Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 730 / 848

Chapter 43. Securing Your Network
704
[root@myServer ~ ] # iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
This allows users to browse websites that communicate using the standard port 80. To allow access
to secure websites (for example, https://www.example.com/), you also need to provide access to port
443, as follows:
[root@myServer ~ ] # iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
Important
When creating an
iptables
ruleset, order is important.
If a rule specifies that any packets from the 192.168.100.0/24 subnet be dropped, and this
is followed by a rule that allows packets from 192.168.100.13 (which is within the dropped
subnet), then the second rule is ignored.
The rule to allow packets from 192.168.100.13 must precede the rule that drops the
remainder of the subnet.
To insert a rule in a specific location in an existing chain, use the
-I
option. For example:
[root@myServer ~ ] # iptables -I INPUT 1 -i lo -p all -j ACCEPT
This rule is inserted as the first rule in the INPUT chain to allow local loopback device
traffic.
There may be times when you require remote access to the LAN. Secure services, for example SSH,
can be used for encrypted remote connection to LAN services.
Administrators with PPP-based resources (such as modem banks or bulk ISP accounts), dial-up
access can be used to securely circumvent firewall barriers. Because they are direct connections,
modem connections are typically behind a firewall/gateway.
For remote users with broadband connections, however, special cases can be made. You can
configure
iptables
to accept connections from remote SSH clients. For example, the following rules
allow remote SSH access:
[root@myServer ~ ] # iptables -A INPUT -p tcp --dport 22 -j ACCEPT
[root@myServer ~ ] # iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
These rules allow incoming and outbound access for an individual system, such as a single PC
directly connected to the Internet or a firewall/gateway. However, they do not allow nodes behind
the firewall/gateway to access these services. To allow LAN access to these services, you can use
Network Address Translation
(NAT) with
iptables
filtering rules.
43.8.5.
FORWARD
and NAT Rules
Most ISPs provide only a limited number of publicly routable IP addresses to the organizations they
serve.