企业防火墙之iptables

1.1 企业中安全优化配置原则

1.1.1 生产中iptables的实际应用

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">主要应用方向

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">其他说明：

 ①iptables是基于内核的防火墙，功能非常强大，基于数据包的过滤！特别是可以在一台非常低的硬件配置下跑的非常好。

**_　　注：_**iptables主要工作在OSI七层的2.3.4层。七层的控制可以使用squid代理+iptables。

②iptabes：生产中根据具体情况，一般，内网关闭，外网打开。大并发的情况不能开iptables，影响性能，iptables是要消耗CPU的，所以大并发的情况下，我们使用硬件防火墙的各方面做的很仔细。selinux：生产中也是关闭的。可以做ids的入侵检测。

③实际生产中尽可能不给服务器配置外网IP。可以通过代理转发。比如，nagios就不需要外网。

④并发不是很大的情况下，再外网的IP环境，开防火墙。

⑤第一次直接默认规则生成配置文件，以后就在配置文件中进行修改（编辑添加删除）。

⑥封掉IP：根据IP地址和网络连接数进行封杀。（定时任务，定时封掉，判断，存在就不再进行二次封杀）

1.1.2 企业常用案例功能小结：

1.2 iptables防火墙简介

   iptables是linux2.4及2.6内核中集成的服务，其功能与安全性比其老一蜚ipfwadm，ipchains 强大的多，iptables主要工作在0SI七层的二、三、四层，如果重新编译内核，iptables也可以支持 7 层控制（squid代理+iptables）。

1.2.1 iptables名词和术语

1.2.2 什么是容器

1.2.3 什么是 Netfilter/iptables ?

1.2.4 什么是表（tables）？

1.2.5 什么是链（chains）？

1.2.6 什么是规则（Policy）？

<td style="width: 23.3%; border-top: solid #666666 1.0pt; border-left: none; border-bottom: solid #666666 1.5pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="23%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: 微软雅黑, sans-serif;">表（</span>tables</strong><strong><span style="font-family: 微软雅黑, sans-serif;">）</span></strong>
  </p>
</td>

<td style="width: 23.3%; border-top: solid #666666 1.0pt; border-left: none; border-bottom: solid #666666 1.5pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="23%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: 微软雅黑, sans-serif;">链（</span>chains</strong><strong><span style="font-family: 微软雅黑, sans-serif;">）</span></strong>
  </p>
</td>

<td style="width: 33.84%; border-top: solid #666666 1.0pt; border-left: none; border-bottom: solid #666666 1.5pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="33%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: 微软雅黑, sans-serif;">规则（</span>Policy</strong><strong><span style="font-family: 微软雅黑, sans-serif;">）</span></strong>
  </p>
</td>

<td style="width: 23.3%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="23%">
  <p style="text-align: center;" align="center">
    <span style="font-family: 微软雅黑, sans-serif;">按里的房子</span>
  </p>
</td>

<td style="width: 23.3%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="23%">
  <p style="text-align: center;" align="center">
    <span style="font-family: 微软雅黑, sans-serif;">房子里的柜子</span>
  </p>
</td>

<td style="width: 33.84%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="33%">
  <p style="text-align: center;" align="center">
    <span style="font-family: 微软雅黑, sans-serif;">柜子里衣服，摆放规则</span>
  </p>
</td>

1.3 iptables 表和链

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">四个表：

  <td style="width: 81.06%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #bfbfbf; padding: 0cm 5.4pt;" colspan="2" width="81%">
    <p style="text-align: center;" align="center">
      <strong><span style="font-family: '微软雅黑',sans-serif;">链（</span>chains</strong><strong><span style="font-family: '微软雅黑',sans-serif;">）</span></strong>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.94%; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: 1pt solid windowtext; border-top: none; background: #d99594; padding: 0cm 5.4pt;" rowspan="4" width="18%">
    <p style="text-align: center;" align="center">
      <strong>Filter</strong>
    </p>
  </td>
  
  <td style="width: 81.06%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #B8CCE4; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="81%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">这是默认表，实现防火墙数据过滤功能。</span>
    </p>
  </td>
</tr>

<tr style="height: 16.0pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>INPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">对于指定到本地套接字的包，即到达本地防火墙服务器的数据包。</span>
    </p>
  </td>
</tr>

<tr style="height: 16.0pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>FORWARD</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">路由穿过的数据包，即经过本地防火墙服务器的数据包。</span>
    </p>
  </td>
</tr>

<tr style="height: 16.0pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>OUTPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">本地创建的数据包</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.94%; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: 1pt solid windowtext; border-top: none; background: #fabf8f; padding: 0cm 5.4pt;" rowspan="4" width="18%">
    <p style="text-align: center;" align="center">
      <strong>NAT</strong>
    </p>
  </td>
  
  <td style="width: 81.06%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #B8CCE4; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="81%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">当遇到新创建的数据包连接时将参考这个表</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>FREROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">一进来就对数据包进行改变</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>OUTPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">本地创建的数据包在路由前进行改变</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>POSTROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">在数据包即将出去时改变数据包信息</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.94%; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: 1pt solid windowtext; border-top: none; background: #c2d69b; padding: 0cm 5.4pt;" rowspan="6" width="18%">
    <p style="text-align: center;" align="center">
      <strong>Mangle</strong>
    </p>
  </td>
  
  <td style="width: 81.06%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #B8CCE4; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="81%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">这个表专门用于改变数据包</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>INPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">进入到设备本身的包</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>FORWARD</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">对路由后的数据包信息进行修改</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>FREROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">在路由之前更改传入的包</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>OUTPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">本地创建的数据包在路由之前改变</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>POSTROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">在数据包即将离开时更改数据包信息</span>
    </p>
  </td>
</tr>

<tr style="height: 7.25pt;">
  <td style="width: 18.94%; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: 1pt solid windowtext; border-top: none; background: #b6dde8; padding: 0cm 5.4pt; height: 7.25pt;" rowspan="3" width="18%">
    <p style="text-align: center;" align="center">
      <strong>raw</strong>
    </p>
  </td>
  
  <td style="width: 81.06%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" colspan="2" width="81%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <strong><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif; courier new"4courier new";color: #E36C0A;">此表用处较少，可以忽略不计。</span></strong>
    </p>
    
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-size: 9.0pt;">This&nbsp; table is used mainly for configuring exemptions from connection tracking in combination with the&nbsp; NOTRACK&nbsp; target.</span>
    </p>
  </td>
</tr>

<tr style="height: 7.25pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>PREROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: 'Microsoft YaHei UI',sans-serif;">for packets arriving via any network interface</span>
    </p>
  </td>
</tr>

<tr style="height: 7.25pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>OUTPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: 'Microsoft YaHei UI',sans-serif;">for packets&nbsp; generated by local processes</span>
    </p>
  </td>
</tr>

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">五个链

<td style="width: 81.24%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #b2a1c7; padding: 0cm 5.4pt;" colspan="5" width="81%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif;">链（</span>chains</strong><strong><span style="font-family: '微软雅黑',sans-serif;">）</span></strong>
  </p>
</td>

<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #FBD4B4; padding: 0cm 5.4pt 0cm 5.4pt; height: 22.05pt;" width="16%">
  <p style="text-align: center;" align="center">
    FORWARD
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #FBD4B4; padding: 0cm 5.4pt 0cm 5.4pt; height: 22.05pt;" width="15%">
  <p style="text-align: center;" align="center">
    OUTPUT
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #FBD4B4; padding: 0cm 5.4pt 0cm 5.4pt; height: 22.05pt;" width="16%">
  <p style="text-align: center;" align="center">
    PREROUTING
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #FBD4B4; padding: 0cm 5.4pt 0cm 5.4pt; height: 22.05pt;" width="17%">
  <p style="text-align: center;" align="center">
    POSTROUTING
  </p>
</td>

<td style="width: 15.88%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="17%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

<td style="width: 15.88%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif;">&times;</span></strong>
  </p>
</td>

<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="17%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 15.88%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="17%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 15.88%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="17%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

