mình xài nano để edit xong rồi service iptables save, save xong thì thứ tự vẫn như trước khi save. 

iptables-restore < <path file rule>

service iptables restart

iptables -I <CHAIN> <số vị trí đặt> -p .........

:<số hàng hoặc nhóm hàng cần chuyển>v<số vị trí đặt>

iptables -A <CHAIN> -p icmp -j ACCEPT

Và, mình chưa hiểu lắm về cách sắp sếp thứ tự trong iptables, cái nào quan trọng hơn cái nào? cái nào cần đi trước? cái nào đi sau? 

ah còn cái nữa, khi dùng iptables trên, mấy cái traceroute, whois, ping php script của mình hết xài được :( permission not allowed hay socket error gì đó. làm sao để giải quyết được vấn đề này? 

Sep 9 08:58:25 xxxxxxxxx sshd[20141]: Address 64.34.179.206 maps to server1.aclutx.org, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 08:58:25 xxxxxxxxx sshd[20141]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.34.179.206 user=root Sep 9 08:58:27 xxxxxxxxx sshd[20141]: Failed password for root from 64.34.179.206 port 35164 ssh2 Sep 9 08:58:27 xxxxxxxxx sshd[20142]: Received disconnect from 64.34.179.206: 11: Bye Bye Sep 9 08:58:28 xxxxxxxxx sshd[20143]: Address 64.34.179.206 maps to server1.aclutx.org, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 08:58:28 xxxxxxxxx sshd[20143]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.34.179.206 user=root Sep 9 08:58:28 xxxxxxxxx sshd[20145]: Address 64.34.179.206 maps to server1.aclutx.org, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 08:58:28 xxxxxxxxx sshd[20145]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=64.34.179.206 user=root Sep 9 08:58:30 xxxxxxxxx sshd[20143]: Failed password for root from 64.34.179.206 port 39604 ssh2 Sep 9 08:58:30 xxxxxxxxx sshd[20144]: Received disconnect from 64.34.179.206: 11: Bye Bye Sep 9 08:58:30 xxxxxxxxx sshd[20145]: Failed password for root from 64.34.179.206 port 35938 ssh2 Sep 9 08:58:31 xxxxxxxxx sshd[20146]: Received disconnect from 64.34.179.206: 11: Bye Bye Sep 9 11:02:43 xxxxxxxxx sshd[21616]: Address 173.231.12.116 maps to 173-231-12-116.hosted.static.webnx.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 11:02:43 xxxxxxxxx sshd[21616]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.231.12.116 user=root Sep 9 11:02:45 xxxxxxxxx sshd[21616]: Failed password for root from 173.231.12.116 port 54261 ssh2 Sep 9 11:02:45 xxxxxxxxx sshd[21617]: Received disconnect from 173.231.12.116: 11: Bye Bye Sep 9 11:02:46 xxxxxxxxx sshd[21618]: Address 173.231.12.116 maps to 173-231-12-116.hosted.static.webnx.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 11:02:46 xxxxxxxxx sshd[21618]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.231.12.116 user=root Sep 9 11:02:46 xxxxxxxxx sshd[21620]: Address 173.231.12.116 maps to 173-231-12-116.hosted.static.webnx.com, but this does not map back to the address - POSSIBLE BREAK-IN ATTEMPT! Sep 9 11:02:46 xxxxxxxxx sshd[21620]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=173.231.12.116 user=root Sep 9 11:02:47 xxxxxxxxx sshd[21618]: Failed password for root from 173.231.12.116 port 60095 ssh2 Sep 9 11:02:47 xxxxxxxxx sshd[21619]: Received disconnect from 173.231.12.116: 11: Bye Bye Sep 9 11:02:48 xxxxxxxxx sshd[21620]: Failed password for root from 173.231.12.116 port 54863 ssh2 Sep 9 11:02:48 xxxxxxxxx sshd[21621]: Received disconnect from 173.231.12.116: 11: Bye Bye 

Và hình như lúc setup ssh server tự nó tạo rsa key cho mình rồi mà?  

