\documentclass[letterpaper,english]{article}
\nonstopmode
\akai
\usepackage{linuxdoc-sgml}
\usepackage{qwertz}
\usepackage{url}
\usepackage[latin1]{inputenc}
\usepackage{t1enc}
\usepackage[english]{babel}
\usepackage{epsfig}
\usepackage{null}
\def\addbibtoc{
\addcontentsline{toc}{section}{\numberline{\mbox{}}\relax\bibname}
}%end-preamble
\setcounter{page}{1}
\title{Linux 2.4 Packet Filtering HOWTO}
\author{×÷Õß£ºRusty Russell, mailing list {\ttfamily netfilter@lists.samba.org}\\ 
ÒëÕß£ºÍøÖÐÈË {\ttfamily netmanforever@yahoo.com}}
\date{v1.0.1 Mon May  1 18:09:31 CST 2000}
\abstract{´ËÎÄ¼þÃèÊöÈçºÎÔÚ 2.4 Linux kernel ÉÏÊ¹ÓÃ iptables ¶Ô²»Á¼·â°ü½øÐÐ¹ýÂË¡£}


\begin{document}
\maketitle
\tableofcontents

\section{Introduction\label{intro}}

¸÷Î»¿´¹Ù£¬»¶Ó­µ½´ËÒ»¶Á£¡



ÕâÀï£¬ÎÒ¼ÙÉèÄúÒÑ¾­ÖªµÀÊ²÷áÊÇ IP µØÖ·¡¢ÍøÂ·µØÖ·¡¢ÍøÂ·ÕÚÕÖ (netmask)¡¢Â·ÓÉ¡¢ÒÔ¼° DNS¡£·ñÔò£¬ÎÒ½¨ÒéÄúÏÈ¶ÁÒ»¶Á Network Concepts HOWTO¡£



´Ë HOWTO ÎÄ¼þ²»Ö¹ì¶ÊÇÒ»¸öµãµ½¼´Ö¹µÄ½éÉÜ(ÈÃÄúÓÐµã·¢ÈÈºÍ·¢Ã«£¬µ«ÓÖÈâÔÚÕèÉÏµÄ¸Ð¾õ)£¬Ò²²»ÖÁì¶ÊÇÒ»¸ö³éË¿°þ¼ëÊ½µÄÔ­Ê¼´óÅûÂ¶(ÈÃÄú±ØÓÐËù»ñ£¬µ«²»»áÉñ¾­´íÂÒ¡¢×ß»ðÈëÄ§)¡£



ÄúµÄÍøÂ·ÆäÊµÒ»µãÒ²²»{\bfseries °²È«}¡£ÎÊÌâÄÑµãÊÇÔÚÔÊÐí¿ìËÙ¶ø±ãÀûÍ¨Ñ¶Ö®Í¬Ê±£¬ÓÖÏëÈ·±£ËüÖ»ÓÃì¶Á¼ºÃÇÒ·ÇÐ°¶ñµÄÒâÍ¼¡£ÆäÇéÐÎµÈÍ¬ì¶ÔÚÒ»¸öÓµ¼·µÄÏ·ÔºÀïÃæ£¬ÔÊÐíÄú¸ßÌ¸À«ÂÛ£¬µ«È´²»ÄÜÂÒº°¡°Öø»ðÀ²£¡¡±Ò»Ñù¡£ÕâÆª HOWTO ²»ÊÇÓÃÀ´½â¾öÕâÎÊÌâµÄ¡£



ËùÒÔ£¬Ö»ÓÐÄú²ÅÄÜ¾ö¶¨ºÎ´¦²ÅÊÇÕÛÖÔËùÔÚ¡£ÎÒ»á³¢ÊÔÖ¸ÒýÄúÈ¥Ê¹ÓÃÒ»Ð©¿ÉÓÃ¹¤¾ß£¬Ò²»áµã³öÒªÁôÒâµÄËÀÑ¨£¬µ±È»£¬Í¬Ê±Ï£ÍûÄúÓÃì¶ÕýÍ¾Ö®ÉÏ¡£ÓÖÊÇ(ÓëÉÏ¾ä)Í¬µÈµÄÎÊÌâ¡£




\section{¹Ù·½µÄÍøÕ¾ÔÚÄÄÀï£¿ÓÐÓÊ¼þÂÛÌ³Âð£¿}

ÓÐÈý¸ö¹Ù·½ÍøÕ¾·ÇÈ¥²»¿É:
\begin{itemize}
\item ¸ÐÐ»\nameurl{http://netfilter.filewatcher.org}{Filewatcher (http://netfilter.filewatcher.org)}.
\item ¸ÐÐ» \nameurl{http://www.samba.org/netfilter}{The Samba Team and SGI (http://www.samba.org/netfilter)}.
\item ¸ÐÐ»\nameurl{http://netfilter.kernelnotes.org}{Jim Pick (http://netfilter.kernelnotes.org)}.
\end{itemize}




ÖÁì¶¹Ù·½µÄ netfilter ÓÊ¼þÂÛÌ³£¬Çë²ÎÔÄ£º
\nameurl{http://lists.samba.org}{Samba's Listserver (http://lists.samba.org)}.




\section{ºÃÁË£¬Ê²÷áÊÇ·â°ü¹ýÂË(Packer Filter)ÄØ£¿}

·â°ü¹ýÂË¾ÍÊÇÓÃÒ»¸öÈíÌå²é¿´ËùÁ÷¾­·â°üÖ®{\itshape ±íÍ·(header)\/} £¬ÓÉ´Ë¾ö¶¨Õû¸ö·â°üµÄÃüÔË¡£Ëü»òÐí»á¾ö¶¨ {\bfseries ¶ªÆú(DROP)} Õâ¸ö·â°ü(ÀýÈç£¬ºöÂÔËü¾ÍÈç¸ù±¾Ã»ÊÕµ½ËüÒ»Ñù)£¬»òÊÇ{\bfseries ½ÓÊÕ(ACCEPT)}Õâ¸ö·â°ü(ÀýÈç£¬ÈÃÕâ¸ö·â°üÍ¨¹ý)£¬»òÊÇÆäËü¸ü¸´ÔÓµÄ¶¯×÷¡£



ÔÚ Linux Ö®ÏÂ£¬·â°ü¹ýÂË¹¦ÄÜÊÇÄÚ½¨ì¶ºËÐÄÖ®ÄÚ(×öÎªÒ»¸öºËÐÄÄ£×é£¬»òÕßÖ±½ÓÄÚ½¨)£¬Í¬Ê±»¹ÓÐÒ»Ð©¼¼ÇÉÎÒÃÇ¿ÉÒÔÔËÓÃì¶·â°üÖ®ÉÏµÄ£¬²»¹ý×î¹ßÓÃµÄÒÀÈ»ÊÇ²é¿´±íÍ·ÒÔ¾ö¶¨·â°üµÄÃüÔË¡£




\subsection{ÎÒÎªÊ²÷áÒª·â°ü¹ýÂË£¿}

¼ò¶øÑÔÖ®£º¿ØÖÆ¡¢±£°²¡¢¾¯½ä¡£



\begin{description}
\item[Control:] \mbox{}

µ±ÄúÓÃÄúµÄ Linux Ö÷»ú½«ÄúµÄÄÚ²¿ÍøÂ·Á¬½ÓÖÁÆäËüÍøÂ·(±È·½Ëµ£¬ineternet)µÄÊ±ºò£¬ÄúÓÐ»ú»áÔÊÐíÌØ¶¨ÀàÐÍµÄ½»Í¨£¬¶ø½ûÖ¹ÆäËüµÄ¡£ ÀýÈç£¬Ò»¸ö·â°üµÄ±íÍ·»á°üº¬·â°üµÄÄ¿µÄµØµØÖ·£¬ËùÒÔÄú¿ÉÒÔ·ÀÖ¹·â°üÁ÷ÏòÍâ²¿ÍøÂ·µÄÄ³Ò»²¿·Ý¡£ÔÙÈç£¬ÎÒÓÃ Netscape Á¬ÏßÖÁ Dilbert archives£¬ÄÇÍøÒ³ÉÏÓÐÒ»¸öÀ´×Ô doubleclick.net µÄ¹ã¸æ£¬ÕâÑù Netscape »áÀË·ÑÎÒµÄÊ±¼äÈ¥ÏÂÔØËüÃÇ¡£Ö»ÒªÈÃ·â°ü¹ýÂË»úÖÆ²»ÔÊÐíÈÎºÎÀ´×Ôdoubleclick.net µÄ·â°ü£¬ÎÒÃÇ¾Í¿ÉÒÔ½â¾öÕâ¸öÎÊÌâ(µ±È»£¬ÓÐ¸üºÃµÄ·½·¨À´×öÕâ¼þÊÂÇéÀ²£¬Çë²Î¿¼ Junkbuster)¡£



\item[Security:] \mbox{}

µ±ÄúµÄ Linux Ö÷»úÊÇÄú¾®È»ÓÐÐòµÄÄÚ²¿ÍøÂ·ºÍÍâÃæÄÇ¸ö»ìãçÎÞ±ÈµÄ internet Ö®¼äµÄÎ¨Ò»Í¨µÀ£¬¶øÄúÖªµÀ¿ÉÒÔÏÞÖÆÄÄÐ©¶«Î÷²ÅÄÜ½øÈëÄúµÄÃÅ»§£¬³ÏÊÇ²»´íÖ®¾Ù°É¡£ÀýÈç£¬Äú»òÐí»á·ÅÐÐÈÎºÎ´ÓÄÚ²¿ÍøÂ·³öÈ¥µÄ¶«Î÷£¬µ«ÓÖµ£ÐÄÀ´×ÔÍâÃæµÄ¶ñÃûÕÑÕÂµÄ¡®Ping of Death¡¯¡£ÓÖÈç£¬Äú»òÐí²¢²»Ï£Íû±ðÈË´ÓÍâÃæ telnet ÉÏÄúµÄ Linux Ö÷»ú£¬¾¡¹ÜÈ«²¿µÄÕÊºÅ¶¼ÓÐÃÜÂë±£»¤¡£»òÐí£¬Äú»¹Ïë(ÕýÈç´ó²¿·ÝÈËÒ»Ñù)ÔÚ internet ÉÏµ±¿´¿Í¶ø²»Ô¸µ±ËÅ·þÆ÷(Ò²¿ÉÄÜÄúÊÇÔ¸ÒâµÄ) £¬×î¼òµ¥ÄªÈçÓÃ·â°ü¹ýÂËÀ´¾Ü¾øÈÎºÎÒâÓûÁ¬ÏßµÄ·â°ü£¬²»ÈÃÈÎºÎÈËÁ¬½øÀ´¡£



\item[Watchfulness:] \mbox{}

ÓÐÊ±ºò£¬Ò»Ì¨Éè¶¨²îÁÓµÄ»úÆ÷»á´Ó±¾µØÍøÂ·ÏòÍâÃæÅ»ËÍ·â°ü¡£¶øºÃÏûÏ¢ÊÇÄú¿ÉÒÔÈÃ·â°ü¹ýÂËÀ´¸æËßÄúÊÇ·ñÓÐ±äÌ¬µÄÊÂÇé·¢Éú¡£Äú»òÐí»á¶ÔÖ®²ÉÈ¡ÐÐ¶¯£¬ÓÖ»òÐíÔçÒÑ¼û¹ß²»¹ÖÁË¡£

\end{description}





\subsection{ÈçºÎÔÚ Linux ÏÂ¹ýÂË·â°ü£¿\label{filter-linux}}

Linux µÄºËÐÄ×Ô´Ó 1.1 °æ¾ÍÒÑ¾­ÓÐ·â°ü¹ýÂË¹¦ÄÜ¡£µÚÒ»´úÊÇ 1994 ÄêÓÉ Alan Cox »ùì¶ BSD µÄ ipfw ÒÆÖ²¹ýÀ´µÄ£¬ááÀ´ÔÚ Linux 2.0 °æ±¾ÔÙÓÉ Jos Vos ¼ÓÇ¿£¬ÀûÓÃ ' ipfwadm ' ÕâÖ»Ê¹ÓÃÕß¿Õ¼ä(userspace *)¹¤¾ßÀ´¿ØÖÆºËÐÄµÄ¹ýÂË¹æÔò¡£ÔÚ 1998 ÄêÄêÖÐ£¬ÎÒÔÚ Micahel Neuling µÄ´óÁ¦°ïÖúÏÂ£¬Í¶×¢ÁËÏàµ±µÄ¾«Á¦ÔÚ Linux ºËÐÄ 2.2 ÉÏÃæ£¬ÍÆ³öÁË ' ipchains ' ÕâÖ»¹¤¾ß¡£ÖÕì¶£¬Linux ºËÐÄ 2.4 µÄµÚËÄ´ú¹¤¾ß ' iptables ' Á¬Í¬ÆäËüºËÐÄ¸ÄÐ´Ò²ÔÚ 1999 ÄêÄêÖÐ½øÐÐ¿ª·¢ÁË¡£Õâ¾ÍÊÇÄ¿Ç°Õâ¸ö iptables µÄ HOWTO ÎÄ¼þËùÖÂÁ¦Ö®ËùÔÚ¡£



 (* ÒëÕß×¢£º¡°Ê¹ÓÃÕß¿Õ¼ä¡±Í¨³£ÊÇÓÃÀ´Çø±ðÏµÍ³¼ÇÒäÌåµÄÊ¹ÓÃ¡õÎ§£¬Ö÷ÒªÀàÐÍ·ÖÎªºËÐÄ¿Õ¼äºÍÊ¹ÓÃÕß¿Õ¼ä¡£Ô­×÷Õß¿ÉÄÜÒÔÎª´ó¼Ò¶¼ÊÇ³ÌÊ½¸ßÊÖ£¬¹Ê»áÓÃÈç´Ë×¨ÃÅÊõÓï¡£È»¶ÔÒ»°ã¶ÁÕßÀ´Ëµ£¬Àí½âÉÏ»òÐíÓÐÀ§ÄÑ£¬¹Ê´Ë¶àËµÁ½¾ä¡£ÔÚÍùááµÄÔÄ¶ÁÖÐÒ²ÇëÁôÒâ¡£)





ÄúÐèÒªÒ»¸öºËÐÄÓÐ netfilter ½¨¹¹ì¶ÆäÖÐ£ºnetfilter ÊÇ Linux ºËÐÄÖÐÒ»¸öÍ¨ÓÃ¼Ü¹¹£¬¿ÉÒÔÈÃÆäËü¶«Î÷(ÀýÈç iptables Ä£×é) ²åÈë(plug into)¡£»»¾ä»°Ëµ£¬ÄúÐèÒªºËÐÄ 2.3.15 »ò¸üÐÂµÄ°æ±¾£¬Í¬Ê±ÔÚºËÐÄ±àÒëÊ±ÒÔ ' Y ' »Ø´ð CONFIG\_NETFILTER Õâ¸öÑ¡Ïî¡£



{\ttfamily iptables} ÕâÖ»¹¤¾ß»áºÍºËÐÄ¶Ô½²²¢¸æËßËüÊ²÷á·â°üÒª¹ýÂË¡£³ý·ÇÄúÊÇÒ»¸ö³ÌÊ½ÈËÔ±£¬»òÒìÏëÌì¿ª£¬ÄÇÄú¾ÍÊÇÓÃËüÀ´¿ØÖÆ·â°üÔõÑù¹ýÂËµÄÁË¡£