1.3.1 filter表的详细介绍

<td style="width: 79.7%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #92cddc; padding: 0cm 5.4pt;" valign="top" width="79%">
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">主要和主机自身相关，真正负责主机防火墙功能的（过滤流入流出主机的数据包）</span>
  </p>
  
  <p>
    filter<span style="font-family: '微软雅黑',sans-serif;">表是</span>iptables<span style="font-family: '微软雅黑',sans-serif;">默认使用的表，这个表定义了三个链（</span>chains<span style="font-family: '微软雅黑',sans-serif;">）</span>
  </p>
  
  <p>
    <strong><span style="font-family: '微软雅黑',sans-serif;">企业工作场景</span>:</strong><strong><span style="font-family: '微软雅黑',sans-serif;">主机防火墙</span></strong>
  </p>
</td>

<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="79%">
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">负责过滤所有目标是本机地址的数据包</span>
  </p>
  
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">通俗来说：就是过滤进入主机的数据包</span>
  </p>
</td>

<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="79%">
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">负责转发流经主机的数据包。起到转发的作用，和</span>NAT<span style="font-family: '微软雅黑',sans-serif;">关系很大。</span>
  </p>
  
  <p>
    LVS NAT <span style="font-family: '微软雅黑',sans-serif;">模式，</span>net.ipv4.ip_forward=0
  </p>
</td>

<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="79%">
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">处理所有源地址是本机地址的数据包</span>
  </p>
  
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">通俗的讲：就是处理从主机发出的数据包</span>
  </p>
</td>

   对于filter表的控制是我们实现本机防火墙功能的重要手段，特别是INPUT链的控制。

1.3.2 NAT表信息详细介绍

<td style="width: 79.7%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #95b3d7; padding: 0cm 5.4pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">负责网络地址转换的，即来源与目的的</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址和</span>port<span style="font-family: '微软雅黑',sans-serif;">的转换。</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">应用：和主机本身无关，一般用于局域网共享上网或者特殊的端口转换相关</span>.
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <strong><em><span style="font-family: '微软雅黑',sans-serif;">工作场景：</span></em></strong>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    1<span style="font-family: '微软雅黑',sans-serif;">、用于企业路由</span>(zebra)<span style="font-family: '微软雅黑',sans-serif;">或网关</span>(iptables),<span style="font-family: '微软雅黑',sans-serif;">共享上网</span>(POSTROUTING)
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    2<span style="font-family: '微软雅黑',sans-serif;">、做内部外部</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址一对一映射</span>(dmz),<span style="font-family: '微软雅黑',sans-serif;">硬件防火墙映射</span>IP<span style="font-family: '微软雅黑',sans-serif;">到内部服务器，</span>FTP<span style="font-family: '微软雅黑',sans-serif;">服务</span>(PREROUTING)
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    3<span style="font-family: '微软雅黑',sans-serif;">、</span>WEB,<span style="font-family: '微软雅黑',sans-serif;">单个端口的映射，直接映射</span>80<span style="font-family: '微软雅黑',sans-serif;">端口</span>(PREROUTING)
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">这个表定义了</span>3<span style="font-family: '微软雅黑',sans-serif;">个链，</span>nat<span style="font-family: '微软雅黑',sans-serif;">功能相当于网络的</span>acl<span style="font-family: '微软雅黑',sans-serif;">控制。和网络交换机</span>acl<span style="font-family: '微软雅黑',sans-serif;">类似。</span>
  </p>
</td>

<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">和主机放出去的数据包有关，改变主机发出数据包的目的地址。</span>
  </p>
</td>

<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在数据包到达防火墙时，进行路由判断之前执行的规则，作用是改变数据包的目的地址、目的端口等</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">就是收信时，根据规则重写收件人的地址</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">例如：把公网</span>IP<span style="font-family: '微软雅黑',sans-serif;">：</span> xxx.xxx.xxx.xxx <span style="font-family: '微软雅黑',sans-serif;">映射到局域网的</span> x.x.x.x <span style="font-family: '微软雅黑',sans-serif;">服务器</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">如果是</span>web<span style="font-family: '微软雅黑',sans-serif;">服务，可以把</span>80<span style="font-family: '微软雅黑',sans-serif;">转换为局域网的服务器</span>9000<span style="font-family: '微软雅黑',sans-serif;">端口上。</span>
  </p>
</td>

