Linux 上 iptables ipset 白名单

ipset

字数统计: 493阅读时长: 2 min

 2017/08/03 

关于

Linux 上 ipset 和 iptables 配合做 ip 白名单

安装

# rpm 系列 os
yum install ipset ipset-service -y
sed -ri '/^IPSET_SAVE_ON_STOP=/s#no#yes#' /etc/sysconfig/ipset-config
systemctl enable --now ipset


# apt 系列 os
apt update && apt install -y ipset-persistent iptables-persistent

配置

1
2
3

# 黑白名单
ipset create blackiplist hash:net maxelem 1000000 
ipset create whiteiplist hash:net maxelem 1000000

rpm 系统

注意下面链的默认规则和接口，自行更改成实际情况

cp /etc/sysconfig/iptables /etc/sysconfig/iptables.change.bak

cat > /etc/sysconfig/iptables << 'EOF'
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:BASE-RULE - [0:0]
-A INPUT -p icmp -j ACCEPT
# 防止本机访问外部的回包被 drop 掉
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp --dport 2222 -j ACCEPT
-A INPUT -j BASE-RULE
-A BASE-RULE -i ens160 -m set ! --match-set whiteiplist src  -j DROP
-A BASE-RULE -j RETURN
COMMIT
EOF

apt 系统

工作原理

apt 系统的规则都是存在 /etc/iptables/

$ ls -l /etc/iptables/
总用量 12
-rw-r----- 1 root root  236  8月 28 14:48 ipsets
-rw-r----- 1 root root 1760  8月 28 14:48 rules.v4
-rw-r----- 1 root root  378  8月 28 14:48 rules.v6

如果手动持久化，执行(有 docker 之类的机器上不推荐执行，直接写下一章节文件即可)

$ netfilter-persistent save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/10-ipset save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-ip4tables save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/25-ip6tables save
run-parts: executing /usr/share/netfilter-persistent/plugins.d/40-ipset save

添加白名单规则：

注意下面链的默认规则和接口，自行更改成实际情况

cat > /etc/iptables/rules.v4 << 'EOF'
*filter
:INPUT ACCEPT [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
:BASE-RULE - [0:0]
-A INPUT -p icmp -j ACCEPT
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -j BASE-RULE
-A BASE-RULE -i vmbr0 -m set ! --match-set whiteiplist src -j DROP
-A BASE-RULE -j RETURN
COMMIT
EOF

测试

# rpm
systemctl enable iptables
# apt
systemctl enable netfilter-persistent.service

# 测试添加
ipset add whiteiplist xxx

reboot

原文作者：Zhangguanzhang

原文链接：http://zhangguanzhang.github.io/2017/08/03/iptables-whitelist/

发表日期：August 3rd 2017, 6:29:08 pm

更新日期：August 3rd 2017, 6:29:08 pm

Next Post

docker容器网络互联
Previous Post

centos桥接测试

CATALOG

1. 关于
2. 安装
3. 配置
1. 3.1. rpm 系统
2. 3.2. apt 系统
  1. 3.2.1. 工作原理
  2. 3.2.2. 添加白名单规则：
4. 测试