1.1 企业中安全优化配置原则

1.1.1 生产中iptables的实际应用

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">主要应用方向

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">其他说明:

 ①iptables是基于内核的防火墙,功能非常强大,基于数据包的过滤!特别是可以在一台非常低的硬件配置下跑的非常好。

**_  注:_**iptables主要工作在OSI七层的2.3.4层。七层的控制可以使用squid代理+iptables。

②iptabes:生产中根据具体情况,一般,内网关闭,外网打开。大并发的情况不能开iptables,影响性能,iptables是要消耗CPU的,所以大并发的情况下,我们使用硬件防火墙的各方面做的很仔细。selinux:生产中也是关闭的。可以做ids的入侵检测。

③实际生产中尽可能不给服务器配置外网IP。可以通过代理转发。比如,nagios就不需要外网。

④并发不是很大的情况下,再外网的IP环境,开防火墙。

⑤第一次直接默认规则生成配置文件,以后就在配置文件中进行修改(编辑添加删除)。

⑥封掉IP:根据IP地址和网络连接数进行封杀。(定时任务,定时封掉,判断,存在就不再进行二次封杀)

1.1.2 企业常用案例功能小结:

1.2 iptables防火墙简介

   iptableslinux2.42.6内核中集成的服务,其功能与安全性比其老一蜚ipfwadmipchains 强大的多,iptables主要工作在0SI七层的二、三、四层,如果重新编译内核,iptables也可以支持 7 层控制(squid代理+iptables)。

1.2.1 iptables名词和术语

1.2.2 什么是容器

1.2.3 什么是 Netfilter/iptables ?

1.2.4 什么是表(tables)?

1.2.5 什么是链(chains)?

1.2.6 什么是规则(Policy)?

<td style="width: 23.3%; border-top: solid #666666 1.0pt; border-left: none; border-bottom: solid #666666 1.5pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="23%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: 微软雅黑, sans-serif;">表(</span>tables</strong><strong><span style="font-family: 微软雅黑, sans-serif;">)</span></strong>
  </p>
</td>

<td style="width: 23.3%; border-top: solid #666666 1.0pt; border-left: none; border-bottom: solid #666666 1.5pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="23%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: 微软雅黑, sans-serif;">链(</span>chains</strong><strong><span style="font-family: 微软雅黑, sans-serif;">)</span></strong>
  </p>
</td>

<td style="width: 33.84%; border-top: solid #666666 1.0pt; border-left: none; border-bottom: solid #666666 1.5pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="33%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: 微软雅黑, sans-serif;">规则(</span>Policy</strong><strong><span style="font-family: 微软雅黑, sans-serif;">)</span></strong>
  </p>
</td>
<td style="width: 23.3%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="23%">
  <p style="text-align: center;" align="center">
    <span style="font-family: 微软雅黑, sans-serif;">按里的房子</span>
  </p>
</td>

<td style="width: 23.3%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="23%">
  <p style="text-align: center;" align="center">
    <span style="font-family: 微软雅黑, sans-serif;">房子里的柜子</span>
  </p>
</td>

<td style="width: 33.84%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="33%">
  <p style="text-align: center;" align="center">
    <span style="font-family: 微软雅黑, sans-serif;">柜子里衣服,摆放规则</span>
  </p>
</td>

1.3 iptables 表和链

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">四个表:

  <td style="width: 81.06%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #bfbfbf; padding: 0cm 5.4pt;" colspan="2" width="81%">
    <p style="text-align: center;" align="center">
      <strong><span style="font-family: '微软雅黑',sans-serif;">链(</span>chains</strong><strong><span style="font-family: '微软雅黑',sans-serif;">)</span></strong>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.94%; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: 1pt solid windowtext; border-top: none; background: #d99594; padding: 0cm 5.4pt;" rowspan="4" width="18%">
    <p style="text-align: center;" align="center">
      <strong>Filter</strong>
    </p>
  </td>
  
  <td style="width: 81.06%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #B8CCE4; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="81%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">这是默认表,实现防火墙数据过滤功能。</span>
    </p>
  </td>
</tr>

<tr style="height: 16.0pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>INPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">对于指定到本地套接字的包,即到达本地防火墙服务器的数据包。</span>
    </p>
  </td>
</tr>

<tr style="height: 16.0pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>FORWARD</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">路由穿过的数据包,即经过本地防火墙服务器的数据包。</span>
    </p>
  </td>
</tr>

