Home PC Games Linux Windows Database Network Programming Server Mobile  
           
  Home \ Server \ Linux firewall settings -DNS server articles     - Build Nginx + uWSGI + Flask operating environment under CentOS 6.4 tutorial (Server)

- C # assembly calls across constants, variables and functions (Programming)

- Ubuntu 14.04 VirtualBox can not start solution (Linux)

- Define and modify strings principle in Python (Programming)

- Three kinds of implementation model of the Linux thread history (Programming)

- ORA-01839 error caused by incorrect system date setting (Database)

- ethtool implementation framework and application in Linux (Linux)

- stat - Get more information than ls (Linux)

- Cacti Linux-based system monitoring and alarm (Linux)

- C ++ complex class of operator overloading (Programming)

- C ++ class implementation date operator overloading (Programming)

- C ++ sequence containers basics summary (Programming)

- Disk partition MBR (Linux)

- How to use SVN to manage our source code (Server)

- Install Visual Studio Code in Ubuntu (Linux)

- Open source backup software installed on Ubuntu Systemback 1.6.201 (Linux)

- iOS9 new feature - stacked view UIStackView (Programming)

- The method of CentOS-7.0. The installation and configuration of Tomcat-7 (Server)

- Linux foundation tutorial: how to modify the host name on CentOS or RHEL 7 (Linux)

- XP virtual machine under VirtualBox solve occupy 100% CPU problem (Linux)

 
         
  Linux firewall settings -DNS server articles
     
  Add Date : 2018-11-21      
         
         
         
  Just set up a DNS server, you need to open the firewall but do not know how to set up a friend, you can refer to the following, or directly use my script given below.

If the server is a DNS server used for the vast majority of cases, in order to turn on the firewall while normally provide related services, general settings are as follows:

[1] The first step: clear the default firewall rules

iptables -F
iptables -X
iptables -Z
Parameter Description:

-F: Clear all the rules that have been developed

-X: Clear all user-defined chain (it should be said that the tables)

(Extension: table - iptables Linux firewall default, there are three tables, Filter, NAT and Mangle, of course, the custom Filter which is the default form, chain-- chain, such as filter there is INPUT, OUTPUT, FORWARD three chains)

-Z: All the chain counts and cleared traffic statistics

Set reasons:

filter of three chains, the default policies are ACCEPT, apparently for INPUT, this is very dangerous, you can use the command iptables -L -n to view the default settings, or use the iptables-save command (listed in more detail firewall configuration information).

[2] The second step: setting policy

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
Set reasons:

DROP to drop, From 1, INPUT DROP strategy formulation is only relatively safe.

 

[3] The third step: the development of the rules according to the required service

 

(1) Set the machine as a trusted device

iptables -A INPUT -i lo -j ACCEPT
(2) the development of a remote ssh connection rules

iptables -A (add) INPUT (link) -p (specify the protocol) tcp (specified as the TCP protocol) --dport (specify the destination port number) 22 (specify the destination port number is 22) -j (designated operation) ACCEPT ( specify the action to accept)
(3) develop dns service rules

iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --sport 53 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT
Description:

It allows new dns requests, while allowing to nslookup way to query to the server that is the source port 53 to query dns information.

(4) the development of other rules

iptables -A INPUT -p icmp -j ACCEPT
Description:

Can not, but in order to facilitate the detection server network connectivity, they still add.

 

[4] write firewall profiles

/etc/init.d/iptables save
Description:

To save, otherwise the above configuration will be made after the failure to restart the server.

Full implementation of the script is as follows:

#! / Bin / bash
PATH = / sbin: / bin: / usr / sbin: / usr / bin; export PATH
iptables -F
iptables -X
iptables -Z

iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -A INPUT -p udp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp --sport 53 -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT

/etc/init.d/iptables save
Save as .sh file with administrator privileges can execute.

Other commonly used commands:

View firewall configuration summary

iptables -L -n
See detailed firewall configuration

iptables-save
Important note:

    The firewall configuration must be careful, especially when done in the remote configuration, if not carefully defined rules clear, again the default rule is set to INPUT DROP, then there is no way to connect remotely, and with particular attention to this point .
     
         
         
         
  More:      
 
- CentOS / Linux restart active NIC connection paths / network configure error Error Resolution (Linux)
- Installation and Configuration Munin monitoring server on Linux (Server)
- HBase vs Oracle (Database)
- NFS installation process under the CentOS (Linux)
- systemd run levels and service management command Introduction (Linux)
- Understanding the type in C ++ bitset (Programming)
- About phpwind 5.01-5.3 0day analysis of the article (Linux)
- How to Install 3.16.7 CKT2 kernel in Ubuntu 14.10, Ubuntu 14.04 and its derivative versions (Linux)
- Web cache basics: terminology, HTTP headers, and caching policies (Server)
- Java transient keyword (Programming)
- Three strategies to teach you to release the device memory (Linux)
- Enterprise-class GitHub warehousing environment build (Server)
- Linux install Samba file sharing server (Server)
- To learn linux security (Linux)
- Python developer of time-saving method (Programming)
- Linux atomic operations and synchronization mechanisms (Programming)
- Run two MySQL service on one server (Database)
- Nginx high concurrency optimization ideas (Server)
- TCP protocol flaw incomplete records (Linux)
- command-line tool for send e-mail (Linux)
     
           
     
  CopyRight 2002-2020 newfreesoft.com, All Rights Reserved.