<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在数据包离开防火墙时进行路由判断之后执行的规则，作用改变数据包的源地址，源端口等。</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">写好收件人的地址，要让家人回信时能够有地址可回。</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">例如。默认笔记本和虚拟机都是局域网地址，在出网的时候被路由器将源地址改为公网地址。</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <strong><em><span style="font-family: '微软雅黑',sans-serif;">生产应用：</span></em></strong><span style="font-family: '微软雅黑',sans-serif;">局域网共享上网。</span>
  </p>
</td>

1.3.3 Mangle表信息详细介绍

<td style="width: 79.7%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #92cddc; padding: 0cm 5.4pt; height: 29.55pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">主要负责修改数据包中特殊的路由标记，如</span>TTL,TOS,MARK<span style="font-family: '微软雅黑',sans-serif;">等，这个表定义了</span>5<span style="font-family: '微软雅黑',sans-serif;">个链</span>(chains).
  </p>
</td>

1.4 iptables工作流程

1.4.1 工作流程说明

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">抽象说明：上图可以用北京地铁1,2号线来描述：

企业案例：

　　主要应用就是主机服务器防火墙，使用FILTER的INPUT链

1.4.2 iptables工作流程小结

1、防火墙是一层层过滤的。实际是按照配置规则的顺序从上到下，从前到后进行过滤的。

2、如果匹配上了规则，即明确表明是阻止还是通过，此时数据包就不在向下匹配新规则了。

3、如果所有规则中没有明确表明是阻止还是通过这个数据包，也就是没有匹配上规则，向下进行匹配，直到匹配默认规则得到明确的阻止还是通过。

4、防火墙的默认规则是对应链的所有的规则执行完以后才会执行的（最后执行的规则）。

1.5 iptables操作

系统环境说明

软件版本

1.5.1 iptables参数说明

<td style="width: 67.52%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #bfbfbf; padding: 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif;">参数说明</span></strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">以数字的方式显示地址或端口信息</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">列出一个链或所有链中的规则信息</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    Print the rules in a chain or all chains
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">当列出规则信息时，打印规则行号</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">显示详细信息，可以叠加</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">显示帮助信息</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">清除所有规则，不会处理默认的规则</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">删除用户自定义的链</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">链的计数器清零（数据包计数器与数据包字节计数器）</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定配置哪个表，指定配置表名称。</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">附加或追加上相应规则策略，到指定链</span>(<span style="font-family: '微软雅黑',sans-serif;">链名称必须大写</span>)<span style="font-family: '微软雅黑',sans-serif;">，默认将配置的规则插入到最后一条。</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    Check for the existence of a rule
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">插入相应规则策略，到指定链上，默认将配置的规则插入到第一条（可以根据规则序号插入到指定位置）</span>--<span style="font-family: '微软雅黑',sans-serif;">封</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址使用。</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">删除指定的规则</span>(<span style="font-family: '微软雅黑',sans-serif;">可以根据规则序号进行删除</span>)
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    Replace rule rulenum (1 = first) in chain
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">改变链上的最终默认规则策略</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">创建新的用户定义链</span>
  </p>
</td>

  <p style="text-align: center;" align="center">
    <strong><span style="color: red;">[!] </span>--proto</strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定规则的协议名称</span> all tcp udp icmp
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定匹配的目标端口信息</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定匹配的源端口信息</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #9BBB59; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.25pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">匹配数据包后的动作</span>&nbsp;&nbsp;&nbsp;&nbsp;
  </p>
</td>

<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">允许</span>
  </p>
</td>

<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">丢弃</span>(<span style="font-family: '微软雅黑',sans-serif;">没有响应</span>)
  </p>
</td>

<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">拒绝</span>(<span style="font-family: '微软雅黑',sans-serif;">回应请求者明确的拒绝</span>)
  </p>
</td>

<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">伪装上网时使用</span>
  </p>
</td>

<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">共享地址上网</span>
  </p>
</td>

