네트워크 서비스 보안 - iptables 예제(2)

10.10.33.2 , 10.10.33.3, 10.10.33.101 만 접속을 허락하고 나머지 IP 대역은 접근을 무시한다.

[root@server3 ~]# vi /etc/sysconfig/iptables-config - iptabels 설정파일 # Save current firewall rules on stop. #   Value: yes|no,  default: no # Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped # (e.g. on system shutdown). #IPTABLES_SAVE_ON_STOP="no" IPTABLES_SAVE_ON_STOP="yes" - "no" 를 "yes"로 바꿔준다. [root@server3 ~]# iptables -A INPUT -s 10.10.33.2 -j ACCEPT [root@server3 ~]# iptables -A INPUT -s 10.10.33.3 -j ACCEPT [root@server3 ~]# iptables -A INPUT -s 10.10.33.101 -j ACCEPT [root@server3 ~]# iptables -A INPUT -s 10.10.0.0/16 -j DROP [root@server3 ~]# iptables -L Chain INPUT (policy ACCEPT) target     prot opt source               destination         ACCEPT     all  --  10.10.33.2           anywhere            ACCEPT     all  --  www.server3.co.kr    anywhere            ACCEPT     all  --  10.10.33.101         anywhere            DROP       all  --  10.10.0.0/16         anywhere           Chain FORWARD (policy ACCEPT) target     prot opt source               destination         Chain OUTPUT (policy ACCEPT) target     prot opt source               destination         [root@server3 ~]# service iptables stop 방화벽 규칙을 /etc/sysconfig/iptables에 저장 중:           [  OK  ]  - iptables의 설정이 /etc/sysconfig/iptables에 저장된다. 방화벽 규칙을 삭제하는 중:                                 [  OK  ] chains를 ACCEPT 규칙으로 설정함: filter                    [  OK  ] iptables 모듈을 제거하는 중:                               [  OK  ] [root@server3 ~]# cat /etc/sysconfig/iptables # Generated by iptables-save v1.3.5 on Mon Feb  2 17:20:33 2009 *filter :INPUT ACCEPT [165:31163] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [612:89553] -A INPUT -s 10.10.33.2 -j ACCEPT -A INPUT -s 10.10.33.3 -j ACCEPT -A INPUT -s 10.10.33.101 -j ACCEPT -A INPUT -s 10.10.0.0/255.255.0.0 -j DROP COMMIT # Completed on Mon Feb  2 17:20:33 2009 [root@server3 ~]# service iptables start iptables 방화벽 규칙들을 적용하는 중:                      [  OK  ] 추가 iptables 모듈을 읽어오는 중: ip_conntrack_netbios_ns  [  OK  ] [root@server3 ~]# iptables -L - iptables 서비스를 재시작해도 설정값이 초기화 되지 않고 적용되어 있다. Chain INPUT (policy ACCEPT) target     prot opt source               destination         ACCEPT     all  --  10.10.33.2           anywhere            ACCEPT     all  --  www.server3.co.kr    anywhere            ACCEPT     all  --  10.10.33.101         anywhere            DROP       all  --  10.10.0.0/16         anywhere            Chain FORWARD (policy ACCEPT) target     prot opt source               destination         Chain OUTPUT (policy ACCEPT) target     prot opt source               destination         [root@server3 ~]#