linux - iptables 예제

iptables -I INPUT -p tcp -s 1.1.1.0/24 -j ACCEPT
1.1.1.x 대역을 사용하는 모든 아이피에 모든 tcp 포트를 연다

iptables -I INPUT -p tcp --dport 3306 -s 1.1.1.0/24 -j ACCEPT
1.1.1.x 대역을 사용하는 모든 아이피에 3306 tcp 포트를 연다

iptables -I INPUT -p tcp --dport 80 -j ACCEPT
모든 아이피 대역에 대하여 tcp 80포트를 연다

iptables -D INPUT -p tcp --dport 3306 -s 2.2.2.2 -j ACCEPT 
방화벽에서 해당 조건을 삭제
(추가와 같은 커맨드에 -D만 다름)

service iptables save
설정값 저장

service iptables restart
iptables 재시작

iptables 정책 테이블

vi /etc/sysconfig/iptables

iptables 정책 수정하기
vi /etc/sysconfig/iptables-config 

출처 - http://happykns.tistory.com/198                            

---

출처 : http://www.homepage.montana.edu/~unixuser/031705/iptables.fedora.html

# /etc/sysconifg/iptables
# /etc/init.d/iptables restart after edit
# Based on Martin's workstation iptables ruleset
# My IP: 172.16.1.100
#
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT DROP [0:0]
# Handle loopback addresses
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
# Allow outbound packets if state related, and inbound if established
-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A INPUT -m state --state ESTABLISHED -j ACCEPT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
# Drop if no flags set or all flags set
-A INPUT -p tcp -s 0/0 -d 172.16.1.100 --tcp-flags ALL NONE -j DROP
-A INPUT -p tcp -s 0/0 -d 172.16.1.100 --tcp-flags ALL ALL -j DROP
# Drop stealth scans
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,SYN,RST,PSH,ACK,URG NONE
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags SYN,FIN SYN,FIN
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags SYN,RST SYN,RST
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags FIN,RST FIN,RST
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags ACK,FIN FIN
-A INPUT -i eth0 -p tcp -m tcp --tcp-flags ACK,URG URG
# Allow port 25.  SMTP
-A INPUT -s 0/0 -p tcp -m tcp --dport 25 -j ACCEPT
# Allow & log SSH in from ben, jerry, and MSU 
-A INPUT -p tcp --syn --dport 22 -j LOG --log-prefix "SSH SYN "
-A INPUT -s 172.16.1.11 -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -s 172.16.1.12 -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -s 153.90.0.0/16 -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
# Allow VNC in from MSU
# -A INPUT -s 152.90.0.0/16 -m state --state NEW -m tcp -p tcp --dport 5901 -j ACCEPT
# Allow ICMP pings to the world, drop all others
-A OUTPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -s 0/0 -d 172.16.1.100 -j DROP
# Need to allow BackupServ1 in for Legato backups
 -A INPUT -s 172.16.1.27 -m state --state NEW -m tcp -p tcp --dport 514 -j ACCEPT
 -A INPUT -s 172.16.1.27 -m state --state NEW -m tcp -p tcp --dport 111 -j ACCEPT
 -A INPUT -s 172.16.1.27 -m state --state NEW -m tcp -p tcp --dport 7937 -j ACCEPT
 -A INPUT -s 172.16.1.27 -m state --state NEW -m tcp -p tcp --dport 7938 -j ACCEPT
# Allow X in from FileServ1 for handling user accounts
-A INPUT -s 172.16.1.104 -m state --state NEW -m tcp -p tcp --dport 6000 -j ACCEPT
# Allow access to my webserver from anywhere within MSU's domain. 
-A INPUT -s 153.90.0.0/16 -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
# Allow samba access for Ben
-A INPUT -s 172.16.1.11 -p tcp -m tcp --dport 137 --syn -j ACCEPT
-A INPUT -s 172.16.1.11 -p tcp -m tcp --dport 138 --syn -j ACCEPT
-A INPUT -s 172.16.1.11 -p tcp -m tcp --dport 139 --syn -j ACCEPT
-A INPUT -s 172.16.1.11 -p udp -m udp --dport 137 -j ACCEPT
-A INPUT -s 172.16.1.11 -p udp -m udp --dport 138 -j ACCEPT
-A INPUT -s 172.16.1.11 -p udp -m udp --dport 139 -j ACCEPT
# Allow samba nfs access for Jerry
# This assumes that mountd is running on port 33333 only.  
# (this can be forced by adding "MOUNTD_PORT=33333" just before first occurance of
# MOUNTD_PORT in /etc/init.d/nfs)
-A INPUT  -s 172.16.1.12 -p icmp -m icmp --icmp-type 3 -j ACCEPT
-A INPUT -s 172.16.1.12 -p tcp -m tcp --dport 111 -j ACCEPT
-A INPUT -s 172.16.1.12 -p udp -m udp --dport 111 -j ACCEPT
-A INPUT -p tcp -m tcp -s 172.16.1.12 --dport 2049 -j ACCEPT
-A INPUT -p udp -m udp -s 172.16.1.12 --dport 2049 -j ACCEPT
-A INPUT -s 172.16.1.12 -p tcp -m tcp --dport 33333 -j ACCEPT
-A INPUT -s 172.16.1.12 -p udp -m udp --dport 33333 -j ACCEPT
#
COMMIT