\subsubsection{iptables}

ÕâÖ» {\ttfamily iptables} ¹¤¾ß¿ÉÒÔ²åÈë»òÒÆ³ýºËÐÄ·â°ü¹ýÂË±í¸ñ(packet filtering table) ÖÐµÄÒ»Ð©¹æÔò(rules)¡£Ò²¾ÍÊÇËµ£¬ÎÞÂÛÄúÉè¶¨ÁËÊ²÷á£¬ÒªÊÇÖØÐÂÆô¶¯(reboot)ÏµÍ³µÄ»°£¬¾Í»áÈ«²¿¶ªÊ§£»Çë²ÎÔÄ \ref{permanent} {(ÖÆ¶¨ÓÀ¾ÃÐÔ¹æÔò(Making Rules Permanent))}£¬ ¿´¿´ÈçºÎÈ·±£Éè¶¨ÔÚÏÂ´Î Linux Æô¶¯áá¿ÉÒÔ»Ø´æ¡£



{\ttfamily iptables}  ÊÇÓÃÀ´È¡´ú {\ttfamily ipfwadm} ºÍ {\ttfamily ipchains} µÄ£ºÇë²ÎÔÄ \ref{oldstyle} {(Ê¹ÓÃ ipchains ºÍ ipfwadm (Using ipchains and ipfwadm))}£¬ ¿´¿´ÈçºÎÎÞÍ´µÄ±ÜÃâÊ¹ÓÃ iptables£¬¼ÙÈçÄúÄ¿Ç°ÕýÊ¹ÓÃËüÃÇÆäÖÐÖ®Ò»¡£




\subsubsection{ÖÆ¶¨ÓÀ¾ÃÐÔ¹æÔò\label{permanent}}

ÄúÄ¿Ç°µÄ·À»ðÇ½Éè¶¨ÊÇ´¢´æì¶ºËÐÄÀïÃæµÄ£¬Ò²ÕýÒòÈç´Ë£¬Éè¶¨»áÔÚÏµÍ³ÖØÆôáá¶ªÊ§¡£iptables-save ºÍ iptables-restore  * µÄ×«Ð´Ä¿Ç°ÒÑ¾­±»ÁÐÈë TODO ÁÐ±íÖÐÁË¡£ÎÒ±£Ö¤µ±ËüÃÇÎÊÊÀµÄÊ±ºò£¬¿Ï¶¨·Ç³£°ô¡£



(* ÒëÕß×¢£ºÔÚ ipchains ¹¤¾ßÖÐ£¬¿ÉÒÔÊ¹ÓÃ ipchains-save Óë ipchains-restore À´°Ñµ±Ç°µÄ·À»ðÇ½Éè¶¨´¢´æÆðÀ´£¬ÒÔ¼°½«Ö®»¹Ô­¡£Èç¹û¶ÁÕßÃ»Ê¹ÓÃ¹ý ipchains ÄÇÁ½¸ö¹¦ÄÜµÄ»°£¬»òÐí²»ÖªµÀ×÷ÕßÔÚËµÊ²÷á¡£)



Ä¿Ç°À´Ëµ£¬¾Í°ÑÉè¶¨¹æÔòËùÐèµÄÄÇÐ©ÃüÁîÐ´½øÒ»¸ö³õÊ¼ÃüÁî¸å(script)ÖÐ°É¡£ÒªÈ·¶¨µÄÊÇ£¬¼ÙÈçÓÐÆäÖÐÒ»¸öÃüÁîÊ§°ÜµÄÊ±ºò£¬ÄúÄÜÌá¹©Ò»Ð©ÖÇÄÜµÄ¶¯×÷·´Ó¦ (Í¨³£Èç ' exec /sbin/sulogin' )¡£




\section{ÄãËãÄÄ¸ù´Ð°¡£¿ÎªºÎÍæÎÒµÄºËÐÄ£¿}

ÎÒÊÇ Rusty£¬ÊÇ Linux IP ·À»ðÇ½µÄÎ¬»¤Õß£¬Í¬Ê±Ò²½øÐÐÆäËüµÄÒ»Ð©±à³Ì¹¤×÷£¬¿ÉÒÔËãÊÇÌìÊ±µØÀûÈËºÍµÄÊ¹È»°É¡£ÎÒÐ´¹ý ipchains (Çë²ÎÔÄÇ°ÃæµÄ \ref{filter-linux} {(ÈçºÎÔÚ Linux ÏÂ¹ýÂË·â°ü£¿(How Do I Packet Filter Under Linux?))}£¬ ¿´¿´Êµ¼ÊµÄ¹¤×÷ÉÐµÃÒæì¶ÄÄÐ©Í¬ÈÊ)£¬´ÓÆäÖÐÑ§µ½×ã¹»µÄ¶«Î÷ÒÔ¿ïÕý½ñ´ÎµÄ·â°ü¹ýÂË¡£ÎÒÏ£ÍûÈç´Ë¡£



\nameurl{http://www.watchguard.com}{WatchGuard} ÊÇÒ»¸ö·Ç³£³öÉ«·À»ðÇ½¹«Ë¾£¬³öÊÛÕæÕýºÃÓÃµÄËæ²åÊ½·À»ðÇ½Éè±¸(plug-in Firebox)£¬ÇÒÏòÎÒÃâ·ÑÌá¹©£¬ÈÃÎÒ¿ÉÒÔÈ«Á¦×«Ð´ÕâÐ©¶«Î÷£¬ÒÔ¼°Î¬»¤¹ýÍùµÄÒ»Ð©¶«Î÷¡£ÎÒÔ­±¾Ô¤¹À 6 ¸öÔÂ¾Í¿ÉÒÔÁË£¬µ«Êµ¼ÊÉÏÈ´»¨ÁË 12 ¸öÔÂ£¬²»¹ýÎÒÔÚ×îáá½×¶Î¾õµÃ×öµÃ»¹²»´í¾ÍÊÇÁË¡£¶à·­ÖØÐ´¡¢Ó²µú»Ù»µ¡¢ÊÖÌáµçÄÔÔâÇÔ¡¢Êý¸öµµ°¸ÏµÍ³µÄËð»Ù¡¢ÒÔ¼°ááÀ´µÄÓ«Ä»»µµô£¬×îÖÕ£¬»¹ÊÇ×ö³öÀ´ÁË¡£



ÔÚÕâÀï£¬ÎÒÏë³ÎÇåÒ»Ð©ÅóÓÑµÄ´íÎó¹ÛÄî£ºÎÒ²¢·ÇºËÐÄ(kenrl)ÀïÃæµÄ×¨¼Ò¡£ÎÒÖ®ËùÒÔÖªµÀÕâÐ©£¬ÊÇÓÉì¶Ä³Ð©ºËÐÄ¹¤×÷ÈÃÎÒ½Ó´¥µ½ËûÃÇÆäÖÐµÄÒ»Ð©³ÉÔ±£º David S. Miller¡¢Alexey Kuznetsov¡¢Andi Kleen¡¢Alan Cox¡£²»¹ý£¬ÖíÍ·¹Ç(×îÄÑµÄ)¶¼ÓÉËûÃÇ¿ÐÁË£¬Ê£ÏÂµÄ¶¹¸¯(°²È«ºÍÈÝÒ×µÄ)²ÅÂÖµ½ÎÒÀ´ÊÕÊ°À²¡£




\section{ÕæÕýµÄ Rusty ·â°ü¹ýÂË¿ìËÙÖ¸ÄÏ}

´ó²¿·ÖÈË¶¼½öÓÃµ¥Ò»µÄ PPP ²¦½ÓÉÏÍø£¬Í¬Ê±²¢²»ÏëÈÎºÎÈË½øÈëËûÃÇµÄÍøÂ·¡¢»ò·À»ðÇ½£º

\begin{tscreen}
\begin{verbatim}
## Insert connection-tracking modules (not needed if built into kernel).
# insmod ip_conntrack
# insmod ip_conntrack_ftp

## Create chain which blocks new connections, except if coming from inside.
# iptables -N block
# iptables -A block -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A block -m state --state NEW -i ! ppp0 -j ACCEPT
# iptables -A block -j DROP

## Jump to that chain from INPUT and FORWARD chains.
# iptables -A INPUT -j block
# iptables -A FORWARD -j block
\end{verbatim}
\end{tscreen}





\section{·â°üÈçºÎ´©Ô½(traverse)¹ýÂË}

ºËÐÄ´Ó 'filter' ±í¸ñµÄÈý¸öÁÐ±í(lists) ¿ªÊ¼£»ÕâÈý¸öÁÐ±í½Ð×ö {\bfseries firewall chains(·À»ðÇ½Á´)} »ò¾Í½Ð
{\bfseries chains(Á´)}¡£ ÕâÈý¸öÁ´·Ö±ðÎª{\bfseries INPUT}¡¢{\bfseries OUTPUT} ¡¢ºÍ {\bfseries FORWARD} ¡£



{\bfseries Õâ¸ú 2.0 ºÍ 2.2 ºËÐÄÓÐºÜ´ó²î±ðÅ¶£¡}



¶Ôì¶ ASCII ÒÕÊõÃÔÀ´Ëµ£¬¸÷Á´(chains)µÄ²¼ÖÃÈçÏÂ£º
\begin{verbatim}
                          _____
Incoming                 /     \         Outgoing
       -->[Routing ]--->|FORWARD|------->
          [Decision]     \_____/        ^
               |                        |
               v                      ____
              ___                    /    \
             /   \                  |OUTPUT|
            |INPUT|                  \____/
             \___/                      ^
               |                        |
                ----> Local Process ----
\end{verbatim}




ÆäÖÐÈý¸öÈ¦´ú±íÖøÇ°ÊöµÄÈý¸öÁ´£¬µ±Ò»¸ö·â°üµÖ´ïÉÏÍ¼ÖÐµÄÆäÖÐÒ»¸öÈ¦£¬ÏàÓ¦µÄÁ´¾Í»á½ÓÊÜ¼ìÑé(examined)£¬ÒÔ¾ö¶¨ÄÇ¸ö·â°üµÄÃüÔË¡£Èç¹ûÁ´Ëµ DROP µôÕâ¸ö·â°ü£¬ÄÇ÷áËü¾Í»á¾ÍµØÕý·¨£¬µ«Èç¹ûÁ´Ëµ ACCEPT Õâ¸ö·â°ü£¬ÄÇ÷áËü¾Í¼ÌÐøÔÚÍ¼Ê¾ÖÐ´©Ô½¡£



Ò»¸öÁ´(chain)ÆäÊµ¾ÍÊÇÖÚ¶à¹æÔò(rules)ÖÐµÄÒ»¸ö¼ì²éÇåµ¥(checklist)¡£Ã¿Ò»Ìõ¹æÔò¶¼»áËµ¡°Èç¹û·â°ü±íÍ·¿´ÆðÀ´ÏñÕâÑù£¬¾ÍÈç´ËÕâ°ã´¦ÖÃÕâ¸ö·â°ü¡±¡£Èç¹û¹æÔòµÄÉè¶¨ºÍ·â°ü²¢²»·ûºÏ(match)£¬ÄÇ÷á¾Í½»ÓÉÁ´ÖÐµÄÏÂÒ»¸ö¹æÔò¼ÌÐø´¦Àí¡£¶ø×îÖÕ£¬Èç¹ûÔÙÃ»ÓÐ¹æÔò¿ÉÒÔ²Î¿¼£¬ÄÇ÷áºËÐÄ¾Í»á¿´Á´µÄ{\bfseries policy(Ô­Ôò)} ÒÔ¾ö¶¨Ôõ÷á×ö¡£ÔÚÒ»¸ö°²È«ÖÁÉÏµÄÏµÍ³Àï£¬Ô­Ôò(policy)Í¨³£¶¼»á¸æËßºËÐÄ DROP µô¸Ã·â°ü¡£



\begin{enumerate}
\item µ±Ò»¸ö·â°ü½øÈëµÄÊ±ºò(¼ÙÉè£¬Í¨¹ý Ethernet ÍøÂ·¿¨)£¬ºËÐÄÊ×ÏÈ¿´¿´·â°üµÄÄ¿µÄµØ(destination)£ºÕâ³ÆÖ®Îª ' rouging (Â·ÓÉ)'¡£
\item Èç¹ûÄ¿µÄµØÖ·Îª±¾»ú£¬Õâ¸ö·â°ü¾Í°´Í¼Ê¾ÏÂÐÐÖÁ INPUT Á´¡£Èç¹ûËüÄÜ¹»Í¨¹ý£¬ÄÇ÷áµÈ´ýÕâ¸ö·â°üµÄÐÐ³Ì(processes)¾Í½«Ö®½Ó¹ÜÏÂÀ´¡£
\item ·ñÔò£¬Èç¹ûºËÐÄ²¢Ã»Æô¶¯×ªµÝ¹¦ÄÜ(forwarding)£¬»òÊÇËü²»ÖªµÀÈçºÎ×ªµÝÕâ¸ö·â°ü£¬ÄÇ÷áÕâ¸ö·â°ü¾Í»á±»¶ªÆú(dropped)¡£Èç¹û×ªµÝ¹¦ÄÜÒÑ¾­Æô¶¯£¬Í¬Ê±·â°üÖ¸ÏòÁíÒ»¸öÍøÂ·½çÃæ(Èç¹ûÄú»¹ÓÐÁíÍâÒ»ÕÅ)£¬È»ááÕâ¸ö·â°ü¾Í°´Í¼Ê¾ÓÒÐÐÖÁ FORWARD Á´¡£Èç¹ûËü±»½ÓÊÜ(ACCEPT)£¬ÄÇ÷áËü¾Í»á±»ËÍ³öÈ¥¡£
\item ×îááÒ»ÖÖÇéÐÎ£¬Ò»¸öÔÚ±¾»úÔËÐÐµÄ³ÌÊ½»áËÍ³öÍøÂ··â°ü¡£·â°ü¾ÍÖ±½Ó½»¸ø OUTPUT Á´£ºÈç¹ûÊÇ ACCEPT£¬È»ááÕâ¸ö·â°ü»á¼ÌÐøËÍ³öÖÁËüËùÖ¸ÏòµÄ½çÃæ¡£
\end{enumerate}





\section{Ê¹ÓÃ iptables}

Èç¹ûÄúÐèÒªÌØ¶¨µÄÏêÏ¸ÁË½â£¬iptables ÓÐÒ»¸ö·Ç³£Ïê¾¡µÄ manual page ({\ttfamily man iptables})¡£¼ÙÈçÄúÊìÏ¤ ipchains µÄ»°£¬»òÐí¿ÉÒÔÖ±½ÓÌøµ½ \ref{Appendix-A} {(iptables Óë ipchains µÄ²îÒì (Differences Between iptables and ipchains))} È¥¿´£»ËüÃÇÊÇ·Ç³£½üËÆµÄ¡£



Äú»¹¿ÉÒÔÀûÓÃ {\ttfamily iptables} ×öÐí¶à²»Í¬µÄÊÂÇéÅ¶¡£ÄúËù¿ªÊ¼µÄÄÇÈý¸öÄÚ½¨(buit-in) Á´£º {\ttfamily INPUT}¡¢{\ttfamily OUTPUT}¡¢ºÍ{\ttfamily FORWARD} £¬ÄúÊÇ²»ÄÜÉ¾³ýµÄ¡£ÈÃÎÒÃÇ¿´¿´Õû¸öÁ´µÄ¹ÜÀíÔË×÷°É£º

\begin{enumerate}
\item  ½¨Á¢Ò»¸öÐÂÁ´ (-N)¡£
\item  É¾³ýÒ»¸ö¿ÕÁ´ (-X)¡£
\item  ¸Ä±äÒ»¸öÄÚ½¨Á´µÄÔ­Ôò (-P)¡£
\item  ÁÐ³öÒ»¸öÁ´ÖÐµÄ¹æÔò (-L)¡£
\item  Çå³ýÒ»¸öÁ´ÖÐµÄËùÓÐ¹æÔò (-F)¡£
\item  ¹éÁã(zero) Ò»¸öÁ´ÖÐËùÓÐ¹æÔòµÄ·â°ü×Ö½Ú(byte) ¼ÇÊýÆ÷ (-Z)¡£
\end{enumerate}