<tr style="height: 16.0pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>OUTPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 16.0pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">本地创建的数据包</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.94%; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: 1pt solid windowtext; border-top: none; background: #fabf8f; padding: 0cm 5.4pt;" rowspan="4" width="18%">
    <p style="text-align: center;" align="center">
      <strong>NAT</strong>
    </p>
  </td>
  
  <td style="width: 81.06%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #B8CCE4; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="81%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">当遇到新创建的数据包连接时将参考这个表</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>FREROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">一进来就对数据包进行改变</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>OUTPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">本地创建的数据包在路由前进行改变</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>POSTROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">在数据包即将出去时改变数据包信息</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.94%; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: 1pt solid windowtext; border-top: none; background: #c2d69b; padding: 0cm 5.4pt;" rowspan="6" width="18%">
    <p style="text-align: center;" align="center">
      <strong>Mangle</strong>
    </p>
  </td>
  
  <td style="width: 81.06%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #B8CCE4; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="81%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">这个表专门用于改变数据包</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>INPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">进入到设备本身的包</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>FORWARD</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">对路由后的数据包信息进行修改</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>FREROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">在路由之前更改传入的包</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>OUTPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">本地创建的数据包在路由之前改变</span>
    </p>
  </td>
</tr>

<tr>
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>POSTROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: '微软雅黑',sans-serif;">在数据包即将离开时更改数据包信息</span>
    </p>
  </td>
</tr>

<tr style="height: 7.25pt;">
  <td style="width: 18.94%; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: 1pt solid windowtext; border-top: none; background: #b6dde8; padding: 0cm 5.4pt; height: 7.25pt;" rowspan="3" width="18%">
    <p style="text-align: center;" align="center">
      <strong>raw</strong>
    </p>
  </td>
  
  <td style="width: 81.06%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" colspan="2" width="81%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <strong><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif; courier new"4courier new";color: #E36C0A;">此表用处较少,可以忽略不计。</span></strong>
    </p>
    
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-size: 9.0pt;">This&nbsp; table is used mainly for configuring exemptions from connection tracking in combination with the&nbsp; NOTRACK&nbsp; target.</span>
    </p>
  </td>
</tr>

<tr style="height: 7.25pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>PREROUTING</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: 'Microsoft YaHei UI',sans-serif;">for packets arriving via any network interface</span>
    </p>
  </td>
</tr>

<tr style="height: 7.25pt;">
  <td style="width: 18.98%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" width="18%">
    <p style="text-align: center;" align="center">
      <strong>OUTPUT</strong>
    </p>
  </td>
  
  <td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 7.25pt;" width="62%">
    <p style="text-align: justify; text-justify: inter-ideograph;">
      <span style="font-family: 'Microsoft YaHei UI',sans-serif;">for packets&nbsp; generated by local processes</span>
    </p>
  </td>
</tr>

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">五个链

<td style="width: 81.24%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #b2a1c7; padding: 0cm 5.4pt;" colspan="5" width="81%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif;">链(</span>chains</strong><strong><span style="font-family: '微软雅黑',sans-serif;">)</span></strong>
  </p>
</td>
<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #FBD4B4; padding: 0cm 5.4pt 0cm 5.4pt; height: 22.05pt;" width="16%">
  <p style="text-align: center;" align="center">
    FORWARD
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #FBD4B4; padding: 0cm 5.4pt 0cm 5.4pt; height: 22.05pt;" width="15%">
  <p style="text-align: center;" align="center">
    OUTPUT
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #FBD4B4; padding: 0cm 5.4pt 0cm 5.4pt; height: 22.05pt;" width="16%">
  <p style="text-align: center;" align="center">
    PREROUTING
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #FBD4B4; padding: 0cm 5.4pt 0cm 5.4pt; height: 22.05pt;" width="17%">
  <p style="text-align: center;" align="center">
    POSTROUTING
  </p>
</td>
<td style="width: 15.88%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="17%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>
<td style="width: 15.88%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif;">&times;</span></strong>
  </p>
</td>

<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="17%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>
<td style="width: 15.88%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="17%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>
<td style="width: 15.88%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

<td style="width: 16.0%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

<td style="width: 15.94%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="15%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 16.2%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="16%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&radic;</span>
  </p>
</td>

<td style="width: 17.22%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="17%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">&times;</span>
  </p>
</td>

1.3.1 filter表的详细介绍

<td style="width: 79.7%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #92cddc; padding: 0cm 5.4pt;" valign="top" width="79%">
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">主要和主机自身相关,真正负责主机防火墙功能的(过滤流入流出主机的数据包)</span>
  </p>
  
