{"id":356,"date":"2021-07-12T21:25:45","date_gmt":"2021-07-12T13:25:45","guid":{"rendered":"https:\/\/blog.zhiccc.net\/?p=356"},"modified":"2022-10-21T14:37:51","modified_gmt":"2022-10-21T06:37:51","slug":"%e6%95%99%e7%a8%8b%e4%bd%bf%e7%94%a8ufw%e4%b8%ba%e5%a4%9a%e5%bc%a0%e7%bd%91%e5%8d%a1%e6%8f%90%e4%be%9b%e5%ae%8c%e5%85%a8%e4%b8%8d%e5%90%8c%e7%9a%84%e8%a7%84%e5%88%99","status":"publish","type":"post","link":"https:\/\/blog.zhiccc.net\/?p=356","title":{"rendered":"[\u6559\u7a0b]\u4f7f\u7528UFW\u4e3a\u591a\u5f20\u7f51\u5361\u63d0\u4f9b\u5b8c\u5168\u4e0d\u540c\u7684\u89c4\u5219"},"content":{"rendered":"\n<ul class=\"wp-block-list\"><li>\u5feb\u901f\u8df3\u8f6c\u5217\u8868<\/li><li><a href=\"#work\">UFW\u57fa\u672c\u5de5\u4f5c\u65b9\u5f0f<\/a><\/li><li><a href=\"#how\">\u8bbe\u7f6e\u601d\u8def<\/a><\/li><li><a href=\"#make\">\u5236\u4f5c\u65b9\u6cd5<\/a><\/li><li><a href=\"#test\">\u9a8c\u8bc1\u53ef\u7528\u6027<\/a><\/li><\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"work\">UFW\u57fa\u672c\u5de5\u4f5c\u65b9\u5f0f<\/h2>\n\n\n\n<p>UFW\u5728\u8bc6\u522b\u5230\u8fde\u63a5\u540e\u4f9d\u6b21\u5339\u914d\u89c4\u5219\uff0c\u5982\u679c\u53d1\u73b0\u4e86\u5bf9\u5e94\u89c4\u5219\uff0c\u5219\u6309\u7167\u89c4\u5219\u7ed9\u5b9a\u7684\u505a\u6cd5\u8fdb\u884c\u4e0b\u4e00\u6b65\u64cd\u4f5c\uff0c\u4ee5\u6b64\u7c7b\u63a8\u3002<br><strong>\u865a\u62df\u7f51\u5361(dummy)\u4f3c\u4e4e\u5e76\u4e0d\u80fd\u76f4\u63a5\u901a\u8fc7UFW\u7ba1\u63a7\uff0c\u6240\u4ee5\u9700\u8981\u901a\u8fc7\u9650\u5236\u8bbf\u95ee\u865a\u62df\u7f51\u5361IP\u5730\u5740\u4e0a\u7684\u7aef\u53e3\u7684\u65b9\u5f0f\u8fdb\u884c\u5904\u7406\u3002<\/strong><\/p>\n\n\n\n<p>\u4f60\u53ef\u80fd\u4f1a\u53d1\u73b0\uff1a\u5f53\u4f60\u901a\u8fc7UFW\u62d2\u7edd\u67d0\u4e2aIP\u53d1\u7684\u5305\u540e\uff0c\u8fd9\u4e2aIP\u8fd8\u80fd\u6b63\u5e38\u8fde\u63a5\uff0c\u6b63\u662f\u56e0\u4e3a\u8fd9\u4e2a\u539f\u56e0\uff0c\u6240\u4ee5ban IP\u7684\u65f6\u5019\u8981ufw insert\uff0c\u76f4\u63a5\u8f93\u5165\u53ef\u80fd\u4f1a\u5361\u5728IPv4\u89c4\u5219\u548cIPv6\u89c4\u5219\u4e4b\u95f4\u3002\uff08\u626f\u8fdc\u4e86\uff09<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"how\">\u8bbe\u7f6e\u601d\u8def<\/h2>\n\n\n\n<p>\u65e2\u7136\u6211\u4eec\u77e5\u9053\u4e86UFW\u7684\u5de5\u4f5c\u65b9\u5f0f\uff0c\u90a3\u4e48\u6211\u4eec\u5c31\u80fd\u901a\u8fc7<strong>\u4e0d\u65ad\u7684insert<\/strong>\u6765\u4e3a\u5404\u4e2a\u7f51\u5361\u5206\u51fa\u4ed6\u4eec\u7684\u89c4\u5219\uff0c\u5e76\u5728\u8be5\u7f51\u5361\u89c4\u5219\u7684<strong>\u6700\u540e<\/strong>\u52a0\u4e0a<strong>\u7981\u6b62\u6240\u6709\u7aef\u53e3\u5165\u7ad9<\/strong>\u7684\u89c4\u5219\uff0c\u8fd9\u6837\u6211\u4eec\u5c31\u80fd\u5212\u5206\u51fa\u5b8c\u5168\u4e0d\u540c\u7684\u89c4\u5219\u3002<\/p>\n\n\n\n<p>\u4f8b\u5982\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&#91;1]80\/tcp (v6) on eth1    ALLOW IN     Anywhere\/tcp (v6)        #\u5141\u8bb8\u8bbf\u95eeeth1\u768480\u7aef\u53e3\n&#91;2]443\/tcp (v6) on eth1    ALLOW IN     Anywhere\/tcp (v6)       #\u5141\u8bb8\u8bbf\u95eeeth1\u7684443\u7aef\u53e3\n&#91;3]Anywhere\/tcp (v6) on eth1    DENY IN     Anywhere\/tcp (v6)   #\u62d2\u7edd\u8bbf\u95eeeth1\u7684\u6240\u6709\u7aef\u53e3\n&#91;4]25\/tcp (v6) on eth2    ALLOW IN     Anywhere\/tcp (v6)        #\u5141\u8bb8\u8bbf\u95eeeth2\u768425\u7aef\u53e3\n&#91;5]587\/tcp (v6) on eth2    ALLOW IN     Anywhere\/tcp (v6)       #\u5141\u8bb8\u8bbf\u95eeeth2\u7684587\u7aef\u53e3\n&#91;6]Anywhere\/tcp (v6) on eth2    DENY IN     Anywhere\/tcp (v6)   #\u62d2\u7edd\u8bbf\u95eeeth2\u7684\u6240\u6709\u7aef\u53e3<\/code><\/pre>\n\n\n\n<p>\u8fd9\u65f6\u5982\u679c\u6709IP\u5c1d\u8bd5\u8bbf\u95ee<strong>eth1\u768480\u7aef\u53e3<\/strong>\uff0c\u7b2c\u4e00\u4e2a\u6761\u4ef6\u4e0e\u5176\u5339\u914d\uff0c\u5219<strong>\u901a\u8fc7<\/strong>\uff0c\u4f46\u662f\u5982\u679c\u8bbf\u95ee<strong>eth1\u768425\u7aef\u53e3<\/strong>\uff0c\u56e0\u4e3a\u7b2c\u4e00\u9879\u4e0e\u7b2c\u4e8c\u9879<strong>\u4e0d\u662f\u5141\u8bb825\u7aef\u53e3<\/strong>\uff0c\u5219<strong>\u5339\u914d\u7b2c\u4e09\u6761\u89c4\u5219<\/strong>\uff0c\u5219<strong>\u62d2\u7edd\u8bbf\u95ee<\/strong>\u3002<br>\u5982\u679c\u8be5IP\u8bbf\u95ee<strong>eth2\u768425<\/strong>\u7aef\u53e3\uff0c\u56e0\u4e3a1-3\u7684\u9002\u7528\u524d\u63d0\u662f<strong>\u901a\u5411eth1\u7684\u7f51\u5361\u7684\u8fde\u63a5<\/strong>\uff0c\u6240\u4ee5\u524d\u4e09\u9879\u5bf9\u6b64\u8fde\u63a5<strong>\u65e0\u6548<\/strong>\uff0c\u4ece\u7b2c\u56db\u9879\u5339\u914d\u8d77\uff0c\u56e0\u4e3a\u7b2c\u56db\u9879\u4e0e\u5176\u5339\u914d\uff0c\u5219<strong>\u901a\u8fc7<\/strong>\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"make\">\u5236\u4f5c\u65b9\u6cd5<\/h2>\n\n\n\n<p>\u5047\u8bbe\u6211\u4eec\u67093\u5f20\u7f51\u5361\uff0c\u540d\u5b57\u5206\u522b\u4e3a<strong>eth1, eth2, eth3<\/strong><\/p>\n\n\n\n<p>\u6211\u60f3\u7ed9<strong>eth1\u5141\u8bb880 443 1234 TCP\u7aef\u53e3\u548c53 UDP\u7aef\u53e3\uff0ceth2\u5141\u8bb825 110 143 587 TCP\u7aef\u53e3\uff0ceth3\u5141\u8bb83306 3389 TCP\u4e0eUDP\u7aef\u53e3<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ufw enable              #\u6253\u5f00UFW\nufw status numbered     #\u67e5\u770b\u76ee\u524d\u89c4\u5219\u72b6\u6001\u5e76\u5217\u51fa\u5bf9\u5e94\u884c\u6570<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"726\" height=\"409\" src=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/scc2.jpg\" alt=\"\" class=\"wp-image-364\" srcset=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/scc2.jpg 726w, https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/scc2-300x169.jpg 300w\" sizes=\"auto, (max-width: 726px) 100vw, 726px\" \/><\/figure>\n\n\n\n<p>\u5148\u5199<strong>eth1<\/strong>\u7684\u89c4\u5219<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw allow in on eth1 proto udp from any to any port 53        #\u5141\u8bb8\u5916\u90e8\u8fde\u63a5\u81f3eth1\u768453\u7aef\u53e3\nsudo ufw allow in on eth1 proto tcp from