网络基础#

参考链接

ip#

ipv4

ipv6 未普及的

子网掩码#

A B C类网络

/24 =255.255.255.0=8x3

网关#

路由器/交换机地址，dhcp分配ip

连通性测试 ping#

查看ip 两命令#

ifconfig#

..[kozakemi@arco-x64-kemi] - [~] - [三 8月 30, 08:59]
..[$] <()> ifconfig 
enp5s0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 10.132.22.106  netmask 255.255.255.0  broadcast 10.132.22.255
        inet6 fe80::df66:28:d9d3:8b42  prefixlen 64  scopeid 0x20<link>
        ether c8:7f:54:03:a4:a0  txqueuelen 1000  (Ethernet)
        RX packets 585126  bytes 740451285 (706.1 MiB)
        RX errors 0  dropped 0  overruns 0  frame 0
        TX packets 446947  bytes 45027152 (42.9 MiB)
        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0
        device memory 0x85b00000-85bfffff  

ip addr#

..[kozakemi@arco-x64-kemi] - [~] - [三 8月 30, 08:59]
..[$] <()> ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host noprefixroute 
       valid_lft forever preferred_lft forever
2: enp5s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether c8:7f:54:03:a4:a0 brd ff:ff:ff:ff:ff:ff
    inet 10.132.22.106/24 brd 10.132.22.255 scope global dynamic noprefixroute enp5s0
       valid_lft 79580sec preferred_lft 79580sec
    inet6 fe80::df66:28:d9d3:8b42/64 scope link noprefixroute 
       valid_lft forever preferred_lft forever

为ip命令的一种应用

网络安全#

防火墙#

配置

iptables 早期

firewalld 现阶段

两者的关系

iptables在内核之上，firewalld 在iptables之上

firewalld

ufw#

firewalld#

sudo apt install firewalld

检查运行状态

sudo systemctl status firewalld.service

检查运行区域

sudo firewall-cmd --get-default-zone

查看默认区域的规则

sudo firewall-cmd --zone=public --list-all

放行80端口

sudo firewall-cmd --zone=public --add-port=80/tcp --permanent

删除放行80端口

sudo firewall-cmd --zone=public --remove-port=80/tcp --permanent

ban ip

sudo firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.132.22.231" port protocol="tcp" port="80" reject"

sudo firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.132.22.106" drop"

unban ip

sudo firewall-cmd --permanent --remove-rich-rule='rule family="ipv4" source address="10.132.22.106" reject'

直接删除之前的规则

reject拒绝 drop丢弃

重新加载

sudo firewall-cmd --reload