Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 742 / 848

Chapter 43. Securing Your Network
716
you can also use the protocol ID, instead of the protocol name. Refer to the following examples, each
of which have the same effect:
iptables -A INPUT -p icmp --icmp-type any -j ACCEPT
iptables -A INPUT -p 5813 --icmp-type any -j ACCEPT
Service definitions are provided in the
/etc/services
file. For readability, it is recommended that
you use the service names rather than the port numbers.
Important
Secure the
/etc/services
file to prevent unauthorized editing. If this file is editable,
crackers can use it to enable ports on your machine you have otherwise closed. To secure
this file, type the following commands as root:
[root@myServer ~]# chown root.root /etc/services [root@myServer ~]# chmod 0644 /
etc/services [root@myServer ~]# i /etc/services
This prevents the file from being renamed, deleted or having links made to it.
43.9.3.4.1. TCP Protocol
These match options are available for the TCP protocol (
-p tcp
):
•
--dport
— Sets the destination port for the packet.
To configure this option, use a network service name (such as www or smtp); a port number; or a
range of port numbers.
To specify a range of port numbers, separate the two numbers with a colon (
:
). For example:
-p
tcp --dport 3000:3200
. The largest acceptable valid range is
0:65535
.
Use an exclamation point character (
!
) after the
--dport
option to match all packets that
do not
use that network service or port.
To browse the names and aliases of network services and the port numbers they use, view the
/
etc/services
file.
The
--destination-port
match option is synonymous with
--dport
.
•
--sport
— Sets the source port of the packet using the same options as
--dport
. The
--
source-port
match option is synonymous with
--sport
.
•
--syn
— Applies to all TCP packets designed to initiate communication, commonly called
SYN
packets
. Any packets that carry a data payload are not touched.
Use an exclamation point character (
!
) after the
--syn
option to match all non-SYN packets.
•
--tcp-flags <tested flag list> <set flag list>
— Allows TCP packets that have
specific bits (flags) set, to match a rule.