ubuntu iptables白名单模式

实验目的： 配置服务只能访问给定的网址，如：http://192.168.2.3:8000

安装

root@86f2a079f5ec:/# apt-get update
root@86f2a079f5ec:/# apt-get install iptables

策略配置

查看默认配置

root@86f2a079f5ec:/# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

关闭Chain OUTPUT的默认策略

由默认的ACCEPT变为DROP，Chain OUTPUT (policy ACCEPT)–>Chain OUTPUT (policy DROP)

root@86f2a079f5ec:/# iptables -P OUTPUT DROP
root@86f2a079f5ec:/# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination

添加白名单

root@86f2a079f5ec:/# iptables -A OUTPUT -p tcp -d 192.168.2.3 --dport 8000 -j ACCEPT
root@86f2a079f5ec:/# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             10.0.7.22            tcp dpt:8000
root@86f2a079f5ec:/# curl http://10.0.7.22:8000
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<title>Directory listing for /</title>
</head>
<body>
<h1>Directory listing for /</h1>
<hr>
<ul>
<li><a href="%24Recycle.Bin/">$Recycle.Bin/</a></li>
<li><a href="%24WinREAgent/">$WinREAgent/</a></li>
<li><a href="Documents%20and%20Settings/">Documents and Settings/</a></li>
<li><a href="DumpStack.log.tmp">DumpStack.log.tmp</a></li>
<li><a href="hiberfil.sys">hiberfil.sys</a></li>
<li><a href="Intel/">Intel/</a></li>
<li><a href="pagefile.sys">pagefile.sys</a></li>
<li><a href="PerfLogs/">PerfLogs/</a></li>
<li><a href="Program%20Files/">Program Files/</a></li>
<li><a href="Program%20Files%20%28x86%29/">Program Files (x86)/</a></li>
<li><a href="ProgramData/">ProgramData/</a></li>
<li><a href="Python27/">Python27/</a></li>
<li><a href="Recovery/">Recovery/</a></li>
<li><a href="swapfile.sys">swapfile.sys</a></li>
<li><a href="System%20Volume%20Information/">System Volume Information/</a></li>
<li><a href="Users/">Users/</a></li>
<li><a href="Windows/">Windows/</a></li>
</ul>
<hr>
</body>
</html>
版权声明：本文为this_is_id原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接和本声明。