{"id":1719,"date":"2011-10-03T15:40:11","date_gmt":"2011-10-03T12:40:11","guid":{"rendered":"http:\/\/skeletor.org.ua\/?p=1719"},"modified":"2015-05-15T10:12:43","modified_gmt":"2015-05-15T07:12:43","slug":"iptables-%d0%b8-%d0%b4%d0%b8%d0%bd%d0%b0%d0%bc%d0%b8%d1%87%d0%b5%d1%81%d0%ba%d0%b8%d0%b5-%d0%bf%d1%80%d0%b0%d0%b2%d0%b8%d0%bb%d0%b0","status":"publish","type":"post","link":"https:\/\/skeletor.org.ua\/?p=1719","title":{"rendered":"iptables \u0438 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 (keep state)"},"content":{"rendered":"

\u0422\u0430\u043a\u043e\u0433\u043e \u043f\u043e\u043d\u044f\u0442\u0438\u044f \u043a\u0430\u043a \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0432 iptables<\/strong> \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043d\u0430\u0437\u044b\u0432\u0430\u0442\u044c – \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f keep state<\/strong>.<\/p>\n

\u0412 Iptables<\/strong> \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0442 \u0442\u0430\u043a\u0438\u0435 \u0442\u0438\u043f\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f (\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e, \u0435\u0441\u043b\u0438 \u043c\u043e\u0434\u0443\u043b\u044c ‘state<\/strong>‘ \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ‘-m state<\/strong>‘):<\/p>\n

NEW<\/span><\/strong> – \u0412\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u043d\u043e\u0432\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 (\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f)<\/p>\n

ESTABLISHED<\/span><\/strong> – \u0412\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044e (\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, GET<\/strong> \u043e\u0442\u0432\u0435\u0442 web<\/strong>-\u0441\u0435\u0440\u0432\u0435\u0440\u0430)<\/p>\n

RELATED<\/span><\/strong> – \u041f\u0430\u043a\u0435\u0442\u044b, \u043d\u0435 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044e (\u0442\u043e \u0435\u0441\u0442\u044c \u0442\u0435 \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u0447\u0430\u0441\u0442\u044c\u044e \u043d\u043e\u0432\u044b\u0445 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0431\u044b\u043b\u043e \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c ESTABLISHED<\/strong> \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435\u043c), \u043d\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0435 \u0441 \u043d\u0438\u043c. (\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 – FTP<\/strong> \u0432 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u043c \u0440\u0435\u0436\u0438\u043c\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442 \u0440\u0430\u0437\u043d\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u043f\u0435\u0440\u0435\u0434\u0430\u0447\u0438 \u0434\u0430\u043d\u043d\u044b\u0445. \u042d\u0442\u0438 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b.)<\/p>\n

INVALID<\/span><\/strong>\u00a0– \u041f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u043f\u043e \u0442\u0435\u043c \u0438\u043b\u0438 \u0438\u043d\u044b\u043c \u043f\u0440\u0438\u0447\u0438\u043d\u0430\u043c \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440 ICMP<\/strong> \u043e\u0448\u0438\u0431\u043a\u0438 \u043d\u0435 \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0438\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u043c \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f\u043c<\/p>\n

\u0422\u0435\u043f\u0435\u0440\u044c \u043f\u0435\u0440\u0435\u0439\u0434\u0451\u043c \u043a \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044e \u043f\u0440\u0430\u0432\u0438\u043b. \u041f\u0435\u0440\u0432\u044b\u043c \u0434\u0435\u043b\u043e\u043c \u0438\u0437\u043c\u0435\u043d\u0438\u043c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e:<\/p>\n

iptables -P INPUT DROP
\niptables -P OUTPUT DROP<\/code><\/p>\n

\u041d\u0443\u0436\u043d\u043e \u0435\u0449\u0451 \u043d\u0435 \u0437\u0430\u0431\u044b\u0442\u044c \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043f\u043e \u043f\u0435\u0442\u043b\u0435\u0432\u043e\u043c\u0443 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 (\u0447\u0442\u043e \u0431\u044b \u0441\u0435\u0440\u0432\u0435\u0440 \u0441\u0430\u0441 \u0441 \u0441\u043e\u0431\u043e\u0439 \u043c\u043e\u0433 \u043e\u0431\u0449\u0430\u0442\u044c\u0441\u044f \u043f\u043e \u0430\u0434\u0440\u0435\u0441\u0443 127.0.0.1<\/strong>):<\/p>\n

iptables -A INPUT -i lo -j ACCEPT
\niptables -A OUTPUT -o lo -j ACCEPT<\/code><\/p>\n

\u0418 \u043d\u0430\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u043a – \u043f\u0440\u0430\u0432\u0438\u043b \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435:<\/p>\n

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
\niptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
\n<\/code><\/p>\n

