Linux/Exercise
네트워크 서비스 보안 - iptables 예제(2)
뺀
2009. 2. 2. 17:30
10.10.33.2 , 10.10.33.3, 10.10.33.101 만 접속을 허락하고 나머지 IP 대역은 접근을 무시한다.
| [root@server3 ~]# vi /etc/sysconfig/iptables-config - iptabels 설정파일 # Save current firewall rules on stop. # Value: yes|no, default: no # Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped # (e.g. on system shutdown). #IPTABLES_SAVE_ON_STOP="no" IPTABLES_SAVE_ON_STOP="yes" - "no" 를 "yes"로 바꿔준다. [root@server3 ~]# iptables -A INPUT -s 10.10.33.2 -j ACCEPT [root@server3 ~]# iptables -A INPUT -s 10.10.33.3 -j ACCEPT [root@server3 ~]# iptables -A INPUT -s 10.10.33.101 -j ACCEPT [root@server3 ~]# iptables -A INPUT -s 10.10.0.0/16 -j DROP [root@server3 ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 10.10.33.2 anywhere ACCEPT all -- www.server3.co.kr anywhere ACCEPT all -- 10.10.33.101 anywhere DROP all -- 10.10.0.0/16 anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@server3 ~]# service iptables stop 방화벽 규칙을 /etc/sysconfig/iptables에 저장 중: [ OK ] - iptables의 설정이 /etc/sysconfig/iptables에 저장된다. 방화벽 규칙을 삭제하는 중: [ OK ] chains를 ACCEPT 규칙으로 설정함: filter [ OK ] iptables 모듈을 제거하는 중: [ OK ] [root@server3 ~]# cat /etc/sysconfig/iptables # Generated by iptables-save v1.3.5 on Mon Feb 2 17:20:33 2009 *filter :INPUT ACCEPT [165:31163] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [612:89553] -A INPUT -s 10.10.33.2 -j ACCEPT -A INPUT -s 10.10.33.3 -j ACCEPT -A INPUT -s 10.10.33.101 -j ACCEPT -A INPUT -s 10.10.0.0/255.255.0.0 -j DROP COMMIT # Completed on Mon Feb 2 17:20:33 2009 [root@server3 ~]# service iptables start iptables 방화벽 규칙들을 적용하는 중: [ OK ] 추가 iptables 모듈을 읽어오는 중: ip_conntrack_netbios_ns [ OK ] [root@server3 ~]# iptables -L - iptables 서비스를 재시작해도 설정값이 초기화 되지 않고 적용되어 있다. Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 10.10.33.2 anywhere ACCEPT all -- www.server3.co.kr anywhere ACCEPT all -- 10.10.33.101 anywhere DROP all -- 10.10.0.0/16 anywhere Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@server3 ~]# |