  <p>
    filter<span style="font-family: '微软雅黑',sans-serif;">表是</span>iptables<span style="font-family: '微软雅黑',sans-serif;">默认使用的表,这个表定义了三个链(</span>chains<span style="font-family: '微软雅黑',sans-serif;">)</span>
  </p>
  
  <p>
    <strong><span style="font-family: '微软雅黑',sans-serif;">企业工作场景</span>:</strong><strong><span style="font-family: '微软雅黑',sans-serif;">主机防火墙</span></strong>
  </p>
</td>
<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="79%">
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">负责过滤所有目标是本机地址的数据包</span>
  </p>
  
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">通俗来说:就是过滤进入主机的数据包</span>
  </p>
</td>
<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="79%">
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">负责转发流经主机的数据包。起到转发的作用,和</span>NAT<span style="font-family: '微软雅黑',sans-serif;">关系很大。</span>
  </p>
  
  <p>
    LVS NAT <span style="font-family: '微软雅黑',sans-serif;">模式,</span>net.ipv4.ip_forward=0
  </p>
</td>
<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="79%">
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">处理所有源地址是本机地址的数据包</span>
  </p>
  
  <p>
    <span style="font-family: '微软雅黑',sans-serif;">通俗的讲:就是处理从主机发出的数据包</span>
  </p>
</td>

   对于filter表的控制是我们实现本机防火墙功能的重要手段,特别是INPUT链的控制。

1.3.2 NAT表信息详细介绍

<td style="width: 79.7%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #95b3d7; padding: 0cm 5.4pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">负责网络地址转换的,即来源与目的的</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址和</span>port<span style="font-family: '微软雅黑',sans-serif;">的转换。</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">应用:和主机本身无关,一般用于局域网共享上网或者特殊的端口转换相关</span>.
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <strong><em><span style="font-family: '微软雅黑',sans-serif;">工作场景:</span></em></strong>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    1<span style="font-family: '微软雅黑',sans-serif;">、用于企业路由</span>(zebra)<span style="font-family: '微软雅黑',sans-serif;">或网关</span>(iptables),<span style="font-family: '微软雅黑',sans-serif;">共享上网</span>(POSTROUTING)
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    2<span style="font-family: '微软雅黑',sans-serif;">、做内部外部</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址一对一映射</span>(dmz),<span style="font-family: '微软雅黑',sans-serif;">硬件防火墙映射</span>IP<span style="font-family: '微软雅黑',sans-serif;">到内部服务器,</span>FTP<span style="font-family: '微软雅黑',sans-serif;">服务</span>(PREROUTING)
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    3<span style="font-family: '微软雅黑',sans-serif;">、</span>WEB,<span style="font-family: '微软雅黑',sans-serif;">单个端口的映射,直接映射</span>80<span style="font-family: '微软雅黑',sans-serif;">端口</span>(PREROUTING)
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">这个表定义了</span>3<span style="font-family: '微软雅黑',sans-serif;">个链,</span>nat<span style="font-family: '微软雅黑',sans-serif;">功能相当于网络的</span>acl<span style="font-family: '微软雅黑',sans-serif;">控制。和网络交换机</span>acl<span style="font-family: '微软雅黑',sans-serif;">类似。</span>
  </p>
</td>
<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">和主机放出去的数据包有关,改变主机发出数据包的目的地址。</span>
  </p>
</td>
<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在数据包到达防火墙时,进行路由判断之前执行的规则,作用是改变数据包的目的地址、目的端口等</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">就是收信时,根据规则重写收件人的地址</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">例如:把公网</span>IP<span style="font-family: '微软雅黑',sans-serif;">:</span> xxx.xxx.xxx.xxx <span style="font-family: '微软雅黑',sans-serif;">映射到局域网的</span> x.x.x.x <span style="font-family: '微软雅黑',sans-serif;">服务器</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">如果是</span>web<span style="font-family: '微软雅黑',sans-serif;">服务,可以把</span>80<span style="font-family: '微软雅黑',sans-serif;">转换为局域网的服务器</span>9000<span style="font-family: '微软雅黑',sans-serif;">端口上。</span>
  </p>
</td>
<td style="width: 79.7%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在数据包离开防火墙时进行路由判断之后执行的规则,作用改变数据包的源地址,源端口等。</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">写好收件人的地址,要让家人回信时能够有地址可回。</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">例如。默认笔记本和虚拟机都是局域网地址,在出网的时候被路由器将源地址改为公网地址。</span>
  </p>
  
