详解Linux防火墙iptables禁IP与解封IP常用命令

常用的IPTABLES规则如下：

只能收发邮件，别的都关闭

iptables -I Filter -m mac –mac-source 00:0F:EA:25:51:37 -j DROP
iptables -I Filter -m mac –mac-source 00:0F:EA:25:51:37 -p udp –dport 53 -j ACCEPT
iptables -I Filter -m mac –mac-source 00:0F:EA:25:51:37 -p tcp –dport 25 -j ACCEPT
iptables -I Filter -m mac –mac-source 00:0F:EA:25:51:37 -p tcp –dport 110 -j ACCEPT

IPSEC NAT 策略

iptables -I PFWanPriv -d 192.168.100.2 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp –dport 80 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:80
iptables -t nat -A PREROUTING -p tcp –dport 1723 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:1723
iptables -t nat -A PREROUTING -p udp –dport 1723 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:1723
iptables -t nat -A PREROUTING -p udp –dport 500 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:500 
iptables -t nat -A PREROUTING -p udp –dport 4500 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.100.2:4500

FTP服务器的NAT

iptables -I PFWanPriv -p tcp –dport 21 -d 192.168.1.22 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp –dport 21 -d $INTERNET_ADDR -j DNAT –to-destination 192.168.1.22:21

只允许访问指定网址

iptables -A Filter -p udp –dport 53 -j ACCEPT
iptables -A Filter -p tcp –dport 53 -j ACCEPT
iptables -A Filter -d www.ctohome.com -j ACCEPT
iptables -A Filter -d www.guowaivps.com -j ACCEPT
iptables -A Filter -j DROP

开放一个IP的一些端口，其它都封闭

iptables -A Filter -p tcp –dport 80 -s 192.168.1.22 -d www.pconline.com.cn -j ACCEPT
iptables -A Filter -p tcp –dport 25 -s 192.168.1.22 -j ACCEPT
iptables -A Filter -p tcp –dport 109 -s 192.168.1.22 -j ACCEPT
iptables -A Filter -p tcp –dport 110 -s 192.168.1.22 -j ACCEPT
iptables -A Filter -p tcp –dport 53 -j ACCEPT
iptables -A Filter -p udp –dport 53 -j ACCEPT
iptables -A Filter -j DROP

多个端口

iptables -A Filter -p tcp -m multiport –destination-port 22,53,80,110 -s 192.168.20.3 -j REJECT

连续端口

iptables -A Filter -p tcp -m multiport –source-port 22,53,80,110 -s 192.168.20.3 -j REJECT iptables -A Filter -p tcp –source-port 2:80 -s 192.168.20.3 -j REJECT

指定时间上网

iptables -A Filter -s 10.10.10.253 -m time –timestart 6:00 –timestop 11:00 –days Mon,Tue,Wed,Thu,Fri,Sat,Sun -j DROP
iptables -A Filter -m time –timestart 12:00 –timestop 13:00 –days Mon,Tue,Wed,Thu,Fri,Sat,Sun -j ACCEPT
iptables -A Filter -m time –timestart 17:30 –timestop 8:30 –days Mon,Tue,Wed,Thu,Fri,Sat,Sun -j ACCEPT

禁止多个端口服务

iptables -A Filter -m multiport -p tcp –dport 21,23,80 -j ACCEPT

将WAN 口NAT到PC