<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">目的地址改写</span>
  </p>
</td>

  <p style="text-align: center;" align="center">
    <strong><span style="color: red;">[!]</span> --in-interface </strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在</span>INPUT<span style="font-family: '微软雅黑',sans-serif;">链配置规则中，指定从哪一个网卡接口进入的流量（只能配置在</span>INPUT<span style="font-family: '微软雅黑',sans-serif;">链上）</span>
  </p>
</td>

  <p style="text-align: center;" align="center">
    <strong><span style="color: red;">[!]</span> --out-interface </strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在</span>OUTPUT<span style="font-family: '微软雅黑',sans-serif;">链配置规则中，指定从哪一个网接口出去的流量（只能配置在</span>OUTPUT<span style="font-family: '微软雅黑',sans-serif;">链上）</span>
  </p>
</td>

  <p style="text-align: center;" align="center">
    &nbsp;<strong><span style="color: red;">[!] --source&nbsp; </span></strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定源</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址或源网段信息</span>
  </p>
</td>

  <p style="text-align: center;" align="center">
    <strong><span style="color: red;">[!]</span> --destination </strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定目标</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址或目标网段信息</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #92D050; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">表示增加扩展，匹配功能扩展匹配（可以加载扩展参数）</span>
  </p>
</td>

<td style="width: 48.54%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="48%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">实现不连续多端口扩展匹配</span>
  </p>
</td>

<td style="width: 48.54%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="48%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">使用</span>icmp<span style="font-family: '微软雅黑',sans-serif;">的扩展</span>
  </p>
</td>

<td style="width: 48.54%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="48%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">状态模块扩展</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">只有类型</span>8<span style="font-family: '微软雅黑',sans-serif;">是真正会影响</span>ping<span style="font-family: '微软雅黑',sans-serif;">，或者也可以采用</span>any<span style="font-family: '微软雅黑',sans-serif;">；了解很多</span>icmp<span style="font-family: '微软雅黑',sans-serif;">类型</span><em>iptables -p icmp -h</em>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定时间内的请求速率&rdquo;</span>n<span style="font-family: '微软雅黑',sans-serif;">&rdquo;为速率，后面为时间分别为：秒</span> <span style="font-family: '微软雅黑',sans-serif;">分</span> <span style="font-family: '微软雅黑',sans-serif;">时</span>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在同一时间内允许通过的请求&rdquo;</span>n<span style="font-family: '微软雅黑',sans-serif;">&rdquo;为数字，不指定默认为</span>5
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">扩展数字（显示精确数值）</span>
  </p>
</td>

<td style="border-width: initial; border-style: none; border-color: initial;" width="129">
  &nbsp;
</td>

<td style="border-width: initial; border-style: none; border-color: initial;" width="9">
  &nbsp;
</td>

<td style="border-width: initial; border-style: none; border-color: initial;" width="287">
  &nbsp;
</td>

!****<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; color: red; background: yellow;">的使用实例

1.5.2 配置前准备

在配置防火墙首先要其中防火墙

清除iptables所有规则

查看iptables的规则

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

查看其他的表配置（-t 参数）

Chain OUTPUT (policy ACCEPT) target prot opt source destination

查看配置规则的顺序号

1.6 iptables filter表配置实例

1.6.1 基础配置

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例一：配置22/ssh端口访问控制规则

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例二：禁止网段连入（禁止172.16.1.0网段访问172.16.1.188）

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例三：禁止某个172.16.1.0网段访问服务器主机的22端口

方向说明：

1.6.2 <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例四：除10.0.0.0网段可以进行连接服务器主机意外，其余网段都禁止

  __第一种方式：

   修改默认规则，将默认规则改为拒绝

   <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">！  — <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; background: yellow;">表示对规则信息进行取反