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <strong><em><span style="font-family: '微软雅黑',sans-serif;">生产应用:</span></em></strong><span style="font-family: '微软雅黑',sans-serif;">局域网共享上网。</span>
  </p>
</td>

1.3.3 Mangle表信息详细介绍

<td style="width: 79.7%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #92cddc; padding: 0cm 5.4pt; height: 29.55pt;" width="79%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">主要负责修改数据包中特殊的路由标记,如</span>TTL,TOS,MARK<span style="font-family: '微软雅黑',sans-serif;">等,这个表定义了</span>5<span style="font-family: '微软雅黑',sans-serif;">个链</span>(chains).
  </p>
</td>

1.4 iptables工作流程

1.4.1 工作流程说明

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">抽象说明:上图可以用北京地铁1,2号线来描述:

企业案例:

  主要应用就是主机服务器防火墙,使用FILTER的INPUT链

1.4.2 iptables工作流程小结

1、防火墙是一层层过滤的。实际是按照配置规则的顺序从上到下,从前到后进行过滤的。

2、如果匹配上了规则,即明确表明是阻止还是通过,此时数据包就不在向下匹配新规则了。

3、如果所有规则中没有明确表明是阻止还是通过这个数据包,也就是没有匹配上规则,向下进行匹配,直到匹配默认规则得到明确的阻止还是通过。

4、防火墙的默认规则是对应链的所有的规则执行完以后才会执行的(最后执行的规则)。

1.5 iptables操作

系统环境说明

软件版本

1.5.1 iptables参数说明

<td style="width: 67.52%; border-top: 1pt solid windowtext; border-right: 1pt solid windowtext; border-bottom: 1pt solid windowtext; border-left: none; background: #bfbfbf; padding: 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif;">参数说明</span></strong>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">以数字的方式显示地址或端口信息</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">列出一个链或所有链中的规则信息</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    Print the rules in a chain or all chains
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">当列出规则信息时,打印规则行号</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">显示详细信息,可以叠加</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">显示帮助信息</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">清除所有规则,不会处理默认的规则</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">删除用户自定义的链</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">链的计数器清零(数据包计数器与数据包字节计数器)</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定配置哪个表,指定配置表名称。</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">附加或追加上相应规则策略,到指定链</span>(<span style="font-family: '微软雅黑',sans-serif;">链名称必须大写</span>)<span style="font-family: '微软雅黑',sans-serif;">,默认将配置的规则插入到最后一条。</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    Check for the existence of a rule
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">插入相应规则策略,到指定链上,默认将配置的规则插入到第一条(可以根据规则序号插入到指定位置)</span>--<span style="font-family: '微软雅黑',sans-serif;">封</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址使用。</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">删除指定的规则</span>(<span style="font-family: '微软雅黑',sans-serif;">可以根据规则序号进行删除</span>)
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    Replace rule rulenum (1 = first) in chain
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">改变链上的最终默认规则策略</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">创建新的用户定义链</span>
  </p>
</td>
  <p style="text-align: center;" align="center">
    <strong><span style="color: red;">[!] </span>--proto</strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定规则的协议名称</span> all tcp udp icmp
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定匹配的目标端口信息</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定匹配的源端口信息</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #9BBB59; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.25pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">匹配数据包后的动作</span>&nbsp;&nbsp;&nbsp;&nbsp;
  </p>
</td>
<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">允许</span>
  </p>
</td>
<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">丢弃</span>(<span style="font-family: '微软雅黑',sans-serif;">没有响应</span>)
  </p>
</td>
<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">拒绝</span>(<span style="font-family: '微软雅黑',sans-serif;">回应请求者明确的拒绝</span>)
  </p>
</td>
<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">伪装上网时使用</span>
  </p>
</td>
<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">共享地址上网</span>
  </p>
</td>
<td style="width: 47.16%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt; height: 8.1pt;" width="47%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">目的地址改写</span>
  </p>
</td>
  <p style="text-align: center;" align="center">
    <strong><span style="color: red;">[!]</span> --in-interface </strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在</span>INPUT<span style="font-family: '微软雅黑',sans-serif;">链配置规则中,指定从哪一个网卡接口进入的流量(只能配置在</span>INPUT<span style="font-family: '微软雅黑',sans-serif;">链上)</span>
  </p>
</td>
  <p style="text-align: center;" align="center">
    <strong><span style="color: red;">[!]</span> --out-interface </strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在</span>OUTPUT<span style="font-family: '微软雅黑',sans-serif;">链配置规则中,指定从哪一个网接口出去的流量(只能配置在</span>OUTPUT<span style="font-family: '微软雅黑',sans-serif;">链上)</span>
  </p>
</td>
  <p style="text-align: center;" align="center">
    &nbsp;<strong><span style="color: red;">[!] --source&nbsp; </span></strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定源</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址或源网段信息</span>
  </p>
</td>
  <p style="text-align: center;" align="center">
    <strong><span style="color: red;">[!]</span> --destination </strong>
  </p>
</td>