ÓÐºÃÐ©·½·¨¿ÉÒÔÍ³³ïÒ»¸öÁ´ÖÐµÄ¹æÔò£º

\begin{enumerate}
\item  ÑÓÔö(append) Ò»¸öÐÂ¹æÔòµ½Ò»¸öÁ´ (-A)¡£
\item  ÔÚÁ´ÄÚÄ³¸öÎ»ÖÃ²åÈë(insert) Ò»¸öÐÂ¹æÔò(-I)¡£
\item  ÔÚÁ´ÄÚÄ³¸öÎ»ÖÃÌæ»»(replace) Ò»Ìõ¹æÔò (-R)¡£
\item  ÔÚÁ´ÄÚÄ³¸öÎ»ÖÃÉ¾³ý(delete) Ò»Ìõ¹æÔò (-D)¡£
\item  É¾³ý(delete) Á´ÄÚµÚÒ»Ìõ¹æÔò (-D)¡£
\end{enumerate}





\subsection{µ±ÄúµÄ»úÆ÷Æô¶¯Ê±£¬ÄúËù¿´µ½µÄ}

iptables ¿ÉÒÔ×ö³ÉÄ£×é(module)£¬½Ð×ö `iptable\_filter.o' £¬µ±ÄúµÚÒ»´ÎÅÜ {\ttfamily iptables} ¾Í»á±»×Ô¶¯ÔØÈë¡£ËüÒ²¿ÉÒÔÓÀ¾ÃÐÔµÄ½¨ÖÃì¶ºËÐÄÀïÃæ¡£



ÔÚÅÜÈÎºÎ iptables ÃüÁîÖ®Ç° (Ð¡ÐÄ£ºÓÐÐ©Ì×¼þ(distributions) »òÐí»áÓÃËüÃÇµÄÆðÊ¼ÃüÁî¸åÀ´ÅÜ iptables)£¬ÄÚ½¨Á´( `INPUT'¡¢`FORWARD'¡¢ºÍ `OUTPUT' )½«²»´øÈÎºÎ¹æÔò£¬ËùÓÐÁ´¶¼½«Ô­ÔòÉèÎª ACCEPT¡£Äú¿ÉÒÔ½« iptable\_filter Ä£×éÑ¡ÏîÉèÎª `forward=0' £¬À´¸Ä±äÔ¤ÉèµÄ FORWARD Á´Ô­Ôò¡£




\subsection{Ò»¸öµ¥Ò»¹æÔòµÄÔË×÷}

ÏÂÃæÈÃÎÒÃÇÀ´ÊìÁ·Ò»ÏÂÔ­ÔòµÄÔËÓÃ°É£¬ËùÎ½ÊìÄÜÉúÇÉÊÇÒ²¡£Äú×î³£ÓÃµÄ»òÐí»áÊÇ append (-A) ºÍ delete (-D) ÃüÁî¡£ÖÁì¶ÆäËüÈç insert (-I) ºÍ replace (-R)£¬ Ö»ÊÇÕâÐ©¸ÅÄîµÄÑÓÉì¶øÒÑ¡£



Ã¿Ò»Ìõ¹æÔò¶¼ÏÞ¶¨ÁËÒ»×éÌõ¼þ(conditions)ÓëÌØ¶¨·â°ü±È¶Ô£¬ÒÔ¼°µ±ËüÃÇ·ûºÏÊ±ÒªÈçºÎ´¦ÖÃ(Ö¸Ò»¸ö`target' )¡£±È·½Ëµ£¬Äú»òÐíÒª¶ªÆúËùÓÐÀ´×Ô127.0.0.1 Õâ¸ö IP µØÖ·µÄ ICMP ·â°ü£¬Òò¶øÎÒÃÇÕâÀïµÄÌõ¼þ¾Í³ÉÎªÕâÑù£ºÐ­¶¨±ØÐëÊÇ ICMP£¬¶øÀ´Ô´µØÖ·±ØÐëÊÇ 127.0.0.1 £¬¶øÎÒÃÇµÄ target(Ä¿±ê)½«»áÊÇ`DROP' ¡£



ÎÒÃÇ³Æ 127.0.0.1 Îª `loopback' ½çÃæ£¬¾ÍËãÄúÃ»ÓÐÕæÊµµÄÍøÂ·Á¬½Ó£¬ÄúÒ²»áÓÐÕâ¸ö½çÃæµÄ¡£Äú¿ÉÒÔÓÃ `ping' ÕâÖ»³ÌÊ½²úÉúÕâÑùµÄ·â°ü (ËüÖ»ÊÇËÍ³öÒ»¸ö type 8(echo request)µÄ ICMP ·â°ü£¬¶øËùÓÐÀÖì¶»ØÓ¦µÄºÏ×÷¶Ë(cooperative hosts) ÔòËÍ»ØÒ»¸ö type 0(echo reply)µÄ ICMP ·â°ü)¡£ÓÃÀ´²âÊÔÊÇºÜºÃÓÃµÄ¡£

\begin{tscreen}
\begin{verbatim}
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes
64 bytes from 127.0.0.1: icmp_seq=0 ttl=64 time=0.2 ms

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 1 packets received, 0% packet loss
round-trip min/avg/max = 0.2/0.2/0.2 ms
# iptables -A INPUT -s 127.0.0.1 -p icmp -j DROP
# ping -c 1 127.0.0.1
PING 127.0.0.1 (127.0.0.1): 56 data bytes

--- 127.0.0.1 ping statistics ---
1 packets transmitted, 0 packets received, 100% packet loss
#
\end{verbatim}
\end{tscreen}


ÕâÀïÄú¿ÉÒÔ¿´µ½µÚÒ»¸ö ping ³É¹¦ÁË(ÕâÀïµÄ `-c 1' ²ÎÊýÊÇ¸æËß ping Ö»ËÍ³öÒ»¸ö·â°ü)¡£



È»áá£¬ÎÒÃÇÎª`INPUT' ÑÓÔö(-A)Ò»Ìõ¹æÔò£¬½«À´×Ô 127.0.0.1(`-s 127.0.0.1') µÄ ICMP Ð­¶¨ (`-p icmp') ·â°üËÍÖÁ DROP Õâ¸öÄ¿±ê (-j DROP)¡£ 



È»ááÎÒÃÇ¿ÉÒÔÓÃµÚ¶þ¸ö ping À´²âÊÔÎÒÃÇµÄ¹æÔò¡£ÔÚ³ÌÊ½·ÅÆú¼ÌÐøµÈ´ýÄÇÐ©ÓÀ²»µ½À´µÄ»ØÓ¦Ö®Ç°£¬½«ÓÐÒ»¶ÎÔÝÍ£¡£



ÎÒÃÇÓÐÁ½¸ö·½·¨¿ÉÒÔÒÆ³ý¹æÔò¡£Ê×ÏÈ£¬ÒòÎªÎÒÃÇÄ¿Ç°ÖÆ¶¨ÔÚ input Á´ÖÐÖ»ÓÐÎ¨Ò»Ò»Ìõ¹æÔò£¬ËùÒÔÎÒÃÇ¿ÉÒÔÖ¸¶¨Êý×ÖÀ´ÒÆ³ý£¬ÀýÈç£º
\begin{tscreen}
\begin{verbatim}
        # iptables -D INPUT 1
        #
\end{verbatim}
\end{tscreen}

ÕâÑù¾Í°ÑµÚÒ»Ìõ¹æÔò´Ó INPUT Á´ÖÐÒÆ³ýµô¡£



µÚ¶þ¸ö·½·¨ÊÇÓ³Éä(mirro)ÉÏÃæµÄ -A ÃüÁî£¬µ«ÓÃ -D À´´úÌæ -A ¶øÒÑ¡£µ±ÄúÓÐÒ»¸öÁ´£¬ÀïÃæÐ´ÓÐ·Ç³£¸´ÔÓµÄ¹æÔò£¬¶øÓÖ²»ÏëÖðÐÐÊý³öµÚ 37 ÐÐ¾ÍÊÇÄúÒªµÄÄÇÌõ¹æÔò£¬ÕâÊ±ºò£¬Õâ·½·¨¾Í·Ç³£ÓÐÓÃÁË¡£
\begin{tscreen}
\begin{verbatim}
        # iptables -D INPUT -s 127.0.0.1 -p icmp -j DROP
        #
\end{verbatim}
\end{tscreen}

ÔÚÃüÁîÐÐÖÐ£¬ÆäÓï·¨ÊÇ -D ±ØÐëºÍ -A (»ò -I¡¢»ò -R) ÃüÁîµÄÎ»ÖÃÒ»ÖÂ¡£Èç¹ûÔÚÍ¬Ò»¸öÁ´ÖÐÓÐÊýÌõÏàÍ¬µÄ¹æÔò£¬ÄÇ÷áÖ»ÓÐµÚÒ»Ìõ»á±»ÒÆ³ýµô¡£




\subsection{¹ýÂË¹æ¸ñ}

ÎÒÃÇÒÑ¾­¿´¹ýÓÃ `-p' À´Ö¸¶¨Ð­¶¨£¬ÒÔ¼°ÓÃ `-s' À´Ö¸¶¨À´Ô´µØÖ·£¬µ«»¹ÓÐÆäËüÑ¡ÏîÎÒÃÇÊÇ¿ÉÒÔÓÃÀ´Ö¸¶¨³öÒ»¸ö·â°üµÄÌØÕ÷¡£µ×ÏÂÊÇÒ»¸öÍêÕûµÄ¸ÅÊö¡£




\subsubsection{Ö¸¶¨À´Ô´ºÍÄ¿µÄµØÖ® IP µØÖ·}

ÎÒÃÇ¿ÉÒÔÓÃËÄÖÖ·½·¨À´Ö¸¶¨À´Ô´(`-s'¡¢»ò`--source'¡¢»ò `--src') ºÍÄ¿µÄµØ(`-d'¡¢»ò`--destination'¡¢»ò`--dst') IP µØÖ·¡£×î³£ÓÃµÄ·½·¨ÊÇÊ¹ÓÃÍêÕûÃû³Æ£¬ÀýÈç `localhost' »ò  `www.linuxhq.com' ¡£µÚ¶þÖÖ·½·¨ÊÇÖ¸¶¨Æä IP µØÖ·£¬ÀýÈç `127.0.0.1' ¡£



µÚÈýºÍµÚËÄÖÖ·½·¨ÔÊÐíÖ¸¶¨Ò»×é(group) IPµØÖ·£¬ÀýÈç `199.95.207.0/24' »ò `199.95.207.0/255.255.255.0' £¬ÕâÁ½¸öÉè¶¨¶¼Ö¸¶¨ÁËËùÓÐ´Ó 199.95.207.0 µ½ 199.95.207.255 Ö®¼äµÄ IP µØÖ·£»¶øÔÚÊý×ÖááÃæµÄ `/' ·ûºÅÊÇ¸æËßÏµÍ³ÄÄ²¿·Ý IP ²ÅÓÐÐ§¡£ `/32' »ò `/255.255.255.255' ÎªÔ¤ÉèÖµ(ËùÓÐ IP Öµ¶¼±ØÐëÎÇºÏ)¡£È«²¿ÓÃ `/0' À´Ö¸¶¨ IP µØÖ·Ò²ÊÇ¿ÉÐÐµÄ£¬ÀýÈç£º
\begin{tscreen}
\begin{verbatim}
        [ NOTE: `-s 0/0' is redundant here. ]
        # iptables -A INPUT -s 0/0 -j DROP
        #
\end{verbatim}
\end{tscreen}


²»¹ýÕâ·Ç³£ÉÙÓÃ£¬ÒòÎªÒÔÉÏµÄÐ§¹ûºÍ²»Ö¸¶¨ `-s' ºÁÎÞÁ½Ñù¡£




\subsubsection{Ïà·´Ö¸¶¨}

Ðí¶àÆì±ê(flags)£¬°üÀ¨ `-s' (»ò `--source')¡¢ºÍ `-d' (»ò `--destination')£¬¿ÉÒÔÔÚËüÃÇÇ°Ãæ·ÅÖÃÒ»¸ö `!' ·ûºÅ(·¢ÒôÎª`not')  £¬À´·ûºÏËùÓÐ·Ç(NOT)Æä¸³ÓèÖµµÄµØÖ·¡£±È·½Ëµ£¬`-s ! localhost' ·ûºÏËùÓÐ{\bfseries ·Ç(not)} À´×Ô±¾»úµÄ·â°ü¡£




\subsubsection{Ö¸¶¨Ð­¶¨}

Ð­¶¨¿ÉÒÔÓÃ `-p' (»ò `--protocol') Æì±êÀ´Ö¸¶¨¡£Ð­¶¨¿ÉÒÔÎªÒ»¸öºÅÂë(¼ÙÈçÄúÖªµÀ IP Ð­¶¨ÊýÖµµÄ»°)£¬»òÊÇÒ»¸öÖîÈç `TCP'¡¢»ò`UDP'¡¢»ò`ICMP' ÕâÑùµÄÃû³Æ¡£´óÐ¡Ð´Ã»¹ØÏµ£¬ËùÒÔ `tcp' ºÍ `TCP' ¶¼¿ÉÒÔ¹¤×÷¡£



Ð­¶¨Ò²¿ÉÒÔ¼ÓÉÏÒ»¸ö `!' Ç°ÖÃ·ûºÅ£¬Ê¹Ö®Ïà·´¡£ÀýÈç `-p ! TCP' ÔòÖ¸¶¨ÁËËùÓÐ{\bfseries ·Ç} TCP µÄ·â°ü¡£




\subsubsection{Ö¸¶¨½çÃæ}

ÎÒÃÇÓÃ `-i' (»ò `--in-interface') ºÍ `-o' (»ò `--out-interface') Ñ¡ÏîÀ´Ö¸¶¨Ò»¸ö·ûºÏµÄ{\bfseries ½çÃæ(interface)}¡£Ò»¸ö½çÃæ¾ÍÊÇ·â°ü½øÈë(`-i') £¬»ò´«³ö(`-o')Ö®ÎïÀíÉè±¸¡£Äú¿ÉÒÔÓÃ {\ttfamily ifconfig} ÃüÁîÁÐ³öÄÄÐ©½çÃæÊÇÅÜÆðÀ´(`up' )µÄ¡£



´©Ô½ {\ttfamily INPUT} Á´µÄ·â°ü²»»áÓÐ´«³ö(output)½çÃæµÄ£¬ËùÒÔ£¬ÈÎºÎÔÚÁ´ÖÐÊ¹ÓÃ `-o' Ñ¡ÏîµÄ¹æÔò¶¼²»ÓëÖ®·ûºÏ¡£Í¬ÑùµÄ£¬´©Ô½ {\ttfamily OUTPUT} Á´µÄ·â°üÒ²²»»áÓÐ´«Èë(input)½çÃæ£¬ËùÒÔÔÚÁ´ÖÐÈÎºÎ´ø `-i' Ñ¡ÏîµÄ¹æÔòÒ²ÊÇ²»·ûºÏµÄ¾ÍÊÇÁË¡£



