firewall
installsforks
How to install firewall?
chaterm/terminal-skills/firewall
$npx -y skills add chaterm/terminal-skills --skill firewall防火墙配置
SKILL.md
| 1 | # 防火墙配置 |
| 2 | |
| 3 | ## 概述 |
| 4 | iptables、firewalld、nftables、ufw 防火墙配置技能。 |
| 5 | |
| 6 | ## iptables |
| 7 | |
| 8 | ### 基础命令 |
| 9 | ```bash |
| 10 | # 查看规则 |
| 11 | iptables -L -n -v |
| 12 | iptables -L -n --line-numbers |
| 13 | iptables -t nat -L -n -v |
| 14 | |
| 15 | # 清空规则 |
| 16 | iptables -F |
| 17 | iptables -X |
| 18 | iptables -t nat -F |
| 19 | |
| 20 | # 默认策略 |
| 21 | iptables -P INPUT DROP |
| 22 | iptables -P FORWARD DROP |
| 23 | iptables -P OUTPUT ACCEPT |
| 24 | ``` |
| 25 | |
| 26 | ### 常用规则 |
| 27 | ```bash |
| 28 | # 允许回环 |
| 29 | iptables -A INPUT -i lo -j ACCEPT |
| 30 | |
| 31 | # 允许已建立连接 |
| 32 | iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| 33 | |
| 34 | # 允许 SSH |
| 35 | iptables -A INPUT -p tcp --dport 22 -j ACCEPT |
| 36 | |
| 37 | # 允许 HTTP/HTTPS |
| 38 | iptables -A INPUT -p tcp --dport 80 -j ACCEPT |
| 39 | iptables -A INPUT -p tcp --dport 443 -j ACCEPT |
| 40 | |
| 41 | # 允许特定 IP |
| 42 | iptables -A INPUT -s 192.168.1.100 -j ACCEPT |
| 43 | |
| 44 | # 允许网段 |
| 45 | iptables -A INPUT -s 192.168.1.0/24 -p tcp --dport 3306 -j ACCEPT |
| 46 | |
| 47 | # 拒绝其他 |
| 48 | iptables -A INPUT -j DROP |
| 49 | ``` |
| 50 | |
| 51 | ### 删除规则 |
| 52 | ```bash |
| 53 | # 按行号删除 |
| 54 | iptables -D INPUT 3 |
| 55 | |
| 56 | # 按规则删除 |
| 57 | iptables -D INPUT -p tcp --dport 80 -j ACCEPT |
| 58 | ``` |
| 59 | |
| 60 | ### NAT 配置 |
| 61 | ```bash |
| 62 | # 开启转发 |
| 63 | echo 1 > /proc/sys/net/ipv4/ip_forward |
| 64 | |
| 65 | # SNAT |
| 66 | iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE |
| 67 | |
| 68 | # DNAT 端口转发 |
| 69 | iptables -t nat -A PREROUTING -p tcp --dport 8080 -j DNAT --to 192.168.1.10:80 |
| 70 | iptables -A FORWARD -p tcp -d 192.168.1.10 --dport 80 -j ACCEPT |
| 71 | ``` |
| 72 | |
| 73 | ### 保存规则 |
| 74 | ```bash |
| 75 | # Debian/Ubuntu |
| 76 | iptables-save > /etc/iptables/rules.v4 |
| 77 | iptables-restore < /etc/iptables/rules.v4 |
| 78 | |
| 79 | # CentOS/RHEL |
| 80 | service iptables save |
| 81 | ``` |
| 82 | |
| 83 | ## firewalld |
| 84 | |
| 85 | ### 基础命令 |
| 86 | ```bash |
| 87 | # 状态 |
| 88 | systemctl status firewalld |
| 89 | firewall-cmd --state |
| 90 | |
| 91 | # 重载 |
| 92 | firewall-cmd --reload |
| 93 | |
| 94 | # 查看区域 |
| 95 | firewall-cmd --get-zones |
| 96 | firewall-cmd --get-default-zone |
| 97 | firewall-cmd --get-active-zones |
| 98 | ``` |
| 99 | |
| 100 | ### 服务管理 |
| 101 | ```bash |
| 102 | # 查看服务 |
| 103 | firewall-cmd --list-services |
| 104 | firewall-cmd --get-services |
| 105 | |
| 106 | # 添加服务 |
| 107 | firewall-cmd --add-service=http --permanent |
| 108 | firewall-cmd --add-service=https --permanent |
| 109 | |
| 110 | # 删除服务 |
| 111 | firewall-cmd --remove-service=http --permanent |
| 112 | ``` |
| 113 | |
| 114 | ### 端口管理 |
| 115 | ```bash |
| 116 | # 查看端口 |
| 117 | firewall-cmd --list-ports |
| 118 | |
| 119 | # 添加端口 |
| 120 | firewall-cmd --add-port=8080/tcp --permanent |
| 121 | firewall-cmd --add-port=5000-5100/tcp --permanent |
| 122 | |
| 123 | # 删除端口 |
| 124 | firewall-cmd --remove-port=8080/tcp --permanent |
| 125 | ``` |
| 126 | |
| 127 | ### 富规则 |
| 128 | ```bash |
| 129 | # 允许特定 IP |
| 130 | firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.100" accept' --permanent |
| 131 | |
| 132 | # 允许网段访问端口 |
| 133 | firewall-cmd --add-rich-rule='rule family="ipv4" source address="192.168.1.0/24" port port="3306" protocol="tcp" accept' --permanent |
