1.Linux Firewall 51 NAT

2. I7?!E71 o Firewall F"*i1i"i1= i%l 0 Linux Firewall0 Linux | PTab| es 39$0 Linux NAT 39$')'l, l"I0 Transparent Proxy axm P-2 3. Firewall Fifi 4. Firewall Fifio Firewall (|3)J'9zz"E - i RedHat 5-51 CentOS WEE Firewall 3- EEUEQIPE ? ?$- / etc/ sysconfig/ iptables (ipv4)- / etc/ sysconfig/ ip6tab| es (ipv6) - , %EfeEPBElEttP%P- / etc/ init. d/iptables {start I stop I restart} - / etc/ init. d/ip6tab| es {start I stop I restart} P-15 16. |PTab| es $El@.3El; ': i%l 17. iPTai: ies tflitieo | PTab| es Table I791? - iptables iZZilXla= '1a2Pl3i$iz%i3=fXla table IEE- E'= ..? $9"i=3?Ef%, %iEH%l7iE,9.t-3 table I79EJ%EUi$iTrl: l:'t I i=3 $9"i=3E%lE'$9"i=3l; i3}l; Hf. H?} T?E?tablel I791%EP. |lE?tab| e2 I791%EPJlE?tab| e..Wt P-17 18. iPTai: ies %@. :3ElP; o | PTab| es Table I791? - iptables ElJ table TEEfilter table nat tablemangle table raw tableP-18 19. iPTai: ies tflitieo | PTab| es Table I791? - filter table W34] chain TEEfilter tableINPUT . t El OUTPUTiiijt, FORWARDiittttil ll1 313 El F.P-19 20. iPTai: ies tflitieo | PTab| es Table I791? - nat table 7934] chain TEEnat table ':5;2;PREROUTING II tieOUTPUT POSTROUTINC Viiiji. P-20 21. iPTai: ies tflitieo | PTab| es Table I791? - mangle table V934] chain TEEmangle table I PREROUTINC*i! '-7iii, 'l".0%POSTROUTINGiiiji, INPUTOUTPUTFORWARD P-21 22. |PTab| es $JEl? El; 'o | PTab| es iiieiiii eA$amaa eemaa eeaaiaaaPREROUTI NG FORWARD POSTROUTI NG ( nat table )( nat table ) (filter table) OUTPUT(filter table )2lSl'e': -': |:'il5lJ$= iEOUTPUT ( nat table )I 2lSttiit| dE - n %7TJr3IH%P)TlElHI34J? E?E - E_lJ)I, %HI3 Active Mode ,Passive Mode I7E7jJE%, I$-$EHIEE - IZEIIEKIEIIETJEEEEEEE port EEHPEEEEHHEPETIEP-59 59. Ei rewall ,1 ET? 0 lPTables Firewall E5-1 FTP- Active Mode I3$H'IIEE A * B2021 2000 command channel 2100 Command Channel data Channel IEFH Port I: I"% server P-60 60. Firewall iii FTPo lPTables Firewall 5! FTP - Active Mode IEEEIIEEEEEHE - Client IIEH (EH3 Port 1024 ? LiZIlE|Port ZEIEEE Server 1%vPort 7"fElT Server EITEEE9 Port , %IE'r'? l;*H - Server IIrI= JX Port 20 EA:3%?Client TEEE9 Port i$I_Ii: ?r3I IEEEH - Active Mode ? E?EIHH'I%3R - Command :(client > port 1024) 9 server port 21- Data:(client > port 1024) 9 server port 20P-61 61. Firewall iii FTPo lPTables Firewall 51 FTP - Passive Mode IEEITITEEE 7I T '1" I I-.: , l_IL, LL" 1;. 2L IJLJL" E1command channel__ If ,Ln, : pI. .**l5rfI I __; . If data channel 62. Firewall E1 FTPo lPTables Firewall 1 FTP - Passive Mode IQEIEEIIEEEEEEEE - Client IIrIEi_? E PASV fli Server IITTEIEHH Passive Mode ? EI: II%iPJrrI, $I3? E - Server II#75(I%'73i Port 1024 ? LiZIlE|Port ZEIEEE Clientv "/ TEEIJ Client IHEEITEEE9 Port , %lnE'aHl; *E - Client 1%:E32 Server TEEEI9 Port i$? _I3?T5II; ,$I - Passive Mode ? E%EIHH'l%R - Command :(client > port 1024) 9 server port 21 - Data:(client > port 1024) 9 (server > port 1024)P-63 63. Firewall E1 FTPo lPTables Firewall 1 FTP- EQE :$I%I%I%E-HIE ssh E ftp HE? ?? v HIIIJ%E}THR'%%JJ:- modprobe nf_conntrack_ftp - iptables A INPUT m state stateESTABLISHED, RELATED j ACCEPT iptables A INPUT I I0 j ACCEPT - iptables -A INPUT p tcp dport 21 j ACCEPT - iptables A INPUT p tcp dport 22 j ACCEPT - iptables A INPUT m state state NEW, INVALIDj DROPP-64 64. NAT IHIEIEEI-EEEE 65. NAT I)JIo NAT (Network Address Translation) - EEHH - NATNetwork Address Translation - NAT TEIEETEIEHEWBU IP I$zilI%EE5Z, ?.