출처 : http://zenhat.org/2011/04/21/how-to-iptables-example/


This is an example script for iptables

#!/bin/sh
#
# IP addresses
SERVER_IP='<your_server_ip>'
DNS1_SERVER_IP='<primary_dns_server_ip>'
SMTP_SERVER_IP='<smtp_server_ip>'
BACKUP_SERVER_IP='<amanda_server_ip>'
MONITOR_SERVER_IP='<zenoss_server_ip>'

# Subnets
LAN_SUBNET='<your_lan_subnet>'

# Flushing all chains
iptables -F
iptables -X

# Setting default filter policy
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP


# Allow unlimited traffic on loopback
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT

# Allow incoming ssh
iptables -A INPUT -p tcp -s 0/0 -d ${SERVER_IP} –sport 513:65535 –dport 22 -m state –state NEW,ESTABLISHED -j ACCEPT
iptables -I INPUT -p tcp -s 0/0 -d ${SERVER_IP} –sport 513:65535 –dport 22 -m state –state NEW -m recent –set
iptables -I INPUT -p tcp -s 0/0 -d ${SERVER_IP} –sport 513:65535 –dport 22 -m state –state NEW -m recent –update –seconds 600 –hitcount 3 -j LOG –log-prefix ‘ERR: SSH hitcount exceed: ‘
iptables -I INPUT -p tcp -s 0/0 -d ${SERVER_IP} –sport 513:65535 –dport 22 -m state –state NEW -m recent –update –seconds 600 –hitcount 4 -j DROP
iptables -A OUTPUT -p tcp -s ${SERVER_IP} -d 0/0 –sport 22 –dport 513:65535 -m state –state ESTABLISHED -j ACCEPT

# Allow incoming http/https
iptables -A INPUT -p tcp -s 0/0 -d ${SERVER_IP} –sport 1024:65535 -m multiport –dports 80,443 -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow incoming svn
iptables -A INPUT -p tcp -s 0/0 -d ${SERVER_IP} –sport 1024:65535 –dport 3690 -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow incoming snmp from monitoring server
iptables -A INPUT -p udp -s ${MONITOR_SERVER_IP} -d ${SERVER_IP} –sport 1024:65535 –dport 161 -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow incoming mysql for monitoring(zenoss) and backups(mysql-zrm via socket)
iptables -A INPUT -p tcp -s ${MONITOR_SERVER_IP} -d ${SERVER_IP} –sport 1024:65535 -m multiport –dports 3306,25300 -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow outgoing dns lookups
iptables -A OUTPUT -p udp -s ${SERVER_IP} -d ${DNS1_SERVER_IP} –sport 1024:65535 –dport 53 -j ACCEPT

 # Allow outgoing ntp syncs(only privilege port)
iptables -A OUTPUT -p udp -s ${SERVER_IP} -d 0/0 –sport 123 –dport 123 -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow incoming/outgoing icmp within the subnet
iptables -A OUTPUT -p icmp -s ${SERVER_IP} -d ${LAN_SUBNET} -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p icmp -s ${LAN_SUBNET} -d ${SERVER_IP} -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT

# Allow amanda – amdump, amcheck
iptables -A INPUT -p tcp -s ${BACKUP_SERVER_IP} -d ${SERVER_IP} –dport 10080 -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow amanda – amrecover
iptables -A OUTPUT -p tcp -s ${SERVER_IP} -d ${BACKUP_SERVER_IP} –dport 10080 -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow outgoing ssh within the subnet
iptables -A OUTPUT -p tcp -s ${SERVER_IP} -d ${LAN_SUBNET} –sport 513:65535 –dport 22 -m state –state NEW -j ACCEPT

# Allow outgoing http/s (for yum)
iptables -A OUTPUT -p tcp -s ${SERVER_IP} -d 0/0 –sport 1024:65535 -m multiport –dports 80,443 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing ftp (for yum)
iptables -A OUTPUT -p tcp -s ${SERVER_IP} -d 0/0 –sport 1024:65535 –dport 21 -m state –state NEW,ESTABLISHED,RELATED -j ACCEPT

# Allow outgoing smtp
iptables -A OUTPUT -p tcp -s ${SERVER_IP} -d ${SMTP_SERVER_IP} –sport 1024:65535 –dport 25 -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow outgoing svn
iptables -A OUTPUT -p tcp -s ${SERVER_IP} -d 0/0 –sport 1024:65535 –dport 3690 -m state –state NEW,ESTABLISHED -j ACCEPT

# Allow all previously established incoming/outgoing connections
iptables -A INPUT -s 0/0 -d ${SERVER_IP} -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -s ${SERVER_IP} -d 0/0 -m state –state ESTABLISHED,RELATED -j ACCEPT

# Make sure nothing comes or goes out
iptables -A INPUT -j LOG –log-level 4 –log-prefix ‘ERR: INPUT drop: ‘
iptables -A INPUT -j DROP
iptables -A OUTPUT -j LOG –log-level 4 –log-prefix ‘ERR: OUTPUT drop: ‘
iptables -A OUTPUT -j DROP

# Save
/sbin/service iptables save

# List rules
iptables -L -v







출처 : http://www.vmadmin.co.uk/linux/44-redhat/159-linuxiptables


###########
## IPTABLES FIREWALL CONFIGURATION
###########

*filter

##ALLOW loopback interface
-A INPUT -i lo -j ACCEPT

##ALLOW connections that originate from this server
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT

##Block
-A INPUT -s 61.225.15.0/24 -j DROP
-A INPUT -s 118.167.0.0/16 -j DROP
-A INPUT -s 114.45.0.0/16 -j DROP
-A INPUT -s 121.96.0.0/18 -j DROP

##Restrictions
#-A INPUT -p icmp -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name ICMP -j LOG  --log-prefix "**IPTABLES**ICMP DENY**"
#-A INPUT -p icmp -m state --state NEW -m recent --update --seconds 60 --hitcount 10 --name ICMP -j DROP
#-A INPUT -p icmp -m state --state NEW -m recent --set --name ICMP -j ACCEPT

#-A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 2 --name SSH -j LOG --log-prefix "**IPTABLES**SSH DENY**"
#-A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 2 --name SSH -j DROP
#-A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH -j ACCEPT

##ALLOW ONLY 192.168.0.0 network to the following ports
-A INPUT -s 192.168.0.0/255.255.0.0 -p tcp --dport 22 -j ACCEPT

##ALLOW ANY to the following ports
#-A INPUT -p tcp --dport 22 -j ACCEPT
-A INPUT -p tcp --dport 25 -j ACCEPT
-A INPUT -p tcp --dport 80 -j ACCEPT
-A INPUT -p tcp --dport 443 -j ACCEPT

##ALLOW specific to the following ports
#-A INPUT -s 192.168.5.1 -p tcp --dport 995 -j ACCEPT
-A INPUT -s 192.168.5.1 -p tcp --dport 993 -j ACCEPT
-A INPUT -s 192.168.5.1 -p tcp --dport 3306 -j ACCEPT

##ALLOW icmp
#-A INPUT -p icmp --icmp-type any -j ACCEPT
#-A INPUT -p icmp --icmp-type echo-request -m limit --limit 20/s --limit-burst 5 -j ACCEPT
-A INPUT -p icmp -m icmp --icmp-type echo-request -j ACCEPT

##LOGGING
#-A INPUT -j LOG --log-tcp-options --log-ip-options

##DEFAULT set DROP as default rule for each chain
-P INPUT DROP
-P FORWARD DROP
-P OUTPUT DROP

