iptable限制多个端口出站

iptable限制多个端口出站

安装包

root@iptable:/home/bb# apt-get update
root@iptable:/home/bb# apt-get -y install iptables  iptables-restore

web准备

root@web:/home/bb/test-iptables# docker run -itd --name web -p 80:80 -v ./web1/index.html:/usr/share/nginx/html/index.html nginx
root@web:/home/bb/test-iptables# docker run -itd --name web2 -p 443:80 -v ./web1/index.html:/usr/share/nginx/html/index.html nginx
root@web:/home/bb/test-iptables# curl localhost
web1
root@web:/home/bb# curl 10.1.0.128:443
web1

测试访问

root@iptable:/home/bb# curl 10.1.0.128
web1
root@iptable:/home/bb# curl 10.1.0.128:443
web1

备份已有的规则

root@iptable:/home/bb# iptables-save >rule_bak.txt
root@iptable:/home/bb# iptables-restore <rule_bak.txt

添加规则

## 重启会失效
root@iptable:/home/bb# iptables -A OUTPUT -p tcp -d 10.1.0.128 --dport 80  -j DROP

root@iptable:/home/bb# iptables -nL
...
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
DROP       tcp  --  0.0.0.0/0            10.1.0.128           tcp dpt:80
...

## 保存规则到本地
[root@master ~]# iptables-save >rule.txt
root@iptable:/home/bb# cat rule.txt
...
-A OUTPUT -d 10.1.0.128/32 -p tcp -m tcp --dport 80 -j DROP
...

验证规则生效

root@iptable:/home/bb# curl 10.1.0.128
^C
root@iptable:/home/bb# curl 10.1.0.128:443
web1

删除规则

root@iptable:/home/bb# iptables -D OUTPUT 1
root@iptable:/home/bb# iptables -nL
...
Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination
无规则

root@iptable:/home/bb# curl 10.1.0.128
web1

同时限制多个端口

root@iptable:/home/bb# iptables -A OUTPUT -p tcp -d 10.1.0.128 -m multiport --dports 80,443  -j DROP
root@iptable:/home/bb# curl 10.1.0.128
^C
root@iptable:/home/bb# curl 10.1.0.128:443
^C

永久保存问题

root@node3:/home/bb# apt-get install iptables-persistent
root@node3:/home/bb# netfilter-persistent save   # 永久保存
root@node3:/home/bb# reboot
root@node3:/home/bb# iptables -nL
...
DROP       tcp  --  0.0.0.0/0            10.1.0.128           multiport dports 80,443



root@iptable:/home/bb# iptables-save >rule.txt
root@iptable:/home/bb# cat rule.txt
# Generated by iptables-save v1.8.7 on 
*nat
:PREROUTING ACCEPT [2:156]
:INPUT ACCEPT [2:156]
:OUTPUT ACCEPT [15:1483]
:POSTROUTING ACCEPT [10:1183]
:DOCKER - [0:0]
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A DOCKER -i docker0 -j RETURN
COMMIT
# Completed on Sun Jan  5 10:57:48 2025
# Generated by iptables-save v1.8.7 on 
*filter
:INPUT ACCEPT [455:22312]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [773:78472]
:DOCKER - [0:0]
:DOCKER-ISOLATION-STAGE-1 - [0:0]
:DOCKER-ISOLATION-STAGE-2 - [0:0]
:DOCKER-USER - [0:0]
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A OUTPUT -d 10.1.0.128/32 -p tcp -m multiport --dports 80,443 -j DROP
-A DOCKER-ISOLATION-STAGE-1 -i docker0 ! -o docker0 -j DOCKER-ISOLATION-STAGE-2
-A DOCKER-ISOLATION-STAGE-1 -j RETURN
-A DOCKER-ISOLATION-STAGE-2 -o docker0 -j DROP
-A DOCKER-ISOLATION-STAGE-2 -j RETURN
-A DOCKER-USER -j RETURN
COMMIT
# Completed on