysconfig/iptables:      [ OK ]
[root@one root]#

ซึ่งเมื่อเราเปิดดูแฟ้ม iptables จะเป็นดังนี้

[root@one root]# cat /etc/sysconfig/iptables

# Generated by iptables-save v1.2.5 on Sat Sep 28 08:53:22 2002
*nat
:PREROUTING ACCEPT [17:1949]
:POSTROUTING ACCEPT [7:1093]
:OUTPUT ACCEPT [7:1093]
[0:0] -A POSTROUTING -d ! 192.168.1.0/255.255.255.0 -o ppp0 -j MASQUERADE
COMMIT
# Completed on Sat Sep 28 08:53:22 2002
# Generated by iptables-save v1.2.5 on Sat Sep 28 08:53:22 2002
*filter
:INPUT ACCEPT [306:23624]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [252:22214]
[0:0] -A FORWARD -s 192.168.1.0/255.255.255.0 -j ACCEPT
[0:0] -A FORWARD -d 192.168.1.0/255.255.255.0 -j ACCEPT
[0:0] -A FORWARD -j DROP
COMMIT
# Completed on Sat Sep 28 08:53:22 2002

จากนั้นสั่งให้ iptables ทำงานโดย

[root@one root]# /etc/init.d/iptables restart
Flushing all current rules and user defined chains:    [ OK ]
Clearing all current rules and user defined chains:    [ OK ]
Applying iptables firewall rules:             [ OK ]
                              [ OK ]
[root@one root]#
ให้แก้แฟ้ม sysctl.conf โดย

[root@one root]# vi /etc/sysctl.conf

# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) for
# more details.

# Controls IP packet forwarding
net.ipv4.ip_forward = 1       <---  เดิมเท่ากับ 0 (ศุนย์) ให้แก้เป็น 1

# Controls source route verification
net.ipv4.conf.default.rp_filter = 1

# Controls the System Request debugging functionality of the kernel
kernel.sysrq = 0

# Controls whether core dumps will append the PID to the core filename.
# Useful for debugging multi-threaded applications.
kernel.core_uses_pid = 1
 

จากนั้นก็สั่ง restart network ใหม่ดังนี้

[root@one root]# /etc/init.d/network restart
Shutting down interface eth0:               [ OK ]
Shutting down loopback interface:             [ OK ]
Disabling IPv4 packet forwarding:             [ OK ]
Setting network parameters:                [ OK ]
Bringing up loopback interface:              [ OK ]
Bringing up interface eth0:                [ OK ]
[root@rtrckorat root]#