%"IJIE - NAT IEEIDXEQ/ ?% SNAT E DNAT EEWEEEQP-66 66. NAT %| HI't. ?%I%Ii%i%0 NAT i%iR7F7E". ..11>:192.168.1.111>:192.168.1.2EIP:192.168.1.3IP:61.16.1.254I" _I External IQ.Internal| EaaD61.16.1.1192.168.1.254NAT Server P-67 67. NAT I)JIo NAT 1 Private IP - E - EZEEEEEE IP I1_EI79f: i|1,%| HHIFIH ~ 7f3"': IjiEI1( internet 1%-1%- RFC 1918 PSI Private IP EEE- Class A:10.0.0.0 ~~ 10.255.255.255 - Class B:172.16.0.0 ~~172.31.255.255 - Class C:192.168.0.0 ~~ 192.168.255.255P-68 68. NAT I)JIo NAT (Network Address Translation) - NAT 13:11 - SNAT - TFEIJTEIEEIE IP E1JE5Z, ?.%? $,1* - F. %: HEE(1EI9E%T3E Private IP JZGEJ:Internet - DNAT - IZTEI: /EEEEI/ J IP ElJE5Z, ?.%? $: ,1* - ETEIEEEUEETEIDHEP-69 69. NAT %| .| f: ?= I%1E1%J0 SNAT i%i%7F%T192.168.1.254/24192.168.1.1/24 InternetNAT RouterH TERH :192.168.1.0/24 Client 2% Internet at ._ .7 %|1%%ENATl? l%11-2.E1161.l6.1.lEZIPEIETEHR192.168.1.2J24P-70 70. NAT %| .| . ?= I5.1E1%0 DNAT i%i%7_F77192.168.1.254/24192.168.1.1/24 InternetNAT RouterWEFH :Internet EEEWEEEEU 61 .16.1.1 :80 BE F$$? i:7I 192.1 68.1 .1 :80P-71 71. IP Forwarding0 Linux Kernel IPv4 Forwarding - EEHI1 - E11 Linux 12/E, lEEIP= '.''zT: fBE"t$1@$: ii}? E ( IP Forward ) IDEE - 7IE. ?%%1flt'I? .E1 / etc/ sys/ net/ ipv4/ip_fonlvard - EEEEEE- E-H131 - echo1 > / proc/ sys/ net/ ipv4/ip_forward- echo 0 > / proc/ sys/ net/ ipv4/ip_fon/ vardP-72 72. IP Forwardingo lPTables I79 IPv4 Forward 1%$| J - ERHH - EE iptables %E*51$%fBE4F ip forwarding DJEE - EEIE - 1EEfeE4F$1@; %E FORWARD chain iptables P FORWARD ACCEPT - 1EEE%JJ: $1@i; 3E FORWARD chain iptables -P FORWARD DROPP-73 73. IP Forwardingo lPTables I79 IPv4 Forward 1%$| J- IIEHUEBEEEEETEEE - iptables P FORWARD ACCEPT - iptables A FORWARD s 192.168.1.1 j DROPP-74 74. Sll/ LT E? o lPTables l79EI~J SNAT EEE - IEFIHEEEE - j SNAT tosource ipaddr[ipaddr][: portport] - j MASQUERADE- IEFIHEIE - 11. EE71( nat table 179134] POSTROUTING chain IEHHP-75 75. Sll/ LT E? o lPTables l79EI~J SNAT EEE - - EEEE SNAT I7JlEE%3 Private IP HD1111: Internet - IEFIH MASQUERADE 32 target rule- $%&EE75EE - echo "1" > / proc/ sys/ net/ ipv4/ip_forward - iptables -t nat A POSTROUTING -0 eth0s192.168.1.0/24 j MASQUERADEP-76 76. Sll/ LT E? o lPTables l79EI~J SNAT EEE - 59% SNAT IDEEEE Private IP El/ X111: Internet - EH1 SNAT E2 target rule- Ef - echo "1 > / proc/ sys/ net/ ipv4/ip_forward - iptables -t nat A POSTROUTING -0 eth0s192.168.1.0/24 j SNAT to P-77 77. SNAT 1 FTP EEE0 lPTables |7:192.168.1.111>:192.168.1.2EIP:192.168.1.3 IP:61.16.1.254Switch /HUBethl:192.168.1.254Proxy Server + NAT P_83 83. Transparent Proxy0 Transparent Proxy - squid proxy squid. conf 7f= ..? $%