\u042d\u0442\u0438\u043c \u043c\u044b \u0441\u043e\u0437\u0434\u0430\u043b\u0438 \u043f\u043e\u043b\u043d\u043e\u0441\u0442\u044c\u044e \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0439 \u0444\u0430\u0439\u0435\u0440\u0432\u043e\u043b. \u0422\u0435\u043f\u0435\u0440\u044c \u043e\u0441\u0442\u0430\u043b\u043e\u0441\u044c \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0442\u044c \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430. \u0412\u043e\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u0438\u043c\u0435\u0440\u043e\u0432:<\/p>\n

– \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u043c \u0442\u043e\u043b\u044c\u043a\u043e \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u043f\u0438\u043d\u0433\u0438<\/span><\/em><\/p>\n

iptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
\niptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT<\/code><\/p>\n

– \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u043c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u043f\u043e ssh:<\/span><\/em><\/p>\n

iptables -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT<\/code><\/p>\n

\u0410 \u0432\u043e\u0442 \u043f\u043e\u043b\u043d\u044b\u0439 \u043b\u0438\u0441\u0442\u0438\u043d\u0433 \u043d\u0430\u0448\u0435\u0433\u043e \u0444\u0430\u0439\u0435\u0440\u0432\u043e\u043b\u0430:<\/p>\n

iptables -F
\niptables -P INPUT DROP
\niptables -P OUTPUT DROP
\niptables -A INPUT -i lo -j ACCEPT
\niptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
\niptables -A INPUT -p icmp --icmp-type echo-reply -j ACCEPT
\niptables -A INPUT -p tcp -m state --state NEW --dport 22 -j ACCEPT
\niptables -A OUTPUT -o lo -j ACCEPT
\niptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
\niptables -A OUTPUT -p icmp --icmp-type echo-request -j ACCEPT<\/code><\/p>\n

\u041b\u043e\u0436\u043a\u0430 \u0434\u0451\u0433\u0442\u044f.<\/span><\/strong><\/em><\/p>\n

\u0414\u0435\u043b\u043e \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043f\u0440\u0438 \u0442\u0430\u043a\u0438\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 \u0444\u0430\u0439\u0435\u0440\u0432\u043e\u043b \u043d\u0435 \u0440\u0430\u0437\u044a\u0435\u0434\u0438\u043d\u044f\u0435\u0442 ESTABLISHED<\/strong> \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. \u0415\u0441\u043b\u0438 \u0432\u044b \u0445\u043e\u0442\u0438\u0442\u0435 \u043f\u0440\u0438\u043d\u0443\u0434\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u044d\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c – \u043b\u0443\u0447\u0448\u0438\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442:<\/p>\n

iptables -I INPUT 1 -s 10.10.10.10 -m state --state ESTABLISHED,RELATED -j DROP<\/code><\/p>\n

\u0433\u0434\u0435\u00a010.10.10.10<\/strong> – \u0430\u0434\u0440\u0435\u0441, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u043b \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435.<\/p>\n

\u041f\u0440\u0438\u043c\u0435\u0447\u0430\u043d\u0438\u0435.<\/span><\/strong><\/em><\/p>\n

\u0415\u0441\u043b\u0438 \u0432\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 FORWARD<\/strong>, \u0442\u043e \u0434\u043b\u044f \u043d\u0435\u0451 \u0431\u0443\u0434\u0443\u0442 \u043d\u0443\u0436\u043d\u044b \u0442\u0430\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430:<\/p>\n

iptables -P FORWARD DROP
\niptables -A FORWARD -i $INET_IFACE -m state --state ESTABLISHED,RELATED -j ACCEPT
\niptables -A FORWARD -i $LAN_IFACE -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
\n<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"

\u0422\u0430\u043a\u043e\u0433\u043e \u043f\u043e\u043d\u044f\u0442\u0438\u044f \u043a\u0430\u043a \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0432 iptables \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442. \u041f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u043d\u0430\u0437\u044b\u0432\u0430\u0442\u044c – \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u0435 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f keep state. \u0412 Iptables \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u044e\u0442 \u0442\u0430\u043a\u0438\u0435 \u0442\u0438\u043f\u0430 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044f (\u0434\u043e\u0441\u0442\u0443\u043f\u043d\u043e, \u0435\u0441\u043b\u0438 \u043c\u043e\u0434\u0443\u043b\u044c ‘state‘ \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e ‘-m state‘): NEW – \u0412\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u043d\u043e\u0432\u043e\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0435 (\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u043f\u0440\u043e\u0441 \u043d\u0430 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f) ESTABLISHED – \u0412\u0441\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u043f\u0440\u0438\u043d\u0430\u0434\u043b\u0435\u0436\u0430\u0449\u0438\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044e (\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, GET \u043e\u0442\u0432\u0435\u0442 web-\u0441\u0435\u0440\u0432\u0435\u0440\u0430)<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-1719","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/1719","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1719"}],"version-history":[{"count":20,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/1719\/revisions"}],"predecessor-version":[{"id":4811,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=\/wp\/v2\/posts\/1719\/revisions\/4811"}],"wp:attachment":[{"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1719"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1719"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/skeletor.org.ua\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1719"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}