COMMIT








출처 : http://controlpanelblog.com/?p=317&upm_export=pdf

Common iptables command, cheatsheet

#!/bin/sh
# File: /etc/rc.d/rc.firewall
# Immediately log and drop any known abusive IPs
iptables -A INPUT -p tcp -s 87.118.104.44 -m limit --limit 1/minute  --limit-burst 10  -j LOG --log-prefix "[DROPPED_NODE]" --log-level 4
iptables -A INPUT -p tcp -s 87.118.104.44 -j DROP

# Allow from any to any on 127.0.0.1/32
iptables -A INPUT -s 127.0.0.1/32 -j ACCEPT
iptables -A OUTPUT -s 127.0.0.1/32 -j ACCEPT

# Track connection state
iptables -A INPUT -p tcp -m state --state ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED -j ACCEPT

# Allow all foreign IPs to access ports 443 and 80
iptables -A INPUT -p TCP --dport 443 -j ACCEPT
iptables -A INPUT -p TCP --dport 80 -j ACCEPT

# Allow access from a specified foreign IP
# to this server's port 8080
iptables -A INPUT -p TCP -s 172.16.88.2/32 --dport 8080 -j ACCEPT

# Allow access from a specified foreign IP
# to any port listening on this server
iptables -A INPUT -p TCP -s 172.13.88.3/32  -j ACCEPT

# Drop incoming UDP packets on port 137 and 138 without logging
iptables -A INPUT -p UDP --dport 137 -j DROP
iptables -A INPUT -p UDP --dport 138 -j DROP

# Accept all other incoming UDP packets
iptables -A INPUT -p UDP -j ACCEPT

# Log and Drop everything else
iptables -A INPUT -j LOG  -m limit --limit 1/minute   --limit-burst 10 --log-prefix "[DROPPED_NODE]" --log-level 4
iptables -A INPUT -j DROP

# View all rules
iptables -L -v

# View INPUT rules
iptables -L INPUT -nv

# View max tracked connections
cat /proc/sys/net/ipv4/netfilter/ip_conntrack_max

# Set max tracked connections
# add the following line to rc.local if sysctl.conf doesn't exist
echo 128000 >  /proc/sys/net/ipv4/netfilter/ip_conntrack_max

# View Current HASHSIZE
cat /proc/sys/net/ipv4/netfilter/ip_conntrack_buckets








출처 : http://networking.ringofsaturn.com/Unix/iptables.php



IPTables Example Config

#flush tables
/usr/sbin/iptables -F

# DUMP
/usr/sbin/iptables -N DUMP > /dev/null
/usr/sbin/iptables -F DUMP
/usr/sbin/iptables -A DUMP -p tcp -j LOG
/usr/sbin/iptables -A DUMP -p udp -j LOG
/usr/sbin/iptables -A DUMP -p tcp -j REJECT --reject-with tcp-reset
/usr/sbin/iptables -A DUMP -p udp -j REJECT --reject-with icmp-port-unreachable
/usr/sbin/iptables -A DUMP -j DROP

# Stateful table
/sbin/iptables -N STATEFUL > /dev/null
/sbin/iptables -F STATEFUL
/sbin/iptables -I STATEFUL -m state --state ESTABLISHED,RELATED -j ACCEPT
/sbin/iptables -A STATEFUL -m state --state NEW -i ! eth0 -j ACCEPT
/sbin/iptables -A STATEFUL -j DUMP

# loopback rules
/sbin/iptables -A INPUT -i lo -j ACCEPT
/sbin/iptables -A OUTPUT -o lo -j ACCEPT

# drop reserved addresses incoming (these are reserved addresses
# but may change soon
/sbin/iptables -A INPUT -i eth0 -s 0.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 1.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 2.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 5.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 7.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 10.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 23.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 27.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 31.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 36.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 39.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 41.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 42.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 58.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 59.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 60.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 127.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 169.254.0.0/16 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 172.16.0.0/12 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 192.168.0.0/16 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 197.0.0.0/8 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 224.0.0.0/3 -j DUMP
/sbin/iptables -A INPUT -i eth0 -s 240.0.0.0/8 -j DUMP

#set iptables to allow everything from my work network
/usr/sbin/iptables -A INPUT -i eth1 -p all -s 160.86.0.0/16 -j ACCEPT
/usr/sbin/iptables -A INPUT -i eth1 -p all -j DROP