<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定目标</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址或目标网段信息</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; background: #92D050; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">表示增加扩展,匹配功能扩展匹配(可以加载扩展参数)</span>
  </p>
</td>
<td style="width: 48.54%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="48%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">实现不连续多端口扩展匹配</span>
  </p>
</td>
<td style="width: 48.54%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="48%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">使用</span>icmp<span style="font-family: '微软雅黑',sans-serif;">的扩展</span>
  </p>
</td>
<td style="width: 48.54%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="2" width="48%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">状态模块扩展</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">只有类型</span>8<span style="font-family: '微软雅黑',sans-serif;">是真正会影响</span>ping<span style="font-family: '微软雅黑',sans-serif;">,或者也可以采用</span>any<span style="font-family: '微软雅黑',sans-serif;">;了解很多</span>icmp<span style="font-family: '微软雅黑',sans-serif;">类型</span><em>iptables -p icmp -h</em>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定时间内的请求速率&rdquo;</span>n<span style="font-family: '微软雅黑',sans-serif;">&rdquo;为速率,后面为时间分别为:秒</span> <span style="font-family: '微软雅黑',sans-serif;">分</span> <span style="font-family: '微软雅黑',sans-serif;">时</span>
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在同一时间内允许通过的请求&rdquo;</span>n<span style="font-family: '微软雅黑',sans-serif;">&rdquo;为数字,不指定默认为</span>5
  </p>
</td>
<td style="width: 67.52%; border-top: none; border-left: none; border-bottom: solid windowtext 1.0pt; border-right: solid windowtext 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" colspan="3" width="67%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">扩展数字(显示精确数值)</span>
  </p>
</td>
<td style="border-width: initial; border-style: none; border-color: initial;" width="129">
  &nbsp;
</td>

<td style="border-width: initial; border-style: none; border-color: initial;" width="9">
  &nbsp;
</td>

<td style="border-width: initial; border-style: none; border-color: initial;" width="287">
  &nbsp;
</td>

!****<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; color: red; background: yellow;">的使用实例

1.5.2 配置前准备

在配置防火墙首先要其中防火墙

清除iptables所有规则

查看iptables的规则

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes) pkts bytes target prot opt in out source destination

查看其他的表配置(-t 参数)

Chain OUTPUT (policy ACCEPT) target prot opt source destination

查看配置规则的顺序号

1.6 iptables filter表配置实例

1.6.1 基础配置

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例一:配置22/ssh端口访问控制规则

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例二:禁止网段连入(禁止172.16.1.0网段访问172.16.1.188

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例三:禁止某个172.16.1.0网段访问服务器主机的22端口

方向说明:

1.6.2 <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例四:10.0.0.0网段可以进行连接服务器主机意外,其余网段都禁止

  __第一种方式:

   修改默认规则,将默认规则改为拒绝

   <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">!  — <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; background: yellow;">表示对规则信息进行取反

1.6.3 <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例五:测试匹配列举端口范围。

   -m 参数表示增加扩展匹配功能,multiport 实现不连续多端口扩展匹配

1.6.4 <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置实例六:匹配ICMP类型

   禁止ping策略原则

   iptables服务器是ping命令发起者或是接受者

input链: 禁止icmp-type 0 

output链: 禁止icmp-type 8 

   <span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: lime;">接受者:

input链: 禁止icmp-type 8 

output链: 禁止icmp-type 0 

简化配置:

   指定类型禁止icmp

   说明:只有类型8是真正会影响ping,或者也可以采用any;了解很多icmp类型iptables -p icmp -h

ICMP**类型的说明**

<td style="width: 11.0%; border-top: solid black 1.0pt; border-left: none; border-bottom: solid black 1.0pt; border-right: none; background: black; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 11.0pt; font-family: 'Verdana',sans-serif; color: white;">CODE</span>
  </p>
</td>