any to any port 80        #\u5141\u8bb8\u5916\u90e8\u8fde\u63a5\u81f3eth1\u768480\u7aef\u53e3\nsudo ufw allow in on eth1 proto tcp from any to any port 443       #\u5141\u8bb8\u5916\u90e8\u8fde\u63a5\u81f3eth1\u7684443\u7aef\u53e3\nsudo ufw allow in on eth1 proto tcp from any to any port 1234      #\u5141\u8bb8\u5916\u90e8\u8fde\u63a5\u81f3eth1\u76841234\u7aef\u53e3\nsudo ufw deny in on eth1 proto tcp from any to any                 #\u7981\u6b62\u6240\u6709TCP\u8fde\u63a5\u901a\u8fc7eth1\nsudo ufw deny in on eth1 proto udp from any to any                 #\u7981\u6b62\u6240\u6709UDP\u8fde\u63a5\u901a\u8fc7eth1\nsudo ufw status numbered         #\u663e\u793a\u9632\u706b\u5899\u89c4\u5219<\/code><\/pre>\n\n\n\n<p>\u518d\u5199<strong>eth2<\/strong>\u7684\u89c4\u5219<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw allow in on eth2 proto tcp from any to any port 25\nsudo ufw allow in on eth2 proto tcp from any to any port 110\nsudo ufw allow in on eth2 proto tcp from any to any port 143\nsudo ufw allow in on eth2 proto tcp from any to any port 587\nsudo ufw deny in on eth2 proto tcp from any to any                 \nsudo ufw deny in on eth2 proto udp from any to any                 \nufw status numbered<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"722\" height=\"627\" src=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/scc3.jpg\" alt=\"\" class=\"wp-image-365\" srcset=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/scc3.jpg 722w, https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/scc3-300x261.jpg 300w\" sizes=\"auto, (max-width: 722px) 100vw, 722px\" \/><\/figure>\n\n\n\n<p><strong>eth3<\/strong>\u7684\u89c4\u5219<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo ufw allow in on eth3 proto tcp from any to any port 3306\nsudo ufw allow in on eth3 proto udp from any to any port 3306\nsudo ufw allow in on eth3 proto tcp from any to any port 3389\nsudo ufw allow in on eth3 proto udp from any to any port 3389\nsudo ufw deny in on eth3 proto tcp from any to any                 \nsudo ufw deny in on eth3 proto udp from any to any    \nufw status numbered<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"731\" height=\"822\" src=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/scc4.jpg\" alt=\"\" class=\"wp-image-366\" srcset=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/scc4.jpg 731w, https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/scc4-267x300.jpg 267w\" sizes=\"auto, (max-width: 731px) 100vw, 731px\" \/><\/figure>\n\n\n\n<p>\u4e3a\u4e86\u65b9\u4fbf\uff0c\u6211\u628a\u7f51\u5361\u540d\u5b57\u4fee\u6539\u6210\u4e86<strong>ens33, ens38, ens39\uff0cens33\u5bf9\u5e94eth1\uff0cens38\u5bf9\u5e94eth2\uff0cens39\u5bf9\u5e94eth3\u3002<\/strong><br>\u73b0\u5728<strong>ens33\u7684IP\u4e3a192.168.0.220\uff0cens38\u7684IP\u4e3a192.168.0.221\uff0cens39\u7684IP\u4e3a192.168.0.222<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/sc6.jpg\" alt=\"\" class=\"wp-image-368\" width=\"729\" height=\"145\" srcset=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/sc6.jpg 