> For the complete documentation index, see [llms.txt](https://kawsing.gitbook.io/opensystem/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kawsing.gitbook.io/opensystem/andoid-shou-ji/wang-lu-da-xiao-shi/xi-tong-an-quan/untitled-1.md).

# iptable與NAT路由器

進入Router機器

建立防火牆

測試ssh連線

<div align="left"><img src="https://529150212-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lh81JtaIQ84bwQqz_Wh%2F-M0LA5zt2hdoPUJrFdtd%2F-M0LCeAKSSTjK5F6Vfs0%2Fimage.png?alt=media&amp;token=7dffc137-c0ea-448b-b195-9a8e171d5d26" alt=""></div>

讓Router能ping別人，外面無法ping自己

```
echo "Flush nat table ......"
echo
# Flush nat
$IPTABLES -F -t nat
$IPTABLES -t nat -X
###-----------------------------------------------------###
# 設定 filter table 的預設政策
###-----------------------------------------------------###
$IPTABLES -P INPUT ACCEPT
$IPTABLES -P OUTPUT ACCEPT
$IPTABLES -P FORWARD ACCEPT

#建立ICMP chain
$IPTABLES -N ICMP

#進行紀錄
$IPTABLES -A ICMP -p icmp --icmp-type 8 -j LOG --log-prefix 'Ping Request:' --log-level alert

#Debug
$IPTABLES -A ICMP -p icmp --icmp-type 8 -j ACCEPT
#ICMP chain 的規則 ：DROP封包
$IPTABLES -A ICMP -p icmp --icmp-type 8 -j DROP
#針對INPUT chain的icmp封包跳到 ICMP chain
$IPTABLES -A INPUT -p icmp -j ICMP
```

### icmp flood 攻擊測試

![](https://529150212-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-Lh81JtaIQ84bwQqz_Wh%2F-M0Lr939CXJI7Uny8pTq%2F-M0Lxdec5CT5TROhAYxl%2F2020-02-18_14-22.png?alt=media\&token=9b8e7bd9-b050-4405-a45c-24f6d4ec09a7)

### 建立ssh的連線限制

```
#2.建立SSH chain
$IPTABLES -N SSH
#進行紀錄
$IPTABLES -A SSH -p tcp --dport 22 -j LOG --log-prefix 'SSH login:' --log-level alert
#Debug:允許ssh(利用iptables 規則 first match 機制)
#$IPTABLES -A SSH -p tcp --dport 22 -j ACCEPT
#SSH chain 的規則 ：DROP封包
$IPTABLES -A SSH -s 192.168.168.0/24 -p tcp --dport 22 -j DROP
#針對INPUT chain的ssh封包跳到 SSH chain
$IPTABLES -A INPUT -p tcp --dport 22 -j SSH

```