<td style="width: 56.0%; border-top: solid black 1.0pt; border-left: none; border-bottom: solid black 1.0pt; border-right: none; background: black; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 11.0pt; font-family: 'Verdana',sans-serif; color: white;">Description</span>
  </p>
</td>

<td style="width: 11.0%; border-top: solid black 1.0pt; border-left: none; border-bottom: solid black 1.0pt; border-right: none; background: black; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 11.0pt; font-family: 'Verdana',sans-serif; color: white;">Query</span>
  </p>
</td>

<td style="width: 11%; border-top: 1pt solid black; border-right: 1pt solid black; border-bottom: 1pt solid black; border-left: none; background: black; padding: 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 11.0pt; font-family: 'Verdana',sans-serif; color: white;">Error</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Echo Reply&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">回显应答(</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Ping</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">应答)</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Network Unreachable&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">网络不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">1</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Host Unreachable&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">主机不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">2</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Protocol Unreachable&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">协议不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">3</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Port Unreachable&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">端口不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">4</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Fragmentation needed but no frag. bit set&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">需要进行分片但设置不分片比特</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">5</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Source routing failed&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">源站选路失败</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">6</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Destination network unknown&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">目的网络未知</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">7</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Destination host unknown&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">目的主机未知</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">8</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Source host isolated (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">源主机被隔离(作废不用)</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">9</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Destination network administratively prohibited&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">目的网络被强制禁止</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">10</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Destination host administratively prohibited&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">目的主机被强制禁止</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">11</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Network unreachable for TOS&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">由于服务类型</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">TOS</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">,网络不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">12</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Host unreachable for TOS&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">由于服务类型</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">TOS</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">,主机不可达</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">13</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Communication administratively prohibited by filtering&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">由于过滤,通信被强制禁止</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">14</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Host precedence violation&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">主机越权</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">15</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Precedence cutoff in effect&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">优先中止生效</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Source quench&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">源端被关闭(基本流控制)</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Redirect for network&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">对网络重定向</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">1</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Redirect for host&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">对主机重定向</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">2</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Redirect for TOS and network&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">对服务类型和网络重定向</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">3</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Redirect for TOS and host&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">对服务类型和主机重定向</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Echo request&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">回显请求(</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Ping</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">请求)</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #FFC000; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Router advertisement&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">路由器通告</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Route solicitation&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">路由器请求</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">TTL equals 0 during transit&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">传输期间生存时间为</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">1</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">TTL equals 0 during reassembly&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">在数据报组装期间生存时间为</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">IP header bad (catchall error)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">坏的</span><span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">IP</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">首部(包括各种差错)</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">1</span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Required options missing&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">缺少必需的选项</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Timestamp request (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">时间戳请求(作废不用)</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Timestamp reply (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">时间戳应答(作废不用)</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Information request (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">信息请求(作废不用)</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Information reply (obsolete)&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">信息应答(作废不用)</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Address mask request&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">地址掩码请求</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">x</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    &nbsp;
  </p>
</td>
<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  <p style="text-align: center;" align="center">
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;"></span>
  </p>
</td>

<td style="width: 56.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="56%">
  <p>
    <span style="font-size: 9.0pt; font-family: 'Verdana',sans-serif;">Address mask reply&mdash;&mdash;</span><span style="font-size: 9.0pt; font-family: '微软雅黑',sans-serif;">地址掩码应答</span>
  </p>
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  &nbsp;
</td>

<td style="width: 11.0%; border-top: none; border-left: none; border-bottom: solid #666666 1.0pt; border-right: solid #666666 1.0pt; background: #CCCCCC; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="11%">
  &nbsp;
</td>

1.6.5 防火墙状态机制配置

状态集简单说明:

<td style="width: 50%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">说明</span></strong>
  </p>
</td>
<td style="width: 50.0%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">表示新建立连接的数据包状态</span>
  </p>
</td>
<td style="width: 50.0%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">表示新建立连接数据包发送之后,回复响应的数据包状态</span>
  </p>
</td>
<td style="width: 50.0%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">表示借助已经建立的链路,发送新的连接数据包</span>
  </p>
</td>
<td style="width: 50.0%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" valign="top" width="50%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">无效无法识别的数据包</span>
  </p>
</td>

防火墙服务配置在FTP服务器上时,需要配置以下策略

 

实现发现sent_syn状态

实现发现sent_rcvd状态

1.6.6 使用iptables实现限速功能

示例:

   语句含义:当来自10.0.0.7 ping包超过5个时进行限速,限制为每10s一个。

参数说明:

