Moxa TC-6110-T-LX [42/117] Rule examples applying user defined chains
Макгруп McGrp.ru
Задайте вопрос
Зарегистрироваться

Moxa TC-6110-T-LX [42/117] Rule examples applying user defined chains

Moxa TC-6110-T-LX [42/117] Rule examples applying user defined chains
TC-6110 Linux User's Manual Managing Communications
3-24
ATTENTION
ICMP
v6 Neighbor Discovery packets will always be classified INVALID
(if you don’t know what this means, you
can probably ignore it)
. You may accept them with this rule:
# iptables -A INPUT -p 41 -j ACCEPT
Example 1: Accept TCP packets from 192.168.0.1.
# iptables –A INPUT –i eth0 –p tcp –s 192.168.0.1 –j ACCEPT
Example 2: Accept TCP packets from Class C network 192.168.1.0/24.
# iptables –A INPUT –i eth0 –p tcp –s 192.168.1.0/24 –j ACCEPT
Example 3: Drop TCP packets from 192.168.1.25 (this rule is only necessary on firewalls where you have set
the INPUT policy to ACCEPT; this is not recommended).
# iptables –A INPUT –i eth0 –p tcp –s 192.168.1.25 –j DROP
Example 4: ACCEPT all TCP packets addressed for port 21.
# iptables –A INPUT –i eth0 –p tcp --dport 21 –j ACCEPT
Example 5: Accept TCP packets from 192.168.0.24 to TC-6110-LX’s port 137, 138, 139
# iptables –A INPUT –i eth0 –p tcp –s 192.168.0.24 --dport 137:139 –j ACCEPT
Example 7: Log TCP packets that visit TC-6110-LX’s port 25.
# iptables –A INPUT –i eth0 –p tcp --dport 25 –j LOG
ATTENTION
To use the rule in
Examples 8 and 9, below, remember to first, to load the module ipt_mac:
moxa@MOXA:~# modprobe ipt_mac.
To make a module load across reboots, you may add it to the /etc/modprobe.conf file
using this command:
moxa@MOXA:~# echo “ipt_mac” >> /etc/modprobe.conf
Don’t forget to backup your modprobe.conf file before altering it, and take care to
use the double pointer (>>)
—which is append—
rather the single pointer (>) which is
overwrite.
Example 8: Drop all packets from MAC address 01:02:03:04:05:06.
# iptables –A INPUT –i eth0 –p all –m mac --mac-source 01:02:03:04:05:06 –j DROP
Example 9: Accept all packets from MAC address 02:03:04:05:06:07.
# iptables –A INPUT –i eth0 –p all –m mac --mac-source 02:03:04:05:06:07 –j ACCEPT
Rule Examples: Applying User-Defined Chains
Some network administrators may find it useful to define their own rule chains. Here, we show how to
implement them in the INPUT chain, and use the chains defined above, in the section User-Defined Chains.
# iptables -A INPUT -p udp -m conntrack --ctstate NEW -j UDP
# iptables -A INPUT -p tcp --syn -m conntrack --ctstate NEW -j TCP
The TCP and UDP chains are now attached to the INPUT chain; by adding in the above connection rule, once
a connection is accepted by either chain, it will be handled by the RELATED/ESTABLISHED rule. You may now
add rules to these chains as if you were adding rules to the INPUT chain. Using some of the INPUT rules defined
above as examples:
# iptables -A TCP -p tcp --dport 80 -j ACCEPT
# iptables -A TCP -p tcp --dport 443 -j ACCEPT
# iptables -A TCP -p tcp --dport 22 -j ACCEPT
# iptables -A UDP -p udp --dport 53 -j ACCEPT
ATTENTION
Sample firew
alls are provided in Appendix C, Sample Scripts
. If you have further questions, please refer to
those.

Содержание

Похожие устройства

Скачать