# allow certain inbound ICMP types (ping, traceroute..)
/sbin/iptables -A INPUT -i eth0 -p icmp --icmp-type destination-unreachable -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p icmp --icmp-type time-exceeded -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p icmp --icmp-type echo-reply -j ACCEPT
/sbin/iptables -A INPUT -i eth0 -p icmp --icmp-type echo-request -j ACCEPT

# Drop all packets to port 111 except those from localhost
/usr/sbin/iptables -A INPUT -s !127.0.0.0/8 -p tcp --dport 111 -j DROP

# kill off identd quick 
/sbin/iptables -A INPUT -p tcp -i eth0 --dport 113 -j REJECT --reject-with tcp-reset

# sfs
/sbin/iptables -A INPUT -p tcp -i eth0 --dport 4  -j ACCEPT
# ftp
/sbin/iptables -A INPUT -p tcp -i eth0 --dport 21 -j ACCEPT
/sbin/iptables -A INPUT -p udp -i eth0 --dport 21 -j ACCEPT
# ssh
/sbin/iptables -A INPUT -p tcp -i eth0 --dport 22 -j ACCEPT
/sbin/iptables -A INPUT -p udp -i eth0 --dport 22 -j ACCEPT
# www
/sbin/iptables -A INPUT -p tcp -i eth0 --dport 80 -j ACCEPT
/sbin/iptables -A INPUT -p udp -i eth0 --dport 80 -j ACCEPT
# https
/sbin/iptables -A INPUT -p tcp -i eth0 --dport 443 -j ACCEPT
/sbin/iptables -A INPUT -p udp -i eth0 --dport 443 -j ACCEPT

# Don't log route packets coming from routers - too much logging
/sbin/iptables -A INPUT -p udp -i eth0 --dport 520 -j REJECT

# Don't log smb/windows sharing packets - too much logging
/sbin/iptables -A INPUT -p tcp -i eth0 --dport 137:139 -j REJECT
/sbin/iptables -A INPUT -p udp -i eth0 --dport 137:139 -j REJECT





----------------------------------------
////////////////////////////////////////
----------------------------------------



Iptables Cheatsheet
http://www.guyrutenberg.com/2009/02/26/iptables-cheatsheet/


Blocking specific IPs
iptables -I INPUT -s "207.58.140.12" -j DROP

Blocking a range of IPs (IP block)
iptables -I INPUT -s "207.58.140.0/24" -j DROP

Deleting rules
iptables -D INPUT -s "207.58.140.12" -j DROP



CentOS / Redhat Iptables Firewall Configuration Tutorial
http://www.cyberciti.biz/faq/rhel-fedorta-linux-iptables-firewall-configuration-tutorial/


Iptables Config File
/etc/sysconfig/iptables


Display Default Rules
iptables --line-numbers -n -L


Turn On Firewall
chkconfig iptables on
service iptables start



IPTables
http://www.centos.org/docs/5/html/Deployment_Guide-en-US/ch-iptables.html



IPTables를 이용한 VPN 관리자 그룹별 접근 제어
http://croshine.blog.me/50099294534


IPTables
http://wiki.centos.org/HowTos/Network/IPTables



Example iptables firewall
http://www.brandonhutchinson.com/iptables_fw.html



25 Most Frequently Used Linux IPTables Rules Examples
http://www.thegeekstuff.com/2011/06/iptables-rules-examples/




 

 

 

 

2013.2.7 추가함

 

 

iptables 중앙관리 오픈소스

 

예전에 참깐 찾아본바로는 2개정도가 있습니다.

물론 puppet같은 것과 연동하는 방안도 있겠지만, 우리 회사는 경우수가 많을테니...

 

 

1. Firelet, 파이썬 기반

http://www.firelet.net/

아직 정식 릴리즈는 없고 https://github.com/FedericoCeratto/firelet 에서 배포됩니다.

 

 

2. Firewall Builder, GUI제공, GPL 라이센스

http://www.fwbuilder.org/

 

메뉴얼에 보면 정책 배포기능이 있습니다.

14.6.1. Using clusters to manage firewall policies on multiple servers

http://www.fwbuilder.org/4.0/docs/users_guide5/tricks.html#cluster_server_fw_synch

[출처] iptables 예제 모음|작성자 쭌

출처 - http://blog.naver.com/PostView.nhn?blogId=junix&logNo=80132536243&redirect=Dlog&widgetTypeCall=true