<td style="width: 55.3%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="55%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">参数含义</span></strong>
  </p>
</td>
<td style="width: 55.3%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="55%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定时间内的请求速率&rdquo;</span>n<span style="font-family: '微软雅黑',sans-serif;">&rdquo;为速率,后面为时间分别为:秒</span> <span style="font-family: '微软雅黑',sans-serif;">分</span> <span style="font-family: '微软雅黑',sans-serif;">时</span>
  </p>
</td>
<td style="width: 55.3%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="55%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">在同一时间内允许通过的请求&rdquo;</span>n<span style="font-family: '微软雅黑',sans-serif;">&rdquo;为数字,不指定默认为</span>5
  </p>
</td>

limit****<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; background: yellow;">模块具体是如何工作的。?

1.6.7 企业级防火墙配置

清除防火墙规则

修改默认规则为拒绝(修改前先放行22端口,保证自己能够连上主机)

放行指定的端口

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">保存iptables****<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; background: yellow;">配置

1.7 iptables nat表配置实例

1.7.1 iptables实现共享上网

也可以使用命令添加默认网关

查看默认的路由信息

第二个里程碑:配置共享上网服务器,开启共享上网服务器路由转发功能

第三个里程碑:配置共享上网服务器,实现内网访问外网的NAT映射

参数详解:

<td style="width: 62.08%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="62%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">参数说明</span></strong>
  </p>
</td>
<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定将哪些内网网段进行映射转换</span>
  </p>
</td>
<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">指定在共享上网哪个网卡接口上做</span>NAT<span style="font-family: '微软雅黑',sans-serif;">地址转换</span>
  </p>
</td>
<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">将源地址进行转换变更</span>
  </p>
</td>
<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">将目标地址进行转换变更</span>
  </p>
</td>
<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">将源地址映射为什么</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址</span>
  </p>
</td>
<td style="width: 62.08%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="62%">
  <p style="text-align: justify; text-justify: inter-ideograph;">
    <span style="font-family: '微软雅黑',sans-serif;">将目标地址映射为什么</span>IP<span style="font-family: '微软雅黑',sans-serif;">地址</span>
  </p>
</td>

filter表中的forward默认为drop策略时,如何配置forward链?

   配置示例

当外网ip不固定时如何配置?

说明:在企业中如何没有固定外网IP地址,可以采取以上伪装映射的方式进行共享上网

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">配置映射方法小结

 01. 指定哪些网段需要进行映射     -s 172.16.1.0/24

02. 指定在哪做映射               -o eth0

03. 用什么方法做映射             -j SNAT/DNAT MASQUERADE

04. 映射成什么地址               –to-source  ip地址/–to-destination ip地址

1.7.2 iptables实现外网IP的端口映射到内网IP的端口

配置实例:

参数说明:

<td style="width: 55.3%; border-top: 1pt solid #9bbb59; border-right: 1pt solid #9bbb59; border-bottom: 1pt solid #9bbb59; border-left: none; background: #9bbb59; padding: 0cm 5.4pt;" width="55%">
  <p style="text-align: center;" align="center">
    <strong><span style="font-family: '微软雅黑',sans-serif; courier new"4courier new";color: white;">参数说明</span></strong>
  </p>
</td>
<td style="width: 55.3%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; background: #EAF1DD; padding: 0cm 5.4pt 0cm 5.4pt;" width="55%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">目标地址。</span>
  </p>
</td>
<td style="width: 55.3%; border-top: none; border-left: none; border-bottom: solid #C2D69B 1.0pt; border-right: solid #C2D69B 1.0pt; padding: 0cm 5.4pt 0cm 5.4pt;" width="55%">
  <p style="text-align: center;" align="center">
    <span style="font-family: '微软雅黑',sans-serif;">目的地址改写。</span>
  </p>
</td>

1.7.3 IP一对一映射

   实际需求:将ip 地址172.16.1.180 映射到10.0.0.188

通过辅助IP配置:

适合内网的机器访问NAT外网的IP

检查配置:

1.7.4 映射多个外网IP上网

   方法1

      在三层交换机或路由器,划分VLAN

   方法2

      扩大子网,会增加广播风暴。

1.7.5 系统防火墙与网络内核优化标准参数

有关iptables的内核优化

以下是我的生产环境的某个服务器的配置:

<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”;background: yellow;">解决time-wait****<span style=“font-family: ‘微软雅黑’,sans-serif; courier new"4courier new”; background: yellow;">过多的解决办法:

如何解决?