311w, https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/sc6-300x60.jpg 300w\" sizes=\"auto, (max-width: 729px) 100vw, 729px\" \/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"test\">\u9a8c\u8bc1\u53ef\u7528\u6027<\/h2>\n\n\n\n<p><em>\u6211\u4eec\u4f7f\u7528\u4e00\u53f0Windows\u4e3b\u673a\u6a21\u62df\u5916\u7f51IP\u8bbf\u95ee<\/em><\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/sc7.jpg\" alt=\"\" class=\"wp-image-369\" width=\"726\" height=\"283\" srcset=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/sc7.jpg 503w, https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/sc7-300x117.jpg 300w\" sizes=\"auto, (max-width: 726px) 100vw, 726px\" \/><figcaption>\u6211\u4eec\u4f7f\u7528\u4e86tcping\u6765\u6d4b\u8bd5\u7aef\u53e3\u662f\u5426\u5f00\u542f<\/figcaption><\/figure>\n\n\n\n<p>\u8fd9\u65f6\uff0c\u6a21\u62df\u5916\u7f51\u8bbf\u95ee80\u7aef\u53e3\u65f6<strong>\u7b26\u5408<\/strong>ens33 (192.168.0.220)\u7684\u89c4\u5219\uff0c<strong>\u5141\u8bb8\u8fde\u63a5<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/sc8.jpg\" alt=\"\" class=\"wp-image-370\" width=\"729\" height=\"276\" srcset=\"https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/sc8.jpg 525w, https:\/\/blog.zhiccc.net\/wp-content\/uploads\/2021\/07\/sc8-300x114.jpg 300w\" sizes=\"auto, (max-width: 729px) 100vw, 729px\" \/><\/figure>\n\n\n\n<p>\u8fd9\u65f6\uff0c\u6a21\u62df\u5916\u7f51\u8bbf\u95ee80\u7aef\u53e3\u65f6<strong>\u4e0d\u7b26\u5408<\/strong>ens33 (192.168.0.220)\u7684\u89c4\u5219\uff0c<strong>\u62d2\u7edd\u8fde\u63a5<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u5feb\u901f\u8df3\u8f6c\u5217\u8868 UFW\u57fa\u672c\u5de5\u4f5c\u65b9\u5f0f \u8bbe\u7f6e\u601d\u8def \u5236\u4f5c\u65b9\u6cd5 \u9a8c\u8bc1\u53ef\u7528\u6027 UFW\u57fa\u672c\u5de5\u4f5c\u65b9\u5f0f UFW\u5728\u8bc6\u522b\u5230\u8fde\u63a5\u540e\u4f9d\u6b21&hellip;&nbsp;<a href=\"https:\/\/blog.zhiccc.net\/?p=356\" class=\"\" rel=\"bookmark\">\u9605\u8bfb\u66f4\u591a &raquo;<span class=\"screen-reader-text\">[\u6559\u7a0b]\u4f7f\u7528UFW\u4e3a\u591a\u5f20\u7f51\u5361\u63d0\u4f9b\u5b8c\u5168\u4e0d\u540c\u7684\u89c4\u5219<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[11],"tags":[],"class_list":["post-356","post","type-post","status-publish","format-standard","hentry","category-jiao-cheng"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=\/wp\/v2\/posts\/356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=356"}],"version-history":[{"count":4,"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=\/wp\/v2\/posts\/356\/revisions"}],"predecessor-version":[{"id":377,"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=\/wp\/v2\/posts\/356\/revisions\/377"}],"wp:attachment":[{"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.zhiccc.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}