½ö½öÊÇ´©Ô½ {\ttfamily FORWARD} Á´µÄ·â°ü²Å»áÍ¬Ê±ÓÐ´«ÈëºÍ´«³ö½çÃæ¡£



Ö¸¶¨Ò»¸ö²»´æÔÚµÄ½çÃæÊÇÍêÈ«ºÏ·¨(legal)µÄ£»·´ÕýÔÚ½çÃæ»¹Ã»ÆðÀ´Ö®Ç°£¬ÕâÌõ¹æÔòÊÇ²»»á·ûºÏµÄ¡£Õâ¶Ôì¶ PPP ²¦½Ó(Í¨³£»áÊÇ{\ttfamily ppp0}) »òÏàÀàÁ¬Ïß£¬¾Í¼«Ö®ÓÐÓÃÁË¡£



ÀýÈçÔÚÒ»¸öÌØÊâÀý×ÓÖÐ£¬½çÃæÊÇÓÃÒ»¸ö `+' ½áÎ²µÄ»°£¬¾Í·ºÖ¸ËùÓÐÒÔ´Ë×Ö´®¿ªÍ·µÄ½çÃæ(²»¹ÜËüÃÇÄ¿Ç°ÊÇ·ñÆðÀ´ÁË)¡£ÀýÈç£¬ÒªÖ¸¶¨Ò»Ìõ¹æÔòÀ´·ûºÏËùÓÐµÄ PPP ½çÃæµÄ»°£¬{\ttfamily -i ppp+} Ñ¡Ïî¾Í¿ÉÒÔÓÃÉÏÁË¡£



½çÃæÃû³ÆÇ°Ãæ¿ÉÒÔÓÃÒ»¸ö`!' ·ûºÅÀ´·ûºÏÒ»¸öÓëÖ¸¶¨½çÃæ {\bfseries ²»} ·ûºÏµÄ·â°ü¡£




\subsubsection{Ö¸¶¨·â°üËéÆ¬ (Fragments)}

ÓÐÊ±ºò£¬Ò»¸ö·â°ü»áÒòÎªÌ«´ó¶ø²»ÄÜÒ»´Î¹ýÈû½øÁ¬ÏßÈ¥¡£µ±ÕâÑùµÄÊÂÇé·¢ÉúÁË£¬·â°ü»á±»ÇÐ¸î³É {\bfseries ËéÆ¬(fragments)}£¬Í¬Ê±»áÒÔ¶à¸ö·â°üÀ´´«ËÍ¡£¶øÁíÒ»¶ËÔòÖØ×éÕâÐ©ËéÆ¬ÒÔ»¹Ô­Õû¸ö·â°ü¡£



µ«ËéÆ¬µÄÎÊÌâÊÇ£¬µÚÒ»¸öÆðÊ¼ËéÆ¬ÓÐÕû¸ö·â°ü±íÍ·À¸Î»(IP+TCP¡¢UDP¡¢ºÍ ICMP)¿É¹©¼ì²é£¬µ«áá¼Ì·â°üÈ´Ö»°üº¬±íÍ·µÄÐ¡²¿·Ý(²»´ø¶îÍâÐ­¶¨À¸Î»µÄ IP)¡£ÕâÑùµÄ»°£¬Òª¼ì²éáá¼ÌËéÆ¬Ö®Ð­¶¨±íÍ·(±È·½ÓÉ TCP¡¢UDP¡¢ºÍ ICMP extensions ¶ø³É)£¬¾Í²»¿ÉÄÜÁË¡£



Èç¹ûÄúÒª×öÁ¬Ïß×·×Ù»ò NAT£¬ÄÇËùÓÐËéÆ¬ÔÚµÝ¸ø·â°ü¹ýÂËÂëÖ®Ç°¶¼»á»ãºÏ»ØÒ»Æð£¬ËùÒÔÄúÎÞÐèµ£ÐÄËéÆ¬ÎÊÌâ¡£



È»¶ø£¬ÒªÅªÃ÷°×¹ýÂË¹æÔòÈçºÎ´¦ÀíËéÆ¬µÄ£¬¾Í±äµÃ·Ç³£ÖØÒªÁË¡£ÈÎºÎ¹æÔòÒªÑ¯ÎÊµÄ×ÊÁÏ¶øÎÒÃÇ²¢Ã»ÓÐÊ±£¬½«±»ÊÓÎª {\itshape ²»\/} ·ûºÏ¡£Ò²¾ÍÊÇËµ£¬µÚÒ»¸öËéÆ¬·â°üµÄ´¦ÀíºÍÆäËü·â°üÒ»Ñù¡£µ«µÚ¶þ¼°Ö®ááµÄËéÆ¬¾Í²»ÊÇÕâÑùÁË¡£ÕâÑùµÄ»°£¬Ò»Ìõ {\ttfamily -p TCP --sport www} (Ö¸¶¨À´Ô´²º¿ÚÎª`www')µÄ¹æÔò£¬½«ÓÀÔ¶²»ºÍËéÆ¬·ûºÏ(³ýµÚÒ»¸öËéÆ¬Íâ)¡£Ïà·´µÄ¹æÔòÈç{\ttfamily -p TCP --sport ! www} Ò²Ò»Ñù¾ÍÊÇÁË¡£



²»¹ý£¬Äú¿ÉÒÔÓÃ `-f' (or `--fragment') Æì±êÌØ±ðÎªµÚ¶þ¼°ÒÔááµÄËéÆ¬Ö¸¶¨Ò»Ìõ¹æÔò¡£ÔÚ `-f' Ç°Ãæ¼ÓÉÏÒ»¸ö `!' À´Ö¸¶¨Ò»Ìõ¹æÔò {\itshape ²»\/} ÊÊÓÃì¶µÚ¶þ¼°ÒÔááËéÆ¬£¬Ò²ÊÇ¿ÉÐÐµÄ¡£



Í¨³££¬ÈÃµÚ¶þ¼°ÒÔááËéÆ¬Í¨¹ýÊÇ±»ÊÓÎª°²È«µÄ£¬ÒòÎªÈç¹û¹ýÂË»áÓ°ÏìµÚÒ»¸öËéÆ¬µÄ»°£¬ÄÇ÷áÒ²¾Í¿ÉÒÔ±ÜÃâÔÚÄ¿±êÖ÷»ú½øÐÐÖØ×é£»µ«ÊÇ£¬Ò»Ð©ÒÑÖªµÄ³ô³æÏÔÊ¾£¬¶ªËÍËéÆ¬·â°ü¿ÉÒÔÇáÒ×µÄÈÃÖ÷»úµ±µô¡£ÄÇÊÇ¸óÏÂÒªÓ¦¸¶µÄÊÂÇéÁË¡£



ÍøÂ·Íæ¼ÒÒªÁôÒâµÄÊÇ£ºµ±½øÐÐÕâÑùµÄ¼ì²âÊ±£¬²»ÍêÕûµÄ·â°ü(Ì«¶ÌµÄ TCP¡¢UDP¡¢ºÍ ICMP ·â°ü»áÈÃ»ðÇ½³ÌÊ½¶Á²»µ½²º¿Ú»ò ICMP ÂëºÍÀàÐÍ) »á±»¶ªÆú¡£Òò´Ë£¬ TCP ËéÆ¬¶¼ÓÉµÚ 8 ¸öÎ»ÖÃ¿ªÊ¼µÄ *¡£



(* ÒëÕß×¢£ºÎÒÒ²²»ÊÇºÜÃ÷°××÷ÕßÕâÀïËùÖ¸ºÎÎï£¬Ô­ÎÄÊÇ£º¡®So are TCP fragments starting at position 8¡¯¡£ÒòÎªÀÁµÃÈ¥·­×ÊÁÏ£¬¹Ê²»ÖªµÀ position 8 ÊÇÖ¸ TCP ±íÍ·Î»ÖÃ»¹ÊÇÆäËü¡£¼ÙÈçÄúÕÒµ½´ð°¸£¬»¶Ó­Ð´ÐÅ¸øÎÒÒÔ×÷³ÎÇå¡£)



¾ÙÀýÀ´Ëµ£¬ÒÔÏÂµÄ¹æÔò»á¶ªÆúÈÎºÎËÍ¸ø 192.168.1.1 µÄËéÆ¬¡£

\begin{tscreen}
\begin{verbatim}
# iptables -A OUTPUT -f -d 192.168.1.1 -j DROP
#
\end{verbatim}
\end{tscreen}





\subsubsection{ÑÓÉì iptables £ºÐÂµÄ±È¶Ô(matches)}

{\ttfamily iptables} ÊÇ {\bfseries ¿ÉÑÓÉìµÄ(extensible)}£¬Ò²¾ÍÊÇËµ£¬ºËÐÄºÍ iptables ¹¤¾ß¿ÉÒÔ½øÐÐÀ©Õ¹ÒÔÌá¹©ÐÂµÄ¹¦ÄÜ¡£



Ä³Ð©ÑÓÉì(Extensions)ÊÇ±ê×¼µÄ£¬µ«ÓÐÐ©Ôò¿ÉÒÔËµÊÇÅÉÉú³öÀ´µÄ¡£±ðµÄÅóÓÑ»òÐí»áÖÆ×ö³öÒ»Ð©ÑÓÉì£¬Í¬Ê±É¢²¥¸øºÏÊÊµÄÓÃ»§¡£



ºËÐÄµÄÑÓÉìÍ¨³£¾Óì¶ºËÐÄÄ£×éÄ¿Â¼ÄÚ£¬ÀýÈç /lib/modules/2.3.15/net ¡£¼ÙÈçÄúµÄºËÐÄÊÇÓÃ CONFIG\_KMOD Éè¶¨À´±àÒëµÄ»°£¬ËüÃÇÊÇÓ¦ÐèÇóÔØÈëµÄ£¬ËùÒÔÄúÎÞÐèÊÖ¶¯µÄ²åÈëËüÃÇ¡£



È»¶ø£¬iptables ³ÌÊ½µÄÑÓÉìÔòÍ¨³£ÊÇ¾Óì¶ /usr/local/lib/iptables/ ÀïÃæµÄ·ÖÏíº¯Ê½¿â£¬»òÕßÓÐÐ©É¢²¥°æ±¾»á½«ËüÃÇ·Å½ø /lib/iptables »ò /usr/lib/iptables ÀïÈ¥¡£



ÑÓÉìÓÐÁ½¸öÖÖÀà£ºÐÂÄ¿±ê(target)£¬ºÍÐÂ±È¶Ô(match)£»ÏÂÃæÎÒÃÇ¾Í½²½²ÐÂÄ¿±ê°É¡£ÓÐÐ©Ð­¶¨»á×Ô¶¯Ìá¹©ÐÂµÄ²âÊÔ(tests)£ºÄ¿Ç°ÓÐ TCP¡¢UDP¡¢ºÍ ICMP£¬ÈçÏÂÊö¡£



ÔÚÃüÁîááÊ¹ÓÃ  `-p' Ñ¡Ïî°ÑÑÓÉìÔØÈë½øÀ´£¬Äú¾Í¿ÉÒÔÀ´Ö¸¶¨Ò»¸öÐÂ²âÊÔÁË¡£µ±ÑÓÉìÑ¡ÏîÔÊÐíµÄÊ±ºò£¬Ê¹ÓÃ `-m' À´ÔØÈëÑÓÉì£¬Ôò¿ÉÒÔÃ÷È·Ö¸Ê¾Ò»¸öÐÂ²âÊÔ¡£



ÈçÐèÄ³¸öÑÓÉìµÄÇóÖú×ÊÁÏ£¬¿ÉÒÔÊ¹ÓÃÑ¡Ïîáá½Ó `-h' »ò `--help' ½«Ö®ÔØÈë(`-p'¡¢ `-j'¡¢»ò `-m')£¬ÀýÈç£º
\begin{tscreen}
\begin{verbatim}
# iptables -p tcp --help
#
\end{verbatim}
\end{tscreen}





\paragraph{TCP ÑÓÉì}

Èç¹ûÖ¸¶¨ÁË `-p tcp' £¬TCP Ö®ÑÓÉì»á×Ô¶¯ÔØÈëµÄ¡£ËüÌá¹©ÈçÏÂÑ¡Ïî(²¢²»·ûºÏ fragments)¡£



\begin{description}
\item[--tcp-flags] \mbox{}

áá½ÓÒ»¸ö `!' Ñ¡Ïî£¬ÔòÓÐÁ½¸öÆì±êµÄ×Ö´®ÈÃÄúÄÜ¹»¶ÔÖ¸¶¨µÄ TCP Æì±ê½øÐÐ¹ýÂË¡£ µÚÒ»¸ö×Ö´®ÊÇÕÚÕÖ(mask)£ºÒ»¸öÄúÓû¼ì²éµÄÆì±êÁÐ±í¡£µÚ¶þ¸ö×Ö´®ÊÇÒªËµÄÄÐ©¶«Î÷ÒªÉè¶¨¡£ÀýÈç£º

\begin{tscreen}
\begin{verbatim}
# iptables -A INPUT --protocol tcp --tcp-flags ALL SYN,ACK -j DENY
\end{verbatim}
\end{tscreen}


Õâ±íÊ¾ËùÓÐÆì±ê¶¼Òª¼ì²é (`ALL' ¾ÍÊÇ·ºÖ¸ `SYN,ACK,FIN,RST,URG,PSH')£¬µ«Ö»ÓÐ SNY ºÍ ACK ±»Éè¶¨¶øÒÑ¡£ÁíÍâÓÐÒ»¸ö²ÎÊý `NONE' ÔòÊÇÃ»Æì±êµÄÒâË¼¡£



\item[--syn] \mbox{}

Îª`--tcp-flags SYN,RST,ACK SYN' µÄ¼òÐ´£¬ÆäÇ°Ãæ¿ÉÒÔ±¸Ñ¡Ò»¸ö `!' ·ûºÅ¡£



\item[--source-port] \mbox{}

Æäáá¿ÉÒÔ±¸Ñ¡ `!' £¬È»ááÊÇÒ»¸öµ¥¶ÀµÄ TCP ²º¿Ú»òÒ»¸ö²º¿ÚÖµÓò(range)¡£²º¿Ú¿ÉÒÔÎª /etc/services ËùÁÐµº²º¿ÚÃû³Æ£¬Ò²¿ÉÒÔÊÇÒ»¸öÊý×Ö¡£Èç¹ûÊÇÖµÓòµÄ»°£¬¿ÉÒÔÊÇÒ»¶ÔÓÃ`:' ·ûºÅ·Ö¸ôµÄ²º¿ÚÃû×Ö£¬»òÒ»¸ö²º¿ÚááÃæ´ø `:' (Ö¸´óì¶ºÍµÈì¶¸Ã²º¿Ú)£¬ÓÖ»òÊÇÒ»¸ö²º¿ÚÇ°Ãæ´ø `:' (Ö¸Ð¡ì¶ºÍµÈì¶¸Ã²º¿Ú)¡£