1.6.3 <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例五：测试匹配列举端口范围。

   -m 参数表示增加扩展匹配功能，multiport 实现不连续多端口扩展匹配

1.6.4 <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例六：匹配ICMP类型

   禁止ping策略原则

   iptables服务器是ping命令发起者或是接受者

input链： 禁止icmp-type 0 

output链： 禁止icmp-type 8 

   <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: lime;">接受者：

input链： 禁止icmp-type 8 

output链： 禁止icmp-type 0 

简化配置：

   指定类型禁止icmp

   说明：只有类型8是真正会影响ping，或者也可以采用any；了解很多icmp类型iptables -p icmp -h

ICMP**类型的说明**

<td style="width: 11.0%; border-top: solid black 1.0pt; border-left: none; border-bottom: solid black 1.0pt; border-right: none; background: black; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 11.0pt; font-family: 'Verdana',sans-serif; color: white;">CODE</span>
  </p>
</td>

<td style="width: 56.0%; border-top: solid black 1.0pt; border-left: none; border-bottom: solid black 1.0pt; border-right: none; background: black; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 11.0pt; font-family: 'Verdana',sans-serif; color: white;">Description</span>
  </p>
</td>

<td style="width: 11.0%; border-top: solid black 1.0pt; border-left: none; border-bottom: solid black 1.0pt; border-right: none; background: black; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 11.0pt; font-family: 'Verdana',sans-serif; color: white;">Query</span>
  </p>
</td>

<td style="width: 11%; border-top: 1pt solid black; border-right: 1pt solid black; border-bottom: 1pt solid black; border-left: none; background: black; padding: 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 11.0pt; font-family: 'Verdana',sans-serif; color: white;">Error</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Echo Reply&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">回显应答（</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Ping</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">应答）</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Network Unreachable&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">网络不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">1</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Host Unreachable&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">主机不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">2</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Protocol Unreachable&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">协议不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">3</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Port Unreachable&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">端口不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">4</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Fragmentation needed but no frag. bit set&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">需要进行分片但设置不分片比特</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">5</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Source routing failed&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">源站选路失败</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">6</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Destination network unknown&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">目的网络未知</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">7</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Destination host unknown&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">目的主机未知</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">8</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Source host isolated (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">源主机被隔离（作废不用）</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">9</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Destination network administratively prohibited&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">目的网络被强制禁止</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">10</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Destination host administratively prohibited&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">目的主机被强制禁止</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">11</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Network unreachable for TOS&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">由于服务类型</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">TOS</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">，网络不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">12</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Host unreachable for TOS&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">由于服务类型</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">TOS</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">，主机不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">13</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Communication administratively prohibited by filtering&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">由于过滤，通信被强制禁止</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">14</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Host precedence violation&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">主机越权</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">15</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Precedence cutoff in effect&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">优先中止生效</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Source quench&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">源端被关闭（基本流控制）</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Redirect for network&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">对网络重定向</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">1</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Redirect for host&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">对主机重定向</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">2</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Redirect for TOS and network&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">对服务类型和网络重定向</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">3</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Redirect for TOS and host&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">对服务类型和主机重定向</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Echo request&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">回显请求（</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Ping</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">请求）</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Router advertisement&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">路由器通告</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Route solicitation&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">路由器请求</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">TTL equals 0 during transit&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">传输期间生存时间为</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">1</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">TTL equals 0 during reassembly&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">在数据报组装期间生存时间为</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">IP header bad (catchall error)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">坏的</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">IP</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">首部（包括各种差错）</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">1</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Required options missing&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">缺少必需的选项</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Timestamp request (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">时间戳请求（作废不用）</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Timestamp reply (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">时间戳应答（作废不用）</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Information request (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">信息请求（作废不用）</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Information reply (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">信息应答（作废不用）</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Address mask request&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">地址掩码请求</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Address mask reply&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">地址掩码应答</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  &nbsp;
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  &nbsp;
</td>

1.6.5 防火墙状态机制配置

状态集简单说明:

<td style="width: 50%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">说明</span></strong>
  </p>
</td>

<td style="width: 50.0%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">表示新建立连接的数据包状态</span>
  </p>
</td>

<td style="width: 50.0%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">表示新建立连接数据包发送之后，回复响应的数据包状态</span>
  </p>
</td>

<td style="width: 50.0%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">表示借助已经建立的链路，发送新的连接数据包</span>
  </p>
</td>

