debian8でICMPをDROPする

  • 投稿者:
  • 投稿カテゴリー:debian

一時的

root@hostname:/home/shimizu# iptables -A INPUT -p icmp -j DROP
root@hostname:/home/shimizu# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       icmp --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

### Firewall情報をすべて消去する ###
root@hostname:/home/shimizu# iptables -F

root@hostname:/home/shimizu# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination

