Firewall高级配置实例

需求简述

1.公司内网用户需要通过网关服务器共享上网
2.互联网用户需要访问网站服务器
3.只允许192.168.1 .0/24ping网关和服务器
4.网站服务器和网关服务器均通过SSH来远程管理,为了安全，将SSH默认端口改为12345，只允许192.168.1.10主机SSH网关和服务器，允许互联网SSH内部服务器

拓扑结构图

1.网关服务器:Centos7 -1
2.企业内网测试机:Centos7 -2
3.网站服务器:Centos7 -3
4.Internet测试机:Centos7 -4

实验步骤

第一步:配置网关服务器的网卡及地址

1.添加网卡,并绑定网卡为VMent2仅主机模式

2.配置并确认网关地址

[root@192 network-scripts]# ifconfigens33: flags=4163  mtu 1500        inet 100.1.1.10  netmask 255.255.255.0  broadcast 100.1.1.255        inet6 fe80::839c:1220:87fc:aef  prefixlen 64  scopeid 0x20        ether 00:0c:29:70:78:f5  txqueuelen 1000  (Ethernet)        RX packets 2715  bytes 723845 (706.8 KiB)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 623  bytes 55679 (54.3 KiB)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0ens36: flags=4163  mtu 1500        inet 192.168.10.1  netmask 255.255.255.0  broadcast 192.168.1.255        inet6 fe80::3d7f:4cdc:f7ec:8638  prefixlen 64  scopeid 0x20        ether 00:0c:29:70:78:09  txqueuelen 1000  (Ethernet)        RX packets 38  bytes 7923 (7.7 KiB)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 143  bytes 24516 (23.9 KiB)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0ens37: flags=4163  mtu 1500        inet 192.168.20.1  netmask 255.255.255.0  broadcast 192.168.2.255        inet6 fe80::a6c3:1677:f71d:8e29  prefixlen 64  scopeid 0x20        ether 00:0c:29:70:78:ff  txqueuelen 1000  (Ethernet)        RX packets 38  bytes 7923 (7.7 KiB)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 138  bytes 23100 (22.5 KiB)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0

3.开启路由转发功能

[root@192 network-scripts]# vim /etc/sysctl.conf ......                                                                          //省略注释内容net.ipv4.ip_forward = 1                                         //添加此条目[root@192 network-scripts]# sysctl -p                   //载入sysctl配置文件net.ipv4.ip_forward = 1

第二步:配置internal区域中内网测试机的地址和网关

1.绑定网卡为VMent3仅主机模式

2.配置并确认IP地址与网关

[root@192 network-scripts]# ifconfig                //查看ip地址及子网掩码ens33: flags=4163  mtu 1500        inet 192.168.10.10  netmask 255.255.255.0  broadcast 192.168.1.255        inet6 fe80::839c:1220:87fc:aef  prefixlen 64  scopeid 0x20        ether 00:0c:29:90:44:7f  txqueuelen 1000  (Ethernet)        RX packets 2647  bytes 190172 (185.7 KiB)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 453  bytes 51940 (50.7 KiB)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0[root@192 network-scripts]# route -n            //查看路由信息Kernel IP routing tableDestination     Gateway         Genmask         Flags Metric Ref    Use Iface192.168.10.0     0.0.0.0         255.255.255.0   U     100    0        0 ens33

第三步:配置DMZ区域网站服务器的地址和网关,并启动网站服务

1.先在联网状态下载安装httpd服务

[root@192 ~]# yum install httpd -y

2.绑定网卡为VMent3仅主机模式**

3.配置并确认IP地址与网关

[root@dmz ~]# ifconfigens33: flags=4163  mtu 1500        inet 192.168.20.20  netmask 255.255.255.0  broadcast 192.168.2.255        inet6 fe80::839c:1220:87fc:aef  prefixlen 64  scopeid 0x20        inet6 fe80::791b:db71:8a12:f34  prefixlen 64  scopeid 0x20        ether 00:0c:29:de:4a:b8  txqueuelen 1000  (Ethernet)        RX packets 5353  bytes 3513622 (3.3 MiB)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 1143  bytes 105439 (102.9 KiB)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0[root@dmz ~]# route -nKernel IP routing tableDestination     Gateway         Genmask         Flags Metric Ref    Use Iface192.168.20.0     0.0.0.0         255.255.255.0   U     100    0        0 ens33