   #iptables优化

1.8 自定义链的配置

创建自定义链

引用自定义链

重命名自定义链

删除自定义链

  1、自定义链没有被引用

  2、自定义链中没有任何规则

1.9 附录-防火墙状态机制

iptables上一共有四种状态,分别被称为NEWESTABLISHEDINVALIDRELATED,这四种状态对于TCPUDPICMP三种协议均有效。下面,我们来分别阐述四种状态的特性.

1.9.1 iptables配置哲学

如何防止自己被关在门外?

 01、去机房重启系统或者登陆服努器删除刚才的禁止规则。

配置禁用22端口策略:

删除配置的禁止连接22端口的规则

 1.10 参考文献

 1  http://www.aichengxu.com/linux/3122717.htm

 

<li>
  <a href="#12_iptables">1.2 iptables防火墙简介</a><ul>
    <li>
      <a href="#121_iptables">1.2.1 iptables名词和术语</a>
    </li>
    <li>
      <a href="#122">1.2.2 什么是容器</a>
    </li>
    <li>
      <a href="#123_Netfilteriptables">1.2.3 什么是 Netfilter/iptables ?</a>
    </li>
    <li>
      <a href="#124_tables">1.2.4 什么是表(tables)?</a>
    </li>
    <li>
      <a href="#125_chains">1.2.5 什么是链(chains)?</a>
    </li>
    <li>
      <a href="#126_Policy">1.2.6 什么是规则(Policy)?</a>
    </li>
  </ul>
</li>

<li>
  <a href="#13_iptables">1.3 iptables 表和链</a><ul>
    <li>
      <a href="#131_filter">1.3.1 filter表的详细介绍</a>
    </li>
    <li>
      <a href="#132_NAT">1.3.2 NAT表信息详细介绍</a>
    </li>
    <li>
      <a href="#133_Mangle">1.3.3 Mangle表信息详细介绍</a>
    </li>
  </ul>
</li>

<li>
  <a href="#14_iptables">1.4 iptables工作流程</a><ul>
    <li>
      <a href="#141">1.4.1 工作流程说明</a>
    </li>
    <li>
      <a href="#142_iptables">1.4.2 iptables工作流程小结</a>
    </li>
  </ul>
</li>

<li>
  <a href="#15_iptables">1.5 iptables操作</a><ul>
    <li>
      <a href="#151_iptables">1.5.1 iptables参数说明</a>
    </li>
    <li>
      <a href="#152">1.5.2 配置前准备</a>
    </li>
  </ul>
</li>

<li>
  <a href="#16_iptables_filter">1.6 iptables filter表配置实例</a><ul>
    <li>
      <a href="#161">1.6.1 基础配置</a>
    </li>
    <li>
      <a href="#162_10000">1.6.2 配置实例四:除10.0.0.0网段可以进行连接服务器主机意外,其余网段都禁止</a>
    </li>
    <li>
      <a href="#163">1.6.3 配置实例五:测试匹配列举端口范围。</a>
    </li>
    <li>
      <a href="#164_ICMP">1.6.4 配置实例六:匹配ICMP类型</a>
    </li>
    <li>
      <a href="#165">1.6.5 防火墙状态机制配置</a>
    </li>
    <li>
      <a href="#166_iptables">1.6.6 使用iptables实现限速功能</a>
    </li>
    <li>
      <a href="#167">1.6.7 企业级防火墙配置</a>
    </li>
  </ul>
</li>

<li>
  <a href="#17_iptables_nat">1.7 iptables nat表配置实例</a><ul>
    <li>
      <a href="#171_iptables">1.7.1 iptables实现共享上网</a>
    </li>
    <li>
      <a href="#172_iptablesIPIP">1.7.2 iptables实现外网IP的端口映射到内网IP的端口</a>
    </li>
    <li>
      <a href="#173_IP">1.7.3 IP一对一映射</a>
    </li>
    <li>
      <a href="#174_IP">1.7.4 映射多个外网IP上网</a>
    </li>
    <li>
      <a href="#175">1.7.5 系统防火墙与网络内核优化标准参数</a>
    </li>
  </ul>
</li>

<li>
  <a href="#18">1.8 自定义链的配置</a>
</li>
<li>
  <a href="#19">1.9 附录-防火墙状态机制</a><ul>
    <li>
      <a href="#191_iptables">1.9.1 iptables配置哲学</a>
    </li>
  </ul>
</li>