\item[--sport] \mbox{}

µÈÍ¬ì¶ `--source-port'¡£



\item[--destination-port] \mbox{}

ºÍ 

\item[--dport] \mbox{}

ÓëÉÏÍ¬£¬Ö»ÊÇËüÃÇÊÇÓÃÀ´Ö¸¶¨Ä¿µÄµØ¶ø·ÇÀ´Ô´²º¿Ú¼ÓÒÔ±È¶Ô¡£



\item[--tcp-option] \mbox{}

Æäáá¿ÉÒÔ±¸Ñ¡ `!' £¬È»ááÎªÒ»¸öÊý×Ö£¬ÓÃÀ´±È¶ÔÒ»¸ö TCP Ñ¡ÏîµÈì¶¸ÃÊý×ÖµÄ·â°ü¡£¼ÙÈçÐèÒª¼ì²é TCP Ñ¡Ïî£¬ÄÇÐ© TCP ±íÍ·²»ÍêÕûµÄ·â°ü¾Í»á×Ô¶¯µÄ±»¶ªÆú¡£

\end{description}





\subparagraph{Ò»¸ö TCP Æì±êµÄ½âÊÍ}

ÓÐÊ±ºò£¬ÔÊÐíµ¥Ïò¶ø·ÇË«ÏòµÄ TCP Á¬Ïß»áºÜºÃÓÃ¡£ÀýÈç£¬Äú»òÐíÏëÔÊÐíÁ¬Ïßµ½Íâ²¿ WWW ËÅ·þÆ÷£¬µ«È´²»ÏëÀ´×Ô¸ÃËÅ·þÆ÷µÄÁ¬Ïß¡£



×îÓ×ÖÉµÄ¾Ù¶¯»òÐí»áÊÇµ²µôÀ´×Ô¸ÃËÅ·þÆ÷µÄ TCP ·â°ü¡£µ«²»ÐÒµÄÊÇ£¬TCP Á¬Ïß¸ù±¾¾ÍÒªÇó·â°üÊÇË«Ïò´«µÝµÄ¡£



½â¾öÖ®µÀÊÇ°ÑÄÇÐ©ÒªÇóÁ¬ÏßµÄ·â°üµ²µô¡£ÕâÐ©·â°ü±»³ÆÎª {\bfseries SYN} ·â°ü(àÅ£¬¼¼ÊõÉÏ½²£¬ËüÃÇÊÇ´ø SYN Éè¶¨µÄ·â°ü£¬¶ø FIN ºÍ ACK ±êÇ©ÔòÊÇ¿Õ°×£¬Ö»ÊÇÎÒÃÇ½«Ö®¼ò³ÆÎª SYN ·â°ü¶øÒÑ)¡£ÒªÖ»ÏÞÖÆÕâÑùµÄ·â°üµÄ»°£¬ÎÒÃÇ¾Í¿ÉÒÔÖÆÖ¹ÄÇÐ©ÍâÀ´µÄÁ¬Ïß³¢ÊÔÁË¡£



`--syn' Æì±ê¿ÉÒÔÓÃì¶ÕâÐ©·½Ãæ£ºËü½ö¶ÔÄÇÐ©Ö¸¶¨Îª TCP Ð­¶¨µÄ¹æÔòÓÐ×÷ÓÃ¡£ÀýÈç£¬Ö¸¶¨À´×Ô 192.168.1.1 µÄ TCP Á¬ÏßÇëÇó£º
\begin{tscreen}
\begin{verbatim}
-p TCP -s 192.168.1.1 --syn
\end{verbatim}
\end{tscreen}




ÕâÆì±êÒ²¿ÉÒÔáá½ÓÒ»¸ö `!' À´·´Éè£¬ÒâÖ¸Ã¿Ò»¸ö·Ç¸ÃÀà³õÊ¼Á¬ÏßµÄ·â°ü¡£




\paragraph{UDP ÑÓÉì}

Èç¹û `-p udp' ±»Ö¸¶¨µÄ»°£¬ÕâÐ©ÑÓÉì¾Í»á×Ô¶¯ÔØÈë¡£ËüÌá¹©ÁË `--source-port'¡¢ `--sport'¡¢`--destination-port'¡¢ÒÔ¼° `--dport' ÕâÐ©Ñ¡Ïî£¬Ò»ÈçÇ°ÊöµÄ TCP Éè¶¨¡£




\paragraph{ICMP ÑÓÉì}

Èç¹û `-p icmp' ±»Ö¸¶¨µÄ»°£¬Õâ¸öÑÓÉì¾Í»á×Ô¶¯ÔØÈë¡£ËüÖ»Ìá¹©Ò»¸öÐÂµÄÑ¡Ïî£º



\begin{description}
\item[--icmp-type] \mbox{}

Æäáá¿ÉÒÔ±¸Ñ¡ `!' £¬È»ááÊÇÒ»¸ö icmp Ãû³ÆÀàÐÍ(Èç `host-unreachable' )£¬»òÊÇÒ»¸öÊý×ÖÀàÐÍ(Èç `3' )£¬»òÊÇÒ»¶ÔÓÃ `/' ·Ö¸ôµÄÊý×ÖÀàÐÍºÍ±àÂë(Èç `3/3' )¡£Ê¹ÓÃ `-p icmp --help' ¾Í¿ÉÒÔ»ñµÃÒ»·Ý¿ÉÓÃ icmp ÀàÐÍÃû³ÆÇåµ¥¡£



\end{description}





\paragraph{ÆäËü±È¶ÔµÄÑÓÉì}

ÔÚ nerfilter Ì×¼þÖÐµÄÆäËüÑÓÉìÔòÊÇÕ¹Ê¾ÐÔ(demonstration)µÄÑÓÉìÄÚÈÝ£¬¿ÉÒÔÓÃ `-m' Ñ¡ÏîÀ´ºô½Ð(¼ÙÈçÒÑ°²×°ÁËµÄ»°)¡£

\begin{description}
\item[mac] \mbox{}

´ËÒ»Ä£×é±ØÐëÒªÃ÷È·µÄÓÃ `-m mac' »ò `--match mac' À´Ö¸¶¨¡£ËüÓÃì¶±È¶Ô´«Èë·â°üµÄÀ´Ô´ Ethernet (MAC) µØÖ·£¬Òò¶øÖ»¶ÔÄÇÐ©´©Ô½ PREROUTING ºÍ INPUT Á´µÄ·â°üÆð×÷ÓÃ¡£ËüÖ»Ìá¹©Ò»¸öÑ¡Ïî£º

\begin{description}
\item[--mac-source] \mbox{}

Æäáá¿ÉÒÔ±¸Ñ¡ `!' £¬È»ááÊÇÒ»¸öÓÃÃ°ºÅ·Ö¸ôµÄÊ®Áù½øÖÆ ethernet µØÖ·£¬Èç  `--mac-source 00:60:08:91:CC:B7'¡£

\end{description}




\item[limit] \mbox{}

Õâ¸öÄ£×é±ØÐëÃ÷È·µÄÓÃ `-m limit' »ò `--match limit'À´Ö¸¶¨¡£ËüÓÃÀ´ÏÞÖÆÒ»¸ö±È¶ÔµÈ¼¶£¬ÖîÈçÒÖÖÆ¼ÇÂ¼ÐÅÏ¢µÈ¡£ËüÖ»ÄÜ±È¶ÔÒ»¸öÃ¿Ãë´ÎÊýÖµ(Ô¤ÉèÊÇÃ¿Ò»¸öÐ¡Ê± 3 ¸ö±È¶Ô£¬°éËæ 5 ¸ö´¥·¢(burst))¡£Ëü½ÓÊÜÁ½¸ö±¸Ñ¡²ÎÊý£º

\begin{description}
\item[--limit] \mbox{}

áá½ÓÒ»¸öÊýÖµ£»Ö¸¶¨¿ÉÔÊÐíµÄÃ¿Ãë×î´óÆ½¾ù±È¶ÔÊýÖµ¡£¸ÃÊýÖµ¿ÉÒÔÓÃ `/second'¡¢`/minute'¡¢`/hour'¡¢»ò  `/day'¡¢»òÆäÖÐ²¿·Ý (¹Ê `5/second' ºÍ `5/s' ÊÇÒ»ÑùµÄ)£¬À´Ã÷È·Ö¸¶¨µ¥Î»(unit)£¬



\item[--limit-burst] \mbox{}

áá½ÓÒ»¸öÊýÖµ£¬Ö¸Ê¾³öÒýÆðÇ°ÊöÏÞÖÆÖ®Ç°µÄ×î´ó´¥·¢´ÎÊý¡£

\end{description}


Õâ¸ö±È¶Ô³£ÓÃì¶ LOG Ä¿±ê£¬ÒÔ½øÐÐ±ÈÂÊÏÞÖÆ(rate-limited) Ö®¼ÇÂ¼¡£ÎªÁË¸üºÃÁË½âËüÊÇÈçºÎ¹¤×÷µÄ£¬ÈÃÎÒÃÇ¿´Ò»¿´ÏÂÃæµÄ¹æÔò£¬ÊÇÒÔÔ¤ÉèÏÞÖÆÒýÊýÀ´¼ÇÂ¼·â°üµÄ£º

\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -m limit -j LOG
\end{verbatim}
\end{tscreen}


µ±´Ë¹æÔòµÚÒ»´ÎÒýÓÃµÄÊ±ºò£¬·â°ü¾Í»á±»¼ÇÂ¼ÏÂÀ´£»ÊÂÊµÉÏ£¬ÓÉì¶Ô¤ÉèµÄ´¥·¢Îª 5 £¬ÄÇÎªÊ×µÄ 5 ¸ö·â°ü¾Í»á¼ÇÂ¼ÏÂÀ´¡£È»áá£¬ÔÙ¸ô 20 ·ÖÖÓ´Ë¹æÔò²Å»áÔÙ¼ÇÂ¼·â°ü£¬¶ø²»¹ÜÆÚ¼äÓÐ¶àÉÙ¸ö·â°üµÖ´ï¡£¶øÇÒ£¬Ã¿ 20 ·ÖÖÓÈç¹ûÃ»ÓÐ·ûºÏµÄ·â°üÍ¨¹ý£¬Ôò»á»Ö¸´ (regained) Ò»¸ö´¥·¢ÊýÖµ£»¼ÙÈç 100 ·ÖÖÓÄÚÔÙÎÞÕâÑùµÄ·â°ü´¥¼°Õâ¹æÔòµÄ»°£¬ÄÇ÷á´¥·¢´ÎÊý¾Í»áÍêÈ«¸´Ô­(recharged)£»»Øµ½ÎÒÃÇ¿ªÊ¼Ê±µÄ×´Ì¬¡£



×¢£ºÄúÄ¿Ç°²»ÄÜÒÔ´óì¶ 59 Ð¡Ê±µÄ¸´Ô­Ê±¼äÀ´½¨Á¢Ò»¸ö¹æÔò£¬¹Ê´Ë£¬¼ÙÈçÄúÉè¶¨Ò»¸öÆ½¾ùÂÊÎªÃ¿ÌìÒ»´Î£¬ÄÇ÷á£¬ÄúµÄ´¥·¢ÂÊÔòÒ»¶¨ÒªÉÙì¶ 3 ¡£



ÄúÒ²¿ÉÒÔÓÃÕâÄ£×éÈ¥±ÜÃâÒÔ¿ìËÙ±ÈÂÊÌáÉý·þÎñ»ØÓ¦µÄ×è¶Ï·þÎñ¹¥»÷(DoS)¡£



Syn-flood protection£º
\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -p tcp --syn -m limit --limit 1/s -j ACCEPT
\end{verbatim}
\end{tscreen}


Furtive port scanner£º
\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -p tcp --tcp-flags SYN,ACK,FIN,RST RST -m limit --limit 1/s -j ACCEPT
\end{verbatim}
\end{tscreen}


Ping of death£º
\begin{tscreen}
\begin{verbatim}
# iptables -A FORWARD -p icmp --icmp-type echo-request -m limit --limit 1/s -j ACCEPT
\end{verbatim}
\end{tscreen}


´ËÄ£×éµÄ¹¤×÷Ô­ÀíÓÐµãÏñ¡°½ØÁ÷·§¡±Ò»Ñù£¬Çë²Î¿¼ÏÂÃæµÄÍ¼Ê¾¡£

\begin{tscreen}
\begin{verbatim}
       rate (pkt/s)  
             ^        .---.
             |       / DoS \
             |      /       \
Edge of DoS -|.....:.........\.......................
 = (limit *  |    /:          \
limit-burst) |   / :           \         .-.
             |  /  :            \       /   \
             | /   :             \     /     \
End of DoS  -|/....:..............:.../.......\..../.
 = limit     |     :              :`-'         `--'
-------------+-----+--------------+------------------> time (s)
   LOGIC =>  Match | Didn't Match |    Match
\end{verbatim}
\end{tscreen}


±È·½Ëµ£¬ÎÒÃÇÒÔ 5 ¸ö·â°ü´¥·¢À´±È¶ÔÃ¿ÃëÒ»¸ö·â°ü£¬µ«·â°ü´ÓÃ¿ÃëËÄ¸ö¿ªÊ¼´«Èë£¬³ÖÐøÈýÃë£¬È»ááµÈÈýÃëÔÙÖØÐÂ¿ªÊ¼¡£
\begin{tscreen}
\begin{verbatim}


        <--Flood 1-->           <---Flood 2--->

Total  ^                   Line  __--      YNNN
Packets|               Rate  __--      YNNN
       |            mum  __--      YNNN
    10 |        Maxi __--         Y
       |         __--            Y
       |     __--               Y
       | __--    YNNN           
       |-    YNNN
     5 |    Y    
       |   Y                                Key:  Y -> Matched Rule
       |  Y                                       N -> Didn't Match Rule
       | Y
       |Y 
     0 +-------------------------------------------------->  Time (seconds)
        0   1   2   3   4   5   6   7   8   9  10  11  12
\end{verbatim}
\end{tscreen}


Äú»á·¢ÏÖÍ·Îå¸ö·â°ü±»ÔÊÐí³¬¹ýÃ¿ÃëÒ»¸ö·â°ü£¬È»áá¾ÍÒýÆðÏÞÖÆÁË£¬Èç¹ûÓÐÒ»¸öÍ£Ðª£¬ÆäËüµÄ´¥·¢Ò²½«±»ÔÊÐí£¬µ«¾Í²»ÄÜÍ¨¹ý¹æÔòÉè¶¨µÄ×î¸ß±ÈÂÊ(ÔÚ¸Ã´¥·¢Ê¹ÓÃááÎªÃ¿ÃëÒ»¸ö·â°ü)¡£



\item[owner] \mbox{}

´ËÄ£×éÎª±¾»ú²úÉúµÄ·â°ü±È¶Ô²»Í¬ÌØÕ÷µÄ·â°ü½¨Á¢Õß(creator)¡£Ëü½ö¶Ô OUTPUT Á´ÓÐÓÃ£¬¶øÇÒ£¬ÉõÖÁÄ³Ð©·â°ü(Èç ICMP ping responses)»òÐíÃ»ÓÐ owner£¬½«±»ÊÓÎª²»·ûºÏÅ¶¡£

\begin{description}
\item[--uid-owner userid] \mbox{}

Èç¹û·â°üÓÉÒ»¸öÐÐ³ÌÒÔÓÐÐ§(Êý×ÖÊ½) user id ½¨Á¢µÄ£¬ÔòÎª·ûºÏ¡£

\item[--uid-owner groupid] \mbox{}

Èç¹û·â°üÓÉÒ»¸öÐÐ³ÌÒÔÓÐÐ§(Êý×ÖÊ½) group id ½¨Á¢µÄ£¬ÔòÎª·ûºÏ¡£

\item[--pid-owner processid] \mbox{}

Èç¹û·â°üÓÉÒ»¸öÐÐ³ÌÒÔ process id ½¨Á¢µÄ£¬ÔòÎª·ûºÏ¡£

\item[--sid-owner processid] \mbox{}

Èç¹û·â°üÓÉÒ»¸öÐÐ³ÌÒÔ session group ½¨Á¢µÄ£¬ÔòÎª·ûºÏ¡£

\end{description}




\item[unclean] \mbox{}

´ËÒ»ÊµÑéÐÔÄ£×é±ØÐëÒÔ `-m unclean' »ò `--match unclean' À´Ã÷È·Ö¸¶¨¡£Ëü»á¶Ô·â°ü½øÐÐ²»Í¬µÄËæ»úÅÐ¶Ï¼ì²â¡£ÕâÄ£×éÉÐÎ´±»»ü²é¹ý£¬ËùÒÔ²»Ó¦¸ÃÓÃì¶°²È«Éè±¸ÉÏ(Ëü»òÐí»á°ÑÊÂÇé¸ãÔÒ£¬ÒòÎªËü±¾Éí»òÐíÓÐ³ô³æµÄ)¡£Ëü²¢Ã»Ìá¹©Ñ¡ÏîÉè¶¨¡£

\end{description}





\paragraph{The State Match}

×îÓÐÓÃµÄ±È¶ÔÅÐ¶Ï±ê×¼ÓÉ `state' ÑÓÉìËùÌá¹©£¬ÒÔÚ¹ÊÍ `ip\_conntrack' Ä£×éµÄÁ¬Ïß×·×Ù·ÖÎö¡£ÕâÊÇ·Ç³£ÖµµÃ¹ÄÀøÊ¹ÓÃµÄ¡£



Ö¸¶¨  `-m state' ÔòÔÊÐíÁíÒ»¸ö¶îÍâµÄ `--state' Ñ¡Ïî£¬¿ÉÒÔÎªÒ»¸ö¶¹µã·Ö¸ôµÄ±È¶Ô³ÂÊöÁÐ±í(  `!'  Æì±êÖ¸Ê¾ {\bfseries ²»(not)} ·ûºÏÄÇÐ©³ÂÊö)¡£ÕâÐ©³ÂÊöÊÇ£º

\begin{description}
\item[NEW] \mbox{}

Ò»¸ö½¨Á¢ÐÂÁ¬ÏßµÄ·â°ü¡£



\item[ESTABLISHED] \mbox{}

Ò»¸öÊôì¶ÏÖÓÐÁ¬Ïß(Èç£ºÒÑ¾­»ØÓ¦·â°üÁË)Ö®·â°ü¡£



\item[RELATED] \mbox{}

Ò»¸öÓëÏÖÓÐÁ¬ÏßÏà¹Ø£¬µ«È´²¢²»ÏÞì¶ÆäÖÐ²¿·ÝµÄ·â°ü£¬ÖîÈç ICMP ´íÎó£¬»òÊÇ½¨Á¢ FTP Êý¾ÝÁ¬ÏßµÄ·â°ü(FTP Ä£×éÒÑ²åÈë)¡£



\item[INVALID] \mbox{}

Ò»¸öÒòÄ³Ð©Ô­Òò²»ÄÜ±»¼ø±ðµÄ·â°ü£ºÕâ°üÀ¨¼ÇÒäÌå²»×ãºÍ²»ÄÜ»ØÓ¦ÈÎºÎÒÑÖªÁ¬ÏßµÄ ICMP ´íÎó¡£Í¨³££¬ÕâÑùµÄ·â°ü¶¼»á±»¶ªÆúµô¡£

\end{description}





\subsection{Ä¿±ê(Target)¹æ¸ñ}

ÏÖÔÚ£¬ÎÒÃÇÖªµÀ¿ÉÒÔ¶Ô·â°ü×öÊ²÷áÑùµÄ¼ì²éÁË£¬ÎÒÃÇ»¹ÐèÒªÒ»¸ö·½·¨À´Ëµ³ö¶ÔÒ»¸ö·ûºÏÎÒÃÇ²âÊÔµÄ·â°üÒª×öÊ²÷áÑù¶¯×÷¡£Õâ¾ÍÊÇËùÎ½µÄÒ»Ìõ¹æÔòÖ®{\bfseries Ä¿±ê(target)} À²¡£



ÓÐÁ½¸ö·Ç³£ÏàÀàµÄÄÚ½¨Ä¿±ê£ºDROP ºÍ ACCEPT£¬ÎÒÃÇÒÑ¾­½Ó´¥¹ýÁË¡£Èç¹ûÒ»Ìõ¹æÔò·ûºÏÒ»¸ö·â°ü£¬Í¬Ê±Ä¿±êÊÇÆäÖÐÖ®Ò»£¬ÄÇ÷á¾ÍÔÙÃ»ÓÐ¹æÔòÐèÒª×ÉÑ¯£º·â°üµÄÃüÔËÒÑ¾­¶¨ÏÂÀ´ÁË¡£



³ýÁËÄÚ½¨Íâ£¬Ò²ÓÐÁ½ÖÖÀàÐÍµÄÄ¿±ê£ºÑÓÉìºÍÓÃ»§×Ô¶¨Á´¡£




\subsubsection{ÓÃ»§×Ô¶¨Á´}

{\ttfamily iptables} ³ÐÏ®ÁË {\ttfamily ipchains} Ò»¸ö·Ç³£À÷º¦µÄ¹¦ÄÜ£¬¾ÍÊÇÈÃÊ¹ÓÃÕß¿ÉÒÔ´´½¨³öÐÂÁ´£¬¸½¼Óì¶Èý¸öÄÚ½¨Á´(INPUT¡¢FORWARD¡¢ºÍ OUTPUT)Ö®Íâ¡£°´¹ßÀý£¬ÓÃ»§×Ô¶¨Á´ÓÃÐ¡Ð´ÒÔÊ¾Çø±ð(´ý»áÎÒÃÇ»áÔÚááÃæµÄ \ref{chain-ops} {(ÔÚÕûÁ´ÉÏÔË×÷(Operations on an Entire Chain))} ÄÇÀï½âÊÍÈçºÎÈ¥½¨Á¢ÐÂµÄÓÃ»§×Ô¶¨Á¬)



µ±Ò»¸ö·â°ü·ûºÏÒ»ÌõÄ¿±êÎªÓÃ»§×Ô¶¨Á´Ö®¹æÔòÊ±£¬·â°ü¾Í»á¿ªÊ¼´©Ô½ÓÃ»§×Ô¶¨Á´ÖÐµÄ¹æÔò¡£¼ÙÈç¸ÃÁ´Î´ÄÜ¾ö¶¨³ö·â°üµÄÃüÔË£¬ÔòÒ»µ©½áÊø´©Ô½¸ÃÁ´áá£¬¾Í»á½ÓÖøµ±Ç°Á´ÖÐµÄÏÂÒ»¸ö¹æÔò¼ÌÐø´©Ô½ÏÂÈ¥¡£



¼ÌÐøÍæÍæ ASCII ÒÕÊõºÃÁË¡£¼ÙÉèÓÐÕâ÷áÁ½Ìõ(¹Ö)Á´£º{\ttfamily INPUT} (ÄÚ½¨Á´)£¬ ºÍ {\ttfamily test} (ÓÃ»§×Ô¶¨Á´)¡£

\begin{tscreen}
\begin{verbatim}
         `INPUT'                         `test'
        ----------------------------    ----------------------------
        | Rule1: -p ICMP -j DROP   |    | Rule1: -s 192.168.1.1    |
        |--------------------------|    |--------------------------|
        | Rule2: -p TCP -j test    |    | Rule2: -d 192.168.1.1    |
        |--------------------------|    ----------------------------
        | Rule3: -p UDP -j DROP    |
        ----------------------------
\end{verbatim}
\end{tscreen}




¼ÙÉèÒ»¸öÀ´×Ô192.168.1.1 µÄ TCP ·â°ü£¬Òªµ½ 1.2.3.4 ÄÇÀïÈ¥¡£Ëü½øÈë{\ttfamily INPUT} Á´£¬²¢ÊÜµ½ Rule1 µÄ²âÊÔ - µ«²»·ûºÏ¡£µ«ÊÇ·ûºÏ Rule2 £¬ÇÒËüµÄÄ¿±êÊÇ {\ttfamily test}£¬ËùÒÔÏÂÒ»¸öÒª¼ìÑéµÄ¹æÔò½«´Ó {\ttfamily test} ¿ªÊ¼¡£ÔÚ {\ttfamily test} ÖÐµÄ Rule1 ·ûºÏ£¬µ«²¢Ã»ÓÐÖ¸¶¨Ä¿±ê£¬ËùÒÔÔÙ¼ìÑéÏÂÒ»Ìõ¹æÔò£¬Ò²¾ÍÊÇ Rule2 ¡£²»¹ýËü²¢²»·ûºÏ£¬ËùÒÔÎÒÃÇÒÑ¾­µÖ´ïÕâÌõÁ´µÄÄ©¶ËÁË¡£È»ááÎÒÃÇ»Øµ½ {\ttfamily INPUT} Á´ÖÐ£¬Ò²¾ÍÊÇÎÒÃÇ¸Õ²Å¼ìÑé Rule2 ÄÇÀï£¬ËùÒÔÎÒÃÇÏÖÔÚ¾ÍÒª¼ì²é Rule3£¬ÒÀÈ»²»·ûºÏ¡£



ÕâÑù£¬¸Ã·â°üµÄÂ·¾¶ÊÇÕâÑù×ÓµÄ£º
\begin{tscreen}
\begin{verbatim}
                                v    __________________________
         `INPUT'                |   /    `test'                v
        ------------------------|--/    -----------------------|----
        | Rule1                 | /|    | Rule1                |   |
        |-----------------------|/-|    |----------------------|---|
        | Rule2                 /  |    | Rule2                |   |
        |--------------------------|    -----------------------v----
        | Rule3                 /--+___________________________/
        ------------------------|---
                                v
\end{verbatim}
\end{tscreen}




ÓÃ»§×Ô¶¨Á´Ò²¿ÉÒÔÔÙÌøµ½ÁíÒ»¸öÓÃ»§×Ô¶¨Á´È¥(µ«²»Òª×ö³É»ØÈ¦£ºÄúµÄ·â°üÈç¹û±»·¢ÏÖ´¦ì¶»ØÈ¦ÖÐ¾Í»á±»¶ªÆú)¡£




\subsubsection{iptables Ö®ÑÓÉì£ºÐÂÄ¿±ê}

ÁíÒ»ÀàÐÍµÄÄ¿±êÊÇÒ»¸öÑÓÉì¡£Ò»¸öÄ¿±êµÄÑÓÉìÓÉºËÐÄÄ£×éºÍ¿ÉÑ¡µÄ {\ttfamily iptables} ÑÓÉì×é³É£¬ÒÔÌá¹©ÐÂµÄÃüÁîÐÐÑ¡Ïî¡£ÔÚÔ¤ÉèµÄ netfilter É¢²¥°æ±¾ÖÐÓÐºÃ¼¸¸öÑÓÉì£º

\begin{description}
\item[LOG] \mbox{}

´ËÄ£×éÌá¹©ºËÐÄ¼ÇÂ¼·ûºÏµÄ·â°ü¡£ËüÌá¹©ÕâÐ©¶îÍâÑ¡Ïî£º
\begin{description}
\item[--log-level] \mbox{}

áá½ÓÒ»¸ö²ã´Î(level)ºÅÂë»òÃû³Æ¡£ºÏ·¨µÄÃû³ÆÓÐ(´óÐ¡Ð´ÓÐ±ð)£º`debug'¡¢`info'¡¢`notice'¡¢`warning'¡¢`err'¡¢`crit'¡¢`alert'¡¢ÒÔ¼° `emerg'£¬Ïà¶ÔµÄºÅÂëÓÉ 7 µ½ 0 ¡£¸÷²ã´ÎºÅÂëµÄ½âÊÍÇë²Î¿¼ syslog.conf µÄ man page¡£



\item[--log-prefix] \mbox{}

áá½ÓÒ»¸ö×î¶à 30 ¸ö×ÖÄ¸µÄ×Ö´®¡£´ËÒ»ÐÅÏ¢ÓÉ¼ÇÂ¼ÐÅÏ¢¿ªÊ¼Ê±ËÍ³ö£¬ÁîÆä¿ÉÒÔ¸ö±ðµÄ±»¼ø±ð³öÀ´¡£

\end{description}


´ËÄ£×é³£ÓÃì¶Ò»¸öÏÞÖÆÄ¿±êáá£¬ËùÒÔ£¬Äú²»Òª¹à±¬ÄúµÄ¼ÇÂ¼µµÅ¶¡£



\item[REJECT] \mbox{}

´ËÄ£×é³ýÁËÏò·¢ËÍ¶ËËÍ³öÒ»¸ö `port unreachable' ÕâÑùµÄ ICMP ´íÎóÍâ£¬ºÍ `DROP' ÊÇÒ»ÑùµÄ¡£×¢£ºÔÚÏÂÁÐÌõ¼þÖÐ£¬ICMP ´íÎóÐÅÏ¢½«²»»áËÍ³ö(Çë²Î¿¼ RFC 1122)£º

\begin{itemize}
\item  ±»¹ýÂËµÄ·â°üÒ»¿ªÊ¼¾ÍÊÇÒ»¸ö ICMP ´íÎóÐÅÏ¢£¬»òÊÇÆäËü²»Ã÷µÄ ICMP ÀàÐÍ¡£
\item  ±»¹ýÂËµÄ·â°üÎªÒ»¸öÎÞÍ· (non-head) ËéÆ¬¡£
\item  ÎÒÃÇÄ¿Ç°ÒÑ¾­ËÍ³öÌ«¶àÖÁ¸ÃÄ¿µÄµØµÄ ICMP ´íÎóÐÅÏ¢ÁË¡£
\end{itemize}


REJECT ÁíÍâ»¹½ÓÊÜÒ»¸ö `--reject-with' Ñ¡ÏîÀ´¸ü¸ÄÆä»ØÓ¦·â°ü£ºÇë²Î¿¼ËµÃ÷ÎÄ¼þ¡£

\end{description}





\subsubsection{ÌØÊâµÄÄÚ½¨Ä¿±ê}

ÓÐÁ½ÖÖÌØÊâµÄÄÚ½¨Ä¿±ê£º{\ttfamily RETURN} ºÍ {\ttfamily QUEUE}¡£



{\ttfamily RETURN} ºÍµôµ½Ò»¸öÁ´µÄÄ©¶ËÓÐÏàÍ¬µÄÐ§¹û£º¶ÔÒ»ÌõÄÚ½¨Á´µÄ¹æÔò¶øÑÔ£¬ÔòÆôÓÃ¸ÃÁ´µÄÔ­Ôò¡£¶ÔÒ»ÌõÓÃ»§×Ô¶¨¹æÔò¶øÑÔ£¬Ôò»á»Øµ½Ç°Ò»¸öÁ´ÖÐ¼ÌÐø´©Ô½£¬¾Í½ÓÔÚÌøµ½Õâ¸öÁ´µÄÄÇÌõ¹æÔòÖ®áá¡£



