{"id":19695,"date":"2017-09-05T06:40:39","date_gmt":"2017-09-04T22:40:39","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/09\/05\/debian-8-x-%e4%b8%8a%e9%98%b2%e7%81%ab%e7%89%86\/"},"modified":"2021-03-18T17:25:09","modified_gmt":"2021-03-18T09:25:09","slug":"debian-8-x-%e4%b8%8a%e9%98%b2%e7%81%ab%e7%89%86","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2017\/09\/05\/debian-8-x-%e4%b8%8a%e9%98%b2%e7%81%ab%e7%89%86\/","title":{"rendered":"Debian 8.x \u4e0a\u9632\u706b\u7246"},"content":{"rendered":"

1. \u641c\u5c0b iptables \u76f8\u95dc\u5957\u4ef6
# apt-cache search iptables | grep ^iptables<\/span>
iptables – administration tools for packet filtering and NAT<\/span>
iptables-converter – convert iptables-commands from a file to iptables-save format<\/span>
iptables-converter-doc – sphinx documentation for iptables-converter<\/span>
iptables-dev – transitional dummy package<\/span>
iptables-nftables-compat – iptables compat tools for nftables<\/span>
iptables-optimizer – sort iptables rules by packet counters<\/span>
iptables-optimizer-doc – sphinx html documentation for iptables-optimizer<\/span>
iptables-persistent – boot-time loader for netfilter rules, iptables plugin<\/span><\/p>\n

2. \u5b89\u88dd iptables-persistent \u5957\u4ef6
# apt-get install iptables-persistent<\/span>
\u00a0\u00a0 ipv4 \u9632\u706b\u7246 \/etc\/iptables\/rules.v4<\/span>
\u00a0\u00a0 ipv6 \u9632\u706b\u7246 \/etc\/iptables\/rules.v6<\/span>
\"\"
<\/a>
\"\"<\/a><\/p>\n

[@more@]3. \u5efa\u7acb\u81ea\u884c\u7684\u9632\u706b\u7246\u898f\u5247
# iptables -L -n<\/span>
Chain INPUT (policy DROP)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span>
f2b-sshd\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 multiport dports 22<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 all\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 all\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 state INVALID<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:!0x17\/0x02 state NEW<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x3F\/0x00<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x03\/0x03<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x06\/0x06<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x05\/0x05<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x11\/0x01<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x30\/0x20<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x18\/0x08<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x3F\/0x29<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x3F\/0x37<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x3F\/0x3F<\/span>
DROP\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp flags:0x3F\/0x01<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 all\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 state RELATED,ESTABLISHED<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 192.168.1.0\/24\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:22 flags:0x17\/0x02 state NEW<\/span><\/p>\n

Chain FORWARD (policy DROP)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span><\/p>\n

Chain OUTPUT (policy ACCEPT)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 all\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 all\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 state RELATED,ESTABLISHED<\/span><\/p>\n

Chain f2b-sshd (1 references)<\/span>
target\u00a0\u00a0\u00a0\u00a0 prot opt source\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 destination<\/span>
RETURN\u00a0\u00a0\u00a0\u00a0 all\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0<\/span><\/p>\n

4. \u5c07 ipv4\/6 \u898f\u5247\u5beb\u5165 \/etc\/iptables\/rules.v4\/6<\/span>
# \/sbin\/iptables-save > \/etc\/iptables\/rules.v4<\/span>
# \/sbin\/ip6tables-save > \/etc\/iptables\/rules.v6<\/span><\/p>\n

5. \u5728 \/etc\/rc.local<\/span> \u4e2d\u8a2d\u5b9a\uff0c\u958b\u6a5f\u6642\u8f09\u5165
# sed -i ‘\/^exit 0\/i\/sbin\/iptables-restore < \/etc\/iptables\/rules.v4’ \/etc\/rc.local<\/span>
# sed -i ‘\/^exit 0\/i\/sbin\/ip6tables-restore < \/etc\/iptables\/rules.v6’ \/etc\/rc.local<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

1. \u641c\u5c0b iptables \u76f8\u95dc\u5957\u4ef6# apt-cache search iptables | grep ^ … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008Debian 8.x \u4e0a\u9632\u706b\u7246\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[179],"tags":[],"class_list":["post-19695","post","type-post","status-publish","format-standard","hentry","category-c-87877"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["691462"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19695"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=19695"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19695\/revisions"}],"predecessor-version":[{"id":21190,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/19695\/revisions\/21190"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=19695"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=19695"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=19695"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}