iptables本地设置个人查阅后的小得

灌水王

今天弄了好久的iptables，总算查到比较合适的资料。本人有台电脑，装了linux，生怕被黑客勒索，上回已经来个一次了，起码花费了我一周才修复，还有丢失了几个月的工作，实在是气愤了。所以想借助iptables的拦截看看是否有效。来源：https://www.digitalocean.com/community/tutorials/iptables-essentials-common-firewall-rules-and-commands#allowing-internal-network-to-access-external

主要的命令行如下：

Allowing Loopback Connections
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

Allowing Established and Related Incoming Connections
sudo iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

Allowing Established Outgoing Connections
sudo iptables -A OUTPUT -m conntrack --ctstate ESTABLISHED -j ACCEPT

Dropping Invalid Packets
sudo iptables -A INPUT -m conntrack --ctstate INVALID -j DROP

Allowing All Incoming SSH
sudo iptables -A INPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allowing Outgoing SSH
sudo iptables -A OUTPUT -p tcp --dport 22 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A INPUT -p tcp --sport 22 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allowing All Incoming HTTP
sudo iptables -A INPUT -p tcp --dport 80 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 80 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Allowing All Incoming HTTPS
sudo iptables -A INPUT -p tcp --dport 443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT
sudo iptables -A OUTPUT -p tcp --sport 443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Dropping Unwanted Traffic
sudo iptables -A INPUT -j DROP

灌水王

list all rules
sudo iptables -L --line-numbers

Delete a rule
sudo iptables -D INPUT <Number>

Save your changes
sudo -s iptables-save -c

SSH
https://kassadin.moe/2020/03/12/037-putty-default-settings-and-SSH-private-key-auth/
编辑sshd配置文件
echo "PubkeyAuthentication yes" >> "/etc/ssh/sshd_config"    #修改配置表
echo "PasswordAuthentication no" >> "/etc/ssh/sshd_config" # (optional)

ssh-keygen -t ed25519 -b 2048  -f /etc/ssh/id_ed25519
不用设置密码
一路回车，生成一对密钥id_ed25519 id_ed25519.pub
第一个是私钥，保存好，第二个公钥，给别人

mkdir -p ~/.ssh && touch ~/.ssh/authorized_keys 在远程电脑上创建文件，记录密钥

sudo chmod 700 ~/.ssh && sudo chmod 600 ~/.ssh/authorized_keys 改权限，不让别人看
把本地电脑的公钥写进去
cat /etc/ssh/id_ed25519.pub >> ~/.ssh/authorized_keys

设置开机启动
systemctl restart sshd 重启sshd服务
systemctl start sshd
systemctl enable sshd

开启ssh开机自动启动命令
sudo systemctl enable sshd
关闭ssh开机自动启动命令
sudo systemctl disable sshd
单次开启ssh
sudo systemctl start sshd
查看ssh是否启动，看到Active: active (running)即表示成功
sudo systemctl status ssh

puttygen /etc/ssh/id_ed25519  -o /etc/ssh/ed_putty
sudo chmod 777 /etc/ssh/ed_putty
下载私钥文件到本地电脑

putty验证方式选择密钥
Connetction ->> SSH ->> Auth
Private key file for authentication 选刚才转换好的ed_putty，保存一下
现在就可以“一键登录”远程主机了

灌水王

电脑在路由器后面，不在路由器设置端口转发或dmz，外面根本进不来

灌水王

一直用ubu桌面，都是默认值，也从来没有开启什么远程