/hvaonline/posts/list/42715.html

#!/bin/bash # ############################# # FIREWALL 1.0 # 09/11/2012 # # How to make the script executable # chmod +x firewall # # edit our script and run it from the shell with the following command # ./firewall ############################# ############################# # Flush all current rules from iptables iptables -F ############################# ############################# # Set default policies for INPUT, FORWARD and OUTPUT chains iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP ############################# ############################# # LOGDROPPER iptables -N LOGNDROP > /dev/null 2> /dev/null iptables -F LOGNDROP iptables -A LOGNDROP -j LOG --log-prefix "LOGNDROP: " iptables -A LOGNDROP -j DROP ############################# ############################# # force syn packets check, make sure new incoming tcp connections are syn packets; otherwise we need to drop them iptables -A INPUT -p tcp ! --syn -m state --state NEW -j LOGNDROP ############################# ############################# # drop invalid syn packets iptables -A INPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOGNDROP iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOGNDROP iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags ALL ACK,RST,SYN,FIN -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags SYN,RST SYN,RST -j LOGNDROP ############################# ############################# # drop packets with incoming fragments. this attack result into linux server panic such data loss iptables -A INPUT -f -j LOGNDROP iptables -A OUTPUT -f -j LOGNDROP ############################# ############################# # xmas packets iptables -A INPUT -p tcp --tcp-flags ALL ALL -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags ALL ALL -j LOGNDROP ############################# ############################# # drop all null packets iptables -A INPUT -p tcp --tcp-flags ALL NONE -j LOGNDROP iptables -A OUTPUT -p tcp --tcp-flags ALL NONE -j LOGNDROP ############################# ############################# # drop invalid iptables -A INPUT -m state --state INVALID -j LOGNDROP iptables -A OUTPUT -m state --state INVALID -j LOGNDROP ############################# ############################# # disable outgoign icmp request iptables -A OUTPUT -p icmp --icmp-type echo-request -j LOGNDROP ############################# ############################# # prevent ssh attacks iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 300 --hitcount 4 --rttl --name SSH -j LOGNDROP ############################# ############################# # Limit NEW traffic on port 80 iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m limit --limit 25/minute --limit-burst 100 -j ACCEPT ############################# ############################# # Limit established traffic iptables -A INPUT -m state --state RELATED,ESTABLISHED -m limit --limit 50/second --limit-burst 50 -j ACCEPT ############################# ############################# # allow loopback iptables -A INPUT -i lo -j ACCEPT iptables -A OUTPUT -o lo -j ACCEPT ############################# ############################# # allow server tcp ports 22,80,443,10000 iptables -A INPUT -p tcp -m multiport -m state -i eth0 --state NEW,ESTABLISHED -j ACCEPT --dports 22,80,443,10000 iptables -A OUTPUT -p tcp -m multiport -m state -o eth0 --state ESTABLISHED -j ACCEPT --sports 22,80,443,10000 ############################# ############################# # allow tcp ports 80,443 for yum update iptables -A INPUT -p tcp -m tcp -m multiport -m state -i eth0 --state ESTABLISHED -j ACCEPT --sports 80,443 iptables -A OUTPUT -p tcp -m tcp -m multiport -m state -o eth0 --state NEW,ESTABLISHED -j ACCEPT --dports 80,443 ############################# ############################# # allow udp ports 123 ntp (network time protocol), 53 dns (domain name service) iptables -A INPUT -p udp -m udp -m multiport -i eth0 -j ACCEPT --sports 123,53 iptables -A OUTPUT -p udp -m udp -m multiport -o eth0 -j ACCEPT --dports 123,53 ############################# ############################# # Save settings /sbin/service iptables save ############################# ############################# # List rules iptables -L -v #############################  

có 1 vấn đề này, nhờ các bác góp ý, cái server trên là centos chạy trên windows xp bằng vmware, nối trực tiếp vô modem ra internet. Không có cái gì bảo vệ thằng xp hết trừ cái firewall có sẵn của xp. Mình rất muốn cài centos thẳng lên cái box đó nhưng mình vẫn chưa tự tin cho lắm vì nếu cài thẳng lên box nếu bị fuked up cái gì đó thì phải lên trực tiếp cái box để sửa. mình xài vmware như vậy nếu có gì hư thì còn vnc vô xp để sửa thằng centos được còn không thì restore từ snapshot của vnware. các bác nghĩ xp (tắt hết mấy services không quan trọng, và không chạy gì trừ vmware) có khả năng đứng ra thẳng internet như vậy không? mình vẫn thích vmware vì rất tiện cho mình. 

nếu như mình cài centos lên box đó, rồi vmware. Thì những file của centos guest của vmware windows tạo ra có phải convert qua host centos mới không? hay chỉ đơn giản là copy qua thôi? 

sao em mới cho

iptables -P INPUT DROP iptables -P OUTPUT DROP iptables -P FORWARD DROP  

thì tất cả các cổng đều bị đóng hết :( lại phải stop iptables mới vào lại đc :(