{\ttfamily QUEUE} Ò²ÊÇÒ»¸öÌØÊâÄ¿±ê£¬¿ÉÒÔÌæÊ¹ÓÃÕß¿Õ¼ä(userspace)ÐÐ³Ì´¢ÁÐ·â°ü¡£ÒªÔËÓÃËü£¬Á½¸ö¹¦ÄÜ×é¼þÊÇ±ØÐèµÄ£º

\begin{itemize}
\item ÆäÒ»Îª "queue handler"£¬´¦ÀíÊ¹ÓÃÕß¿Õ¼äÓëºËÐÄÖ®¼ä´«ËÍ·â°üµÄÊµÖÊ»úÖÆ£»
\item ÁíÒ»¸öÎªÒ»Ê¹ÓÃÕß¿Õ¼äµÄÓ¦ÓÃ³ÌÊ½£¬È¥½ÓÊÕ£¬»òËµ²Ù¿Ø£¬ÒÔ¼°¶Ô·â°ü×ö³ö²Ã¾ö¡£
\end{itemize}

IPv4 iptables µÄ±ê×¼ queue handler Îª ip\_queue Ä£×é£¬ËüÄ¿Ç°ÊÇÒÔÊµÑéÐÔÖÊÓëºËÐÄÒ»Æð·¢²¼µÄ¡£

ÈçÏÂÊÇÒ»¸öÈçºÎÓÃ iptables ÎªÊ¹ÓÃÕß¿Õ¼äÐÐ³Ì½øÐÐ´¢ÁÐ·â°üµÄ¼òµ¥Àý×Ó£º
\begin{tscreen}
\begin{verbatim}
# modprobe iptable_filter
# modprobe ip_queue
# iptables -A OUTPUT -p icmp -j QUEUE
\end{verbatim}
\end{tscreen}

ÓÃ´Ë¹æÔò£¬±¾»ú²úÉúµÄ¶ÔÍâ ICMP ·â°ü(ÈçÓÃ ping ½¨Á¢) ¾Í»á±»ËÍÖÁ ip\_queue Ä£×éÈ¥£¬È»áá³¢ÊÔ½«·â°ü´«¸øÊ¹ÓÃÕß¿Õ¼äÓ¦ÓÃ³ÌÊ½¡£Èç¹ûÃ»ÓÐÊ¹ÓÃÕß¿Õ¼äÓ¦ÓÃ³ÌÊ½ÔÚµÈ´ýµÄ»°£¬¸Ã·â°ü¾Í»á±»¶ªÆú¡£



ÒªÐ´Ò»¸öÊ¹ÓÃÕß¿Õ¼äÓ¦ÓÃ³ÌÊ½£¬ÐèÊ¹ÓÃ libipq API ¡£ËüÒ²ÊÇºÍ iptables Ò»Æð·¢²¼µÄ¡£³ÌÊ½Âë¡õÀý¿ÉÒÔÔÚ CVS ÖÐµÄ testsuite ¹¤¾ß(Èç redirect.c) ÕÒµ½¡£



ip\_queue µÄ×´Ì¬¿ÉÒÔÓÃÈçÏÂ·½·¨À´¼ì²é£º
\begin{tscreen}
\begin{verbatim}
/proc/net/ip_queue
\end{verbatim}
\end{tscreen}

´¢ÁÐµÄ×î´ó³¤¶È(Èç´«µÝ¸øÊ¹ÓÃÕß¿Õ¼äÇÒÎÞÐèËÍ»Ø²Ã¾ö·â°üÖ®ÊýÁ¿)¿ÉÒÔÍ¨¹ýÕâÑùµÄ·½Ê½À´¿ØÖÆ£º
\begin{tscreen}
\begin{verbatim}
/proc/sys/net/ipv4/ip_queue_maxlen
\end{verbatim}
\end{tscreen}

×î´ó´¢ÁÐ³¤¶ÈµÄÔ¤ÉèÖµÎª 1024¡£Ò»µ©´ïµ½´ËÏÞÖÆ£¬ÐÂµÄ·â°ü¾Í»á±»¶ªÆú£¬Ö±µ½´¢ÁÐ³¤¶Èµø»ØµÍì¶ÏÞÖÆÖ®ÊýÎªÖ¹¡£ºÃµÄÐ­¶¨£¬Èç TCP£¬»á½«¶ªÆúµÄ·â°ü½âÊÍÎªÓµ¼·(congestion)£¬Í¬Ê±ÀíÏëµØ£¬µ±´¢ÁÐÌîÆðÀ´áá»á½«Ö®µ²»ØÈ¥¡£È»¶ø£¬Èç¹ûÔ¤ÉèÖµÔÚËù¾ÙÇéÐÎÏÂ¾õµÃÌ«Ð¡µÄ»°£¬»òÐíÐèÒªÒ»Ð©ÊµÑéÀ´¾ö¶¨ÆäÀíÏëµÄ×î¸ß´¢ÁÐ³¤¶È¡£




\subsection{ÔÚÕûÁ´ÉÏÔË×÷\label{chain-ops}}

{\ttfamily iptables} µÄÒ»¸ö·Ç³£ÓÐÓÃµÄ¹¦ÄÜÊÇ£¬ËüÄÜ¹»×éºÏ(group)Ïà¹ØµÄ¹æÔòì¶Á´ÖÐ¡£Ö»ÒªÄúÏ²»¶£¬Äú¿ÉÒÔËæ±ãÎªÁ´ÆðÒ»¸öÃû×Ö£¬µ«ÎÒ½¨ÒéÄúÊ¹ÓÃÐ¡Ð´×ÖÄ¸ÒÔ±ÜÃâºÍÄÚ½¨Á´¼°Ä¿±ê¸ã»ìÁË¡£Á´Ãû×î³¤¿ÉÒÔÈ¥µ½ 31 ¸ö×ÖÄ¸¡£




\subsubsection{½¨Á¢Ò»¸öÐÂÁ´}

ÏÖÔÚ¾ÍÈÃÎÒÃÇÒ»Æð½¨Ò»¸öÐÂÁ´°É¡£ÒòÎªÎÒÊµÔÚÊÇÒ»¸ö°®»ÃÏëµÄ¼Ò»ï£¬ËùÒÔÎÒ³ÆÖ®Îª{\ttfamily test} (¹þ£¬ÓÐµã·í´Ì)¡£ÕâÀï£¬ÎÒÃÇÓÃ `-N' »ò `--new-chain' Ñ¡Ïî£º

\begin{tscreen}
\begin{verbatim}
# iptables -N test
#
\end{verbatim}
\end{tscreen}




¾ÍÊÇÕâ÷á¼òµ¥¡£ºÃÁË£¬ÏÖÔÚÄú¿ÉÒÔ½«Ò»Ð©¹æÔò¼ÓÈëÆäÖÐ£¬Ò»ÈçÇ°ÃæËµµÄÄÇÑù¡£




\subsubsection{É¾³ýÒ»ÌõÁ´}

ÒªÉ¾³ýÒ»ÌõÁ´Ò²ÊÇÒ»Ñù¼òµ¥£¬ÓÃ `-X' »ò `--delete-chain' ¼´¿É¡£ÎªÊ²÷áÓÃ `-X' ÄØ£¿àÅ£¬ ºÃÓÃµÄ×ÖÄ¸¶¼Ò»Ôç¸øÓÃ¹âÁËÀ²¡£

\begin{tscreen}
\begin{verbatim}
# iptables -X test
#
\end{verbatim}
\end{tscreen}




ÒªÉ¾³ýÒ»ÌõÁ´µÄ»°£¬»áÓÐºÃÐ©ÏÞÖÆ£ºËüÃÇ±ØÐèÊÇ¿ÕµÄ (Çë²Î¿¼ááÃæµÄ \ref{flushing} {(Çå¿ÕÒ»ÌõÁ´(Flushing a Chain))} ) £¬Í¬Ê±ËüÃÇ±ØÐè²»ÄÜ×÷ÎªÈÎºÎ¹æÔòµÄÄ¿±ê¡£ÈÎºÎÈýÌõÄÚ½¨Á´Äú¶¼²»ÄÜÉ¾³ý¾ÍÊÇÁË¡£



¼ÙÈçÄú²»Ö¸¶¨Ò»ÌõÁ´£¬ÄÇ÷áÈç¹û¿ÉÄÜµÄ»°£¬ {\itshape È«²¿\/} ÓÃ»§×Ô¶¨µãÁ´¶¼»á±»É¾³ý¡£




\subsubsection{Çå¿ÕÒ»ÌõÁ´\label{flushing}}

ÓÐÒ»¸ö¼òµ¥µÄ·½·¨¿ÉÒÔÇå¿ÕÒ»ÌõÁ´ÖÐµÄËùÓÐ¹æÔò£¬¾ÍÊÇÊ¹ÓÃ `-F' (»ò `--flush') ÃüÁî¡£

\begin{tscreen}
\begin{verbatim}
# iptables -F forward
#
\end{verbatim}
\end{tscreen}




Èç¹ûÄú²»Ö¸¶¨ÊÇÄÄÒ»ÌõÁ´£¬ÄÇ÷á {\itshape È«²¿\/} Á´¶¼»á±»Çå¿Õ¡£




\subsubsection{ÁÐÊ¾Ò»ÌõÁ´}

Äú¿ÉÒÔÊ¹ÓÃ `-L' (»ò `--list') ÃüÁîÁÐÊ¾Ò»ÌõÁ´ÖÐµÄËùÓÐ¹æÔò¡£



Ã¿Ò»¸öÓÃ»§×Ô¶¨Á´ËùÁÐµÄ `refcnt' £¬ÊÇËµÓÐ¶àÉÙÊýÄ¿µÄ¹æÔòÊÇÒÔ¸ÃÁ´ÎªÄ¿±êµÄ¡£ÔÚ¸ÃÁ´±»É¾³ýÖ®Ç°£¬ÕâÊýÄ¿±ØÐèÎªÁã(Í¬Ê±Á´ÊÇ¿ÕµÄ)¡£



Èç¹ûÃ»Ìá¹©Á´Ãû³ÆµÄ»°£¬ËùÓÐÁ´¶¼»á±»ÁÐÊ¾³öÀ´£¬¾ÍËã¿ÕÁ´Ò²Ò»Ñù¡£



ÓÐÈý¸öÑ¡Ïî¿ÉÒÔ°éËæ  `-L' Ò»ÆðÊ¹ÓÃµÄ¡£Ê×ÏÈÊÇ `-n' (numeric) Ñ¡Ïî£¬ËüºÜÓÐÓÃ£¬ÒòÎªËü¿ÉÒÔ±ÜÃâ {\ttfamily iptables} È¥³¢ÊÔ²éÕÒ IP µØÖ·£¬¼ÙÈçÄúµÄ DNS Ã»ÓÐÉè¶¨ÕýÈ·µÄ»°£¬»òÊÇÄúÒÑ¾­¹ýÂËµô DNS ÇëÇóÁË£¬Õâ»òÐí»áÔì³ÉÑÏÖØµÄÑÓ³Ù(¼ÙÉèÄúºÍ´ó¶àÊýÈËÒ»Ñù¶¼ÊÇÊ¹ÓÃ DNS )¡£ËüÍ¬Ê±Ò²»á½« TCP Óë UDP ²º¿ÚÏÔÊ¾ÎªÊý×Ö¶ø·ÇÃû³Æ¡£



µÚ¶þ¸öÊÇ `-v' Ñ¡Ïî£¬Ëü»áÏÔÊ¾³öÄúÈ«²¿¹æÔòµÄÏ¸½Ú£¬ÖîÈç·â°üµÄ byte Á÷Á¿Í³¼Æ¡¢TOS ±È½Ï¡¢ÒÔ¼°½çÃæµÈ¡£·ñÔòÕâÐ©ÊýÖµÊÇ±»ÂÔµôµÄ¡£



×¢£º·â°üµÄ byte Á÷Á¿Í³¼Æ¿ÉÒÔ·Ö±ðÊ¹ÓÃ `K', `M' »ò `G' ÕâÐ©×ÖÎ²£¬·Ö±ð´ú±í 1000¡¢1,000,000¡¢ÒÔ¼°1,000,000,000£¬À´ÏÔÊ¾¡£Ê¹ÓÃ `-x' (expand numbers) Æì±êÍ¬ÑùÒ²¿ÉÒÔÏÔÊ¾³öÍêÕûµÄÊý×Ö£¬¸ù±¾²»Àí»áËüÃÇÓÐ¶à³¤¡£




\subsubsection{ÖØÉè(¹éÁã)Á÷Á¿¼ÇÊýÆ÷(counter)}

ÄÜ¹»ÖØÉèÁ÷Á¿¼ÇÊýÆ÷µ±È»ÊÇÓÐÓÃµÄ¡£Äú¿ÉÒÔÓÃ  `-Z' (»ò `--zero') Ñ¡ÏîÀ´×ö¡£



Î¨Ò»Âé·³ÊÇ£¬ÓÐÊ±ºòÔÚ½øÐÐÖØÉèÖ®Ç°£¬Äú±ØÐèÁ¢¼´¼Ç×¡Á÷Á¿Í³¼ÆÖµ¡£ÔÚÇ°ÃæµÄÀý×ÓÖÐ£¬µ±ÄúÏÂ `-L' È»áá `-Z' ÃüÁî£¬Ä³Ð©·â°ü¿ÉÄÜ»áÔÚÕâÆÚ¼äÍ¨¹ý¡£Òò´Ë£¬Äú¿ÉÒÔ°Ñ `-L' ºÍ `-Z' {\itshape Ò»Æð\/} Ê¹ÓÃ£¬ÔÚ¶ÁÈ¡µÄÍ¬Ê±½øÐÐ¼ÇÊýÆ÷ÖØÉè¡£






\subsubsection{Éè¶¨Ô­Ôò(policy)\label{policy}}

ÎÒÃÇÔÚÇ°ÃæÌ½ÌÖ·â°üÈçºÎÍ¨¹ýÒ»¸öÁ´µÄÊ±ºò£¬ÒÑÚ¹ÊÍ¹ýµ±·â°üµÖ´ïÄÚ½¨Á´Ä©¶ËÊ±½«»á·¢ÉúÊ²÷áÊÂÇé¡£´ËÊ±£¬¾ÍÓÉ¸ÃÁ´µÄ{\bfseries Ô­Ôò}À´¾ö¶¨·â°üµÄÃüÔË¡£Ö»ÓÐÄÚ½¨Á´({\ttfamily INPUT}¡¢{\ttfamily OUTPUT}¡¢ÒÔ¼° {\ttfamily FORWARD}) ²ÅÓÐÔ­ÔòÉè¶¨£¬ÒòÎª£¬Èç¹ûÒ»¸ö·â°üµôÖÁÒ»¸öÓÃ»§×Ô¶¨Á´µÄÊ±ºò£¬Ôò»á»Øµ½ÉÏÒ»¸öÁ´ÖÐ¼ÌÐø´©Ô½¡£



Ô­Ôò¿ÉÒÔÎª {\ttfamily ACCEPT} »ò {\ttfamily DROP}¡£




\section{Ê¹ÓÃ ipchains Óë ipfwadm\label{oldstyle}}

 ÔÚ netfilter Ì×¼þÖÐ£¬ÓÐÁ½¸öÄ£×é·Ö±ð½Ð×ö ipchains.o ºÍ ipfwadm.o¡£ÄúÖ»Òª½«ÆäÖÐÒ»¸ö²åÈë½øºËÐÄÀïÃæ( ×¢£ºËüÃÇºÍ iptables.o¡¢ip\_conntrack.o ¼° ip\_nat.o ÊÇ²»¼æÈÝµÄ£¡)¡£È»ááÄú¾Í¿ÉÒÔÈçÍù³£Ò»°ãÊ¹ÓÃ ipchains »ò ipfwadm ÁË¡£