| 134 | |
| 135 | # 拒绝 IP |
| 136 | firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.100" reject' --permanent |
| 137 | ``` |
| 138 | |
| 139 | ## ufw (Ubuntu) |
| 140 | |
| 141 | ### 基础命令 |
| 142 | ```bash |
| 143 | # 启用/禁用 |
| 144 | ufw enable |
| 145 | ufw disable |
| 146 | |
| 147 | # 状态 |
| 148 | ufw status |
| 149 | ufw status verbose |
| 150 | ufw status numbered |
| 151 | ``` |
| 152 | |
| 153 | ### 规则管理 |
| 154 | ```bash |
| 155 | # 允许端口 |
| 156 | ufw allow 22 |
| 157 | ufw allow 80/tcp |
| 158 | ufw allow 443/tcp |
| 159 | |
| 160 | # 允许服务 |
| 161 | ufw allow ssh |
| 162 | ufw allow http |
| 163 | |
| 164 | # 允许 IP |
| 165 | ufw allow from 192.168.1.100 |
| 166 | |
| 167 | # 允许网段到端口 |
| 168 | ufw allow from 192.168.1.0/24 to any port 3306 |
| 169 | |
| 170 | # 拒绝 |
| 171 | ufw deny 23 |
| 172 | |
| 173 | # 删除规则 |
| 174 | ufw delete allow 80 |
| 175 | ufw delete 3 |
| 176 | ``` |
| 177 | |
| 178 | ### 默认策略 |
| 179 | ```bash |
| 180 | ufw default deny incoming |
| 181 | ufw default allow outgoing |
| 182 | ``` |
| 183 | |
| 184 | ## 常见场景 |
| 185 | |
| 186 | ### 场景 1：Web 服务器 |
| 187 | ```bash |
| 188 | # iptables |
| 189 | iptables -A INPUT -i lo -j ACCEPT |
| 190 | iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT |
| 191 | iptables -A INPUT -p tcp --dport 22 -j ACCEPT |
| 192 | iptables -A INPUT -p tcp --dport 80 -j ACCEPT |
| 193 | iptables -A INPUT -p tcp --dport 443 -j ACCEPT |
| 194 | iptables -A INPUT -j DROP |
| 195 | |
| 196 | # firewalld |
| 197 | firewall-cmd --add-service=ssh --permanent |
| 198 | firewall-cmd --add-service=http --permanent |
| 199 | firewall-cmd --add-service=https --permanent |
| 200 | firewall-cmd --reload |
| 201 | ``` |
| 202 | |
| 203 | ### 场景 2：数据库服务器 |
| 204 | ```bash |
| 205 | # 只允许应用服务器访问 |
| 206 | iptables -A INPUT -s 192.168.1.10 -p tcp --dport 3306 -j ACCEPT |
| 207 | iptables -A INPUT -s 192.168.1.11 -p tcp --dport 3306 -j ACCEPT |
| 208 | iptables -A INPUT -p tcp --dport 3306 -j DROP |
| 209 | ``` |
| 210 | |
| 211 | ### 场景 3：限速防护 |
| 212 | ```bash |
| 213 | # 限制 SSH 连接频率 |
| 214 | iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --set |
| 215 | iptables -A INPUT -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP |
| 216 | ``` |
| 217 | |
| 218 | ## 故障排查 |
| 219 | |
| 220 | | 问题 | 排查方法 | |
| 221 | |------|----------| |
| 222 | | 连接被拒 | 检查规则顺序、默认策略 | |
| 223 | | 规则不生效 | 检查 --permanent、reload | |
| 224 | | NAT 不工作 | 检查 ip_forward、FORWARD 链 | |
| 225 | |
| 226 | ```bash |
| 227 | # 查看计数 |
| 228 | iptables -L -n -v |
| 229 | |
| 230 | # 日志 |
| 231 | iptables -A INPUT -j LOG --log-prefix "IPT_DROP: " |
| 232 | tail -f /var/log/messages | grep IPT_DROP |
| 233 | |
| 234 | # 连接跟踪 |
| 235 | conntrack -L |
| 236 | ``` |
People who liked this also viewed
6 picksType
- entra-app-registrationGuides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API perSkillsJul 2026
- azure-complianceRun Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: SkillsJul 2026
- azure-rbacOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
- better-auth-best-practicesAgent skill from better-auth/skillsSkillsJul 2026
- firebase-security-rules-auditorA skill to evaluate how secure Firestore security rules are. Use this when Firestore security rules are updated to ensure that the generated rules are extremely secure and robust.SkillsJul 2026
- audit-websiteAudit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-opSkillsJul 2026