<td style="width: 50.0%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">无效无法识别的数据包</span>
  </p>
</td>

防火墙服务配置在FTP服务器上时，需要配置以下策略

 

实现发现sent_syn状态

实现发现sent_rcvd状态

1.6.6 使用iptables实现限速功能

示例：

   语句含义：当来自10.0.0.7 的ping包超过5个时进行限速，限制为每10s一个。

参数说明：

<td style="width: 55.3%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="55%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">参数含义</span></strong>
  </p>
</td>

<td style="width: 55.3%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="55%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定时间内的请求速率&rdquo;</span>n<span style="font-family: '微软雅黑',sans-serif;">&rdquo;为速率，后面为时间分别为：秒</span> <span style="font-family: '微软雅黑',sans-serif;">分</span> <span style="font-family: '微软雅黑',sans-serif;">时</span>
  </p>
</td>

<td style="width: 55.3%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="55%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在同一时间内允许通过的请求&rdquo;</span>n<span style="font-family: '微软雅黑',sans-serif;">&rdquo;为数字，不指定默认为</span>5
  </p>
</td>

limit****<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; background: yellow;">模块具体是如何工作的。？

1.6.7 企业级防火墙配置

清除防火墙规则

修改默认规则为拒绝（修改前先放行22端口，保证自己能够连上主机）

放行指定的端口

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">保存iptables****<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; background: yellow;">配置

1.7 iptables nat表配置实例

1.7.1 iptables实现共享上网

也可以使用命令添加默认网关

查看默认的路由信息

第二个里程碑：配置共享上网服务器，开启共享上网服务器路由转发功能

第三个里程碑：配置共享上网服务器，实现内网访问外网的NAT映射

参数详解：

<td style="width: 62.08%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="62%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">参数说明</span></strong>
  </p>
</td>

<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定将哪些内网网段进行映射转换</span>
  </p>
</td>

<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定在共享上网哪个网卡接口上做</span>NAT<span style="font-family: '微软雅黑',sans-serif;">地址转换</span>
  </p>
</td>

<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">将源地址进行转换变更</span>
  </p>
</td>

<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">将目标地址进行转换变更</span>
  </p>
</td>

<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">将源地址映射为什么</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址</span>
  </p>
</td>

<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">将目标地址映射为什么</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址</span>
  </p>
</td>

当filter表中的forward默认为drop策略时，如何配置forward链？

   配置示例

当外网ip不固定时如何配置？

说明：在企业中如何没有固定外网IP地址，可以采取以上伪装映射的方式进行共享上网

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置映射方法小结

 01. 指定哪些网段需要进行映射     -s 172.16.1.0/24

02. 指定在哪做映射               -o eth0

03. 用什么方法做映射             -j SNAT/DNAT MASQUERADE

04. 映射成什么地址               –to-source  ip地址/–to-destination ip地址

1.7.2 iptables实现外网IP的端口映射到内网IP的端口

配置实例：

参数说明:

<td style="width: 55.3%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="55%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">参数说明</span></strong>
  </p>
</td>

<td style="width: 55.3%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="55%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">目标地址。</span>
  </p>
</td>

<td style="width: 55.3%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="55%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">目的地址改写。</span>
  </p>
</td>

1.7.3 IP一对一映射

   实际需求：将ip 地址172.16.1.180 映射到10.0.0.188

通过辅助IP配置：

适合内网的机器访问NAT外网的IP

检查配置：

1.7.4 映射多个外网IP上网

   方法1：

      在三层交换机或路由器，划分VLAN。

   方法2：

      扩大子网，会增加广播风暴。

1.7.5 系统防火墙与网络内核优化标准参数

有关iptables的内核优化

以下是我的生产环境的某个服务器的配置：

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">解决time-wait****<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; background: yellow;">过多的解决办法：

如何解决？

   #iptables优化

1.8 自定义链的配置

创建自定义链

引用自定义链

重命名自定义链

删除自定义链

　　1、自定义链没有被引用

　　2、自定义链中没有任何规则

1.9 附录-防火墙状态机制

在iptables上一共有四种状态，分别被称为NEW、ESTABLISHED、INVALID、RELATED,这四种状态对于TCP、UDP、ICMP三种协议均有效。下面，我们来分别阐述四种状态的特性.

1.9.1 iptables配置哲学

如何防止自己被关在门外？

 01、去机房重启系统或者登陆服努器删除刚才的禁止规则。

配置禁用22端口策略:

删除配置的禁止连接22端口的规则

 1.10 参考文献

 1  http://www.aichengxu.com/linux/3122717.htm

 

<li>
  <a href="#12_iptables">1.2 iptables防火墙简介</a><ul>
    <li>
      <a href="#121_iptables">1.2.1 iptables名词和术语</a>
    </li>
    <li>
      <a href="#122">1.2.2 什么是容器</a>
    </li>
    <li>
      <a href="#123_Netfilteriptables">1.2.3 什么是 Netfilter/iptables ?</a>
    </li>
    <li>
      <a href="#124_tables">1.2.4 什么是表（tables）？</a>
    </li>
    <li>
      <a href="#125_chains">1.2.5 什么是链（chains）？</a>
    </li>
    <li>
      <a href="#126_Policy">1.2.6 什么是规则（Policy）？</a>
    </li>
  </ul>
</li>

<li>
  <a href="#13_iptables">1.3 iptables 表和链</a><ul>
    <li>
      <a href="#131_filter">1.3.1 filter表的详细介绍</a>
    </li>
    <li>
      <a href="#132_NAT">1.3.2 NAT表信息详细介绍</a>
    </li>
    <li>
      <a href="#133_Mangle">1.3.3 Mangle表信息详细介绍</a>
    </li>
  </ul>
</li>

<li>
  <a href="#14_iptables">1.4 iptables工作流程</a><ul>
    <li>
      <a href="#141">1.4.1 工作流程说明</a>
    </li>
    <li>
      <a href="#142_iptables">1.4.2 iptables工作流程小结</a>
    </li>
  </ul>
</li>

<li>
  <a href="#15_iptables">1.5 iptables操作</a><ul>
    <li>
      <a href="#151_iptables">1.5.1 iptables参数说明</a>
    </li>
    <li>
      <a href="#152">1.5.2 配置前准备</a>
    </li>
  </ul>
</li>

<li>
  <a href="#16_iptables_filter">1.6 iptables filter表配置实例</a><ul>
    <li>
      <a href="#161">1.6.1 基础配置</a>
    </li>
    <li>
      <a href="#162_10000">1.6.2 配置实例四：除10.0.0.0网段可以进行连接服务器主机意外，其余网段都禁止</a>
    </li>
    <li>
      <a href="#163">1.6.3 配置实例五：测试匹配列举端口范围。</a>
    </li>
    <li>
      <a href="#164_ICMP">1.6.4 配置实例六：匹配ICMP类型</a>
    </li>
    <li>
      <a href="#165">1.6.5 防火墙状态机制配置</a>
    </li>
    <li>
      <a href="#166_iptables">1.6.6 使用iptables实现限速功能</a>
    </li>
    <li>
      <a href="#167">1.6.7 企业级防火墙配置</a>
    </li>
  </ul>
</li>

<li>
  <a href="#17_iptables_nat">1.7 iptables nat表配置实例</a><ul>
    <li>
      <a href="#171_iptables">1.7.1 iptables实现共享上网</a>
    </li>
    <li>
      <a href="#172_iptablesIPIP">1.7.2 iptables实现外网IP的端口映射到内网IP的端口</a>
    </li>
    <li>
      <a href="#173_IP">1.7.3 IP一对一映射</a>
    </li>
    <li>
      <a href="#174_IP">1.7.4 映射多个外网IP上网</a>
    </li>
    <li>
      <a href="#175">1.7.5 系统防火墙与网络内核优化标准参数</a>
    </li>
  </ul>
</li>

<li>
  <a href="#18">1.8 自定义链的配置</a>
</li>
<li>
  <a href="#19">1.9 附录-防火墙状态机制</a><ul>
    <li>
      <a href="#191_iptables">1.9.1 iptables配置哲学</a>
    </li>
  </ul>
</li>