 ÕâÔÚÒ»¶¨Ê±ÆÚÄÚÕâÈÔ»á±»Ö§³ÖµÄ¡£ÎÒÈÏÎªºÏÀíµÄ¼ÆËã¹«Ê½ÊÇ£º2 * {[} Ìæ´ú²úÆ··¢²¼ - ³õÊ¼ÎÈ¶¨·¢ÐÐ ] £¬ÔÙ¼ÓÉÏÌæ´ú²úÆ·¿ÉÒÔÕæÕýÎÈ¶¨·¢ÐÐµÄÈÕ×Ó¡£



»»¶øÑÔÖ®£¬¶Ô ipfwadm µÄ×îááÖ§³Ö½«»áÑÓÖÁ£º

\begin{tscreen}
\begin{verbatim}
2 * [October 1997 (2.1.102 release) - March 1995 (ipfwadm 1.0)]
        + January 1999 (2.2.0 release)
    = November 2003.
\end{verbatim}
\end{tscreen}




 ¶ø¶Ô ipchains µÄ×îááÖ§³ÖÔòÎª£º

\begin{tscreen}
\begin{verbatim}
2 * [August 1999 (2.3.15 release) - October 1997 (2.2.0 release)]
        + July 2000 (2.4.0 release?)
    = March 2004.
\end{verbatim}
\end{tscreen}


ËùÒÔ£¬ÔÚ 2004 ÄêÖ®Ç°¶¼¿ÉÒÔ¸ßÕíÎÞ¡õÀ²¡£




\section{ÕûºÏ NAT Óë Packet Filtering}

Òª×ö Network Address Translation (Çë²ÎÔÄ NAT HOWTO) ÒÔ¼°·â°ü¹ýÂË£¬ÒÑÊÇºÜÆ½³£Ö®ÊÂÁË¡£ºÃÏûÏ¢ÊÇ£¬½«ËüÃÇ»ìºÏÆðÀ´Ê¹ÓÃÊµÊÇÍêÈ«Ã»ÎÊÌâµÄ¡£



µ±ÄãÉè¼Æ·â°ü¹ýÂËµÄÊ±ºò£¬¿ÉÒÔÍêÈ«²»ÓÃÀí»áÄúÒª×öÔõÑùµÄ NAT ¡£ì¶·â°ü¹ýÂËÖÐ¿´µ½µÄÀ´Ô´ÓëÄ¿µÄµØ£¬Ö»»áÊÇ `ÕæÕýµÄ' À´Ô´ºÍÄ¿µÄµØ¡£¾ÙÀýÀ´Ëµ£¬Èç¹ûÄú×ö NAT £¬Òª½«ËùÓÐÁ¬µ½ 1.2.3.4 port 80 µÄÁ¬ÏßËÍµ½ 10.1.1.1 port 8080 È¥£¬ÕâÑù·â°ü¹ýÂË»á¿´ÄÇÐ©ËÍµ½ 10.1.1.1 port 8080 (ÕæÕýµÄÄ¿µÄµØ)£¬¶ø²»ÊÇ 1.2.3.4 port 80¡£ÀàËÆµÄ£¬ÄúÒ²¿ÉÒÔºöÂÔ·â°üÎ±×°£º·â°ü»á¿´ÆðÀ´ÊÇÀ´×ÔÕæÕýµÄÄÚ²¿ IP µØÖ·(±È·½ 10.1.1.1)£¬»ØÓ¦Ò²¿´ÆðÀ´ËÍ»ØÄÇÀï¡£



Äú¿ÉÒÔÔËÓÃ `state' ±È¶ÔÑÓÉì(match extension)¶øÎÞÐèÈÃ·â°ü¹ýÂË×ö¶îÍâµÄ¹¤×÷£¬ÒòÎªÎÞÂÛÈçºÎ£¬ NAT ¶¼»áÒªÇóÁ¬Ïß×·×Ù¡£ÎªÁËÔöÇ¿ÔÚ NAT HOWTO ÀïÃæÄÇ¸ö¼òµ¥µÄ·â°üÎ±×°Àý×Ó£¬È¥µ²µôÀ´×Ô ppp0 ½çÃæµÄÈÎºÎÐÂÁ¬½Ó£¬Äú¿ÉÒÔÕâÑù×ö£º

\begin{tscreen}
\begin{verbatim}
# Masquerade out ppp0
iptables -t nat -A POSTROUTING -o ppp0 -j MASQUERADE

# Disallow NEW and INVALID incoming or forwarded packets from ppp0.
iptables -A INPUT -i ppp0 -m state --state NEW,INVALID -j DROP
iptables -A FORWARD -i ppp0 0 -m state --state NEW,INVALID -j DROP

# Turn on IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
\end{verbatim}
\end{tscreen}





\section{iptables Óë ipchains µÄ²îÒì\label{Appendix-A}}

\begin{itemize}
\item  Ê×ÏÈ£¬ÄÚ½¨Á´Ãû³Æ´ÓÐ¡Ð´»¹»»³É´óÐ´£¬ÒòÎª INPUT Óë OUTPUT Á´Ä¿Ç°Ö»»á×¥Ä¿±êÎª±¾»úÒÔ¼°´Ó±¾»ú²úÉúµÄ·â°ü¡£ËüÃÇ·Ö±ðÓÃÀ´²é¿´´«ÈëÓë´«³öµÄ·â°ü¡£
\item  ÏÖÔÚÓÐÒ»¸ö `-i' Æì±êÀ´´ú±í´«Èë½çÃæ£¬²¢ÇÒÖ»¹¤×÷ì¶ INPUT ºÍ FORWARD Á´ÖÐ¡£ÔÚ FORWARD Óë OUTPUT Á´ÖÐ¾ÍÒª½« `-i' ¸Ä³É `-o' ÁË¡£
\item  TCP Óë UDP ²º¿ÚÏÖÔÚ¶¼ÒªÓÃ --source-port »ò --sport Ñ¡ÏîÀ´Æ´Ð´³öÀ´(»òÊÇµô¹ýÀ´Ð´ --destination-port »ò --dport)£¬Í¬Ê±£¬±ØÐèÖÃì¶ `-p tcp' »ò `-p udp' Ñ¡ÏîÖ®áá£¬ÒòÎª TCP »ò UDP ÑÓÉìÊÇ·Ö¿ªÔØÈëµÄ¡£
\item  ÒÔÇ° TCP ÄÇ¸ö -y ÏÖÔÚ±ä³É --syn£¬²¢ÇÒ±ØÐèÖÃì¶ `-p tcp' Ö®áá¡£
\item  Ô­À´µÄ DENY Ä¿±êÏÖÔÚÖÕì¶±ä³É DROP ÁË¡£
\item  ÔÚÁÐÊ¾Æä¹¤×÷µÄÍ¬Ê±¿ÉÒÔ½«¸ÃÁ´¹éÁã(zeroing)¡£
\item  ¹éÁãÄÚ½¨Á´Ò²¿ÉÒÔÇåµôÔ­Ôò¼ÇÊýÆ÷(policy counters)¡£
\item  ÁÐÊ¾Á´¿ÉÒÔÈÃÄú°Ñ¼ÇÊýÆ÷±ä³ÉÎ¢Ð¡¿ìÕÕ(atomic snapshot)¡£
\item  REJECT Óë LOG ÏÖÔÚ±ä³ÉÑÓÉìÄ¿±êÁË£¬ÒâÎ¶ÖøËüÃÇÒÑ¾­ºÍºËÐÄÄ£×é·Ö¿ª¡£
\item  Á´Ãû³Æ×î³¤¿É´ï 31 ¸ö×ÖÄ¸¡£
\item  MASQ ÏÖÔÚ±ä³É MASQUERADE£¬ ¶øÇÒÊ¹ÓÃ²»Í¬µÄÓï·¨¡£REDIRECT ÔÚ±£ÁôÏàÍ¬Ãû³ÆµÄÍ¬Ê±£¬Ò²¾­ÀúÁËÓï·¨µÄ±äÇ¨¡£ÖÁì¶ÈçºÎÉè¶¨ËüÃÇµÄÏêÏ¸×ÊÁÏ£¬Çë²ÎÔÄ NAT-HOWTO¡£
\item  ¶ø -o Ñ¡ÏîÔò²»ÔÙÓÃÀ´½«·â°ü´«µÝ¸øÊ¹ÓÃÕß¿Õ¼äÉè±¸ÁË(²Î¿¼Ç°ÃæµÄ -i )¡£ÏÖÔÚÔòÓÃ QUEUE Ä¿±ê½«·â°üËÍ¸øÊ¹ÓÃÕß¿Õ¼ä¡£
\item  Å¶£¬ÎÒ¿ÉÄÜÒÑ¼Ç²»µÃÄÇ÷á¶àÁË¡£
\end{itemize}





\section{¹Øì¶Éè¼Æ·â°ü¹ýÂËµÄ½¨Òé}

ÔÚµçÄÔ°²È«Õ½³¡ÉÏ×îÃ÷ÖÇÖ®¾ÙÄª¹ýì¶ÏÈµ²µôÒ»ÇÐ£¬È»áá¿ª·Å±ØÐèµÄ¡£ÓÐÒ»¾äÖÁÀíÃûÑÔÊÇ£º`·ÇÇëÎð½ø'¡£ÎÒ½¨ÒéÄúÀÎ¼Çì¶ÐÄ£¬¼ÙÈçÄú×î×¢ÖØ°²È«µÄ»°¡£



²»ÒªÅÜÄÇÐ©ÄúÓÃ²»µ½µÄ·þÎñ£¬²»¹ÜÄúÊÇ·ñÒÔÎªÒÑ¾­½«Ö®µ²ÏÂÀ´ÁË¡£



Èç¹ûÄúÒª½¨Á¢Ò»¸öÖ¸¶¨Ê½·À»ðÇ½(dedicated firewall)£¬¿ªÊ¼²»ÒªÅÜÈÎºÎ¶«Î÷£¬Í¬Ê±µ²µôËùÓÐ·â°ü£¬È»ááÔö¼Ó·þÎñÒÔ¼°ÈÃËùÐèµÄ·â°üÍ¨¹ý¡£



ÎÒÌØ±ðÇ¿µ÷°²È«ÐÔ£º½áºÏ tcp-wrappers(¶Ôì¶·â°ü¹ýÂË±¾ÉíµÄÁ¬½Ó)¡¢·þÎñ´úÀí(¶Ôì¶Í¨¹ý·â°ü¹ýÂËµÄÁ¬½Ó)¡¢Â·ÓÉÑéÖ¤¡¢ÒÔ¼°·â°ü¹ýÂËµÈÊÖ¶Î¡£Â·ÓÉÑéÖ¤ÊÇÖ¸£¬ÄÇÐ©À´×ÔÎ´Ô¤ÆÚ½çÃæµÄ·â°ü¾Í»á±»¶ªÆú£º¾ÙÀýËµ£¬Èç¹ûÄúµÄÄÚ²¿ÍøÂ·ÓÐÒ»¶Î 10.1.1.0/24 µÄµØÖ·£¬Í¬Ê±ÓÐÒ»¸öÀ´×Ô¸ÃµØÖ·µÄ·â°üÈ´´ÓÍâ²¿½çÃæ½øÈë£¬ÄÇËü¾Í»á±»¶ªÆúµô¡£Ëü¿ÉÒÔÎªÒ»¸ö½çÃæ(Èç ppp0) ÉèÆðÀ´£¬Èç£º

\begin{tscreen}
\begin{verbatim}
# echo 1 > /proc/sys/net/ipv4/conf/ppp0/rp_filter
#
\end{verbatim}
\end{tscreen}


»òÊÇÈ«²¿ÏÖÓÐ¼°½«ÓÐµÄ½çÃæ£¬Èç£º

\begin{tscreen}
\begin{verbatim}
# for f in /proc/sys/net/ipv4/conf/*/rp_filter; do
#     echo 1 > $f
# done
# 
\end{verbatim}
\end{tscreen}


Debian ÔÚ¿ÉÄÜÖ®ÏÂÔ¤Éè¾Í»áÈç´ËÁË¡£Èç¹ûÄúÓÐ²»¶Ô³ÆÂ·ÓÉ(ÀýÈç£¬ÄúÔ¤ÆÚ·â°ü»á´ÓÆäËü·½Ïò½øÈë)£¬ÄúÓ¦¸ÃÔÚÄÇÐ©½çÃæÉÏ¹Ø±Õ´ËÒ»¹ýÂË¡£



Éè¶¨·À»ðÇ½µÄÊ±ºò£¬¼ÙÈçÓÐÄ³Ð©¶«Î÷²»¹¤×÷µÄ»°£¬¼ÇÂ¼¹¦ÄÜ¾ÍÏÔµÃºÜÓÐÓÃÁË£»µ«ÔÚÒ»¸öÊµ¼ÊÔË×÷µÄ·À»ðÇ½ÉÏ£¬ÈÎºÎÊ±ºò¶¼Òª½«Ëü½áºÏ `limit' ±È¶ÔÀ´Ò»ÆðÊ¹ÓÃ£¬ÒÔ±ÜÃâÓÐÈË¹à±¬ÄúµÄ¼ÇÂ¼µµ¡£

ÎÒÇ¿ÁÒ½¨Òé¶Ô°²È«ÏµÍ³×öÁ¬Ïß×·×Ù£ºËüËäÈ»»áÒýÖÂÒ»Ð©¸ºµ£(ÒòÎªËùÓÐÁ¬Ïß¶¼Òª×·×Ù)£¬µ«¶Ôì¶¹óÍøÂ·µÄÁ¬½Ó¿ØÖÆÈ´ºÜÓÐÓÃ¡£Èç¹ûÄúµÄºËÐÄ²»»á×Ô¶¯ÔØÈëÄ£×éµÄ»°£¬Äú»òÐíÐèÒªÔØÈë`ip\_conntrack.o' Ä£×é¡£¼ÙÈçÄúÒª¾«È·×·×Ù¸´ÔÓµÄÐ­¶¨£¬Äú»¹ÐèÒªÔØÈëºÏÊÊµÄ helper Ä£×é(Èç£¬`ip\_conntrack\_ftp.o' )¡£

\begin{tscreen}
\begin{verbatim}
# iptables -N no-conns-from-ppp0
# iptables -A no-conns-from-ppp0 -m state --state ESTABLISHED,RELATED -j ACCEPT
# iptables -A no-conns-from-ppp0 -m state --state NEW -i ! ppp0 -j ACCEPT
# iptables -A no-conns-from-ppp0 -i ppp0 -m limit -j LOG --log-prefix "Bad packet from ppp0:"
# iptables -A no-conns-from-ppp0 -i ! ppp0 -m limit -j LOG --log-prefix "Bad packet not from ppp0:"
# iptables -A no-conns-from-ppp0 -j DROP

# iptables -A INPUT -j no-conns-from-ppp0
# iptables -A FORWARD -j no-conns-from-ppp0
\end{verbatim}
\end{tscreen}




½¨ÖÃÒ»¸öÁ¼ºÃµÄ·À»ðÇ½ÒÑ¾­³¬³öÕâ¸ö HOWTO µÄ¡õÎ§ÁË£¬µ«ÎÒµÄ½¨ÒéÊÇ£º `Ò»ÇÐ´ÓÑÏ(always be minimalist)'¡£¶Ôì¶ÔÚÄú»úÆ÷ÉÏ½øÐÐ²âÊÔÓëÌ½Ë÷µÄ¸ü¶à×ÊÁÏ£¬¾ÍÒª²Î¿¼ Security HOWTO ÁË¡£



\end{document}