4.开启网站服务

[root@192 ~]# vim /var/www/html/index.html[root@192 ~]# cat /var/www/html/index.html
this is dmz web
[root@dmz html]# systemctl start httpd

第四步:在DMZ区域网站服务器上配置防火墙策略[root@dmz ~]# firewall-cmd --set-default-zone=dmz

success[root@dmz ~]# firewall-cmd --add-service=http --zone=dmz --permanent                        //将防火墙的默认区域改为dmz区域success[root@dmz ~]# firewall-cmd --remove-service=ssh --zone=dmz --permanent                      //添加http服务到dmz区域永久设置中success[root@dmz ~]# firewall-cmd --add-icmp-block=echo-request  --zone=dmz --permanent                        //禁止使用ssh进行登录success[root@dmz ~]# firewall-cmd --reload                         //重载防火墙success

第五步:配置external区域的Internet测试机网卡和地址,并启动网站服务

1.先在联网状态下载安装httpd服务

[root@192 ~]# yum install httpd -y

2.绑定网卡为VMent1仅主机模式

3.配置并确认IP地址与网关

[root@192 ~]# ifconfigens33: flags=4163  mtu 1500        inet 100.1.1.20  netmask 255.255.255.0  broadcast 100.1.1.255        inet6 fe80::839c:1220:87fc:aef  prefixlen 64  scopeid 0x20        inet6 fe80::791b:db71:8a12:f34  prefixlen 64  scopeid 0x20        ether 00:0c:29:9e:f9:aa  txqueuelen 1000  (Ethernet)        RX packets 6587  bytes 4090863 (3.9 MiB)        RX errors 0  dropped 0  overruns 0  frame 0        TX packets 1266  bytes 105686 (103.2 KiB)        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0[root@192 ~]# route -nKernel IP routing tableDestination     Gateway         Genmask         Flags Metric Ref    Use Iface100.1.1.0       0.0.0.0         255.255.255.0   U     100    0        0 ens33

4.开启网站服务,并关闭防火墙与增强型安全功能

[root@192 ~]# vim /var/www/html/index.html[root@192 ~]# cat /var/www/html/index.html
this is external web
[root@192 ~]# systemctl stop firewalld.service [root@192 ~]# setenforce 0 

第六步:在网关服务器上配置防火墙策略

[root@192 ~]# firewall-cmd --set-default-zone=external              //将防火墙默认区域改为extemalsuccess[root@192 ~]# firewall-cmd --change-interface=ens36 --zone=trusted --permanent                      //将ens36网卡设为信任区域The interface is under control of NetworkManager, setting zone to 'trusted'.success[root@192 ~]# firewall-cmd --change-interface=ens37 --zone=dmz --permanent                      //将ens37网卡设为dmz区域The interface is under control of NetworkManager, setting zone to 'dmz'.success[root@192 ~]# firewall-cmd --zone=dmz --remove-service=ssh --permanent                      //dmz区域内禁止使用ssh登录success[root@192 ~]# firewall-cmd --zone=dmz --add-service=http --permanent                        //dmz区域内添加http服务success[root@192 ~]# firewall-cmd --zone=dmz --add-icmp-block=echo-request --permanent                     //dmz区域内阻塞icmp协议            success[root@192 ~]# firewall-cmd --zone=external --add-service=http --permanent                           //在外部区域添加http服务success[root@192 ~]# firewall-cmd --reload                     //重载防火墙success

第七步:使用企业内网测试机验证网站服务器和internel测试机提供的的网页

第八步:在网关网关服务器上配置端口转换

[root@192 ~]# firewall-cmd --zone=external --add-forward port=port=80:proto=tcp:toaddr=192.168.2.10 --permanent      //设定端口映射success[root@192 ~]# firewall-cmd --reload                     //重载防火墙 success

第九步:使用Internet测试机访问网站服务器提供的网页,可以看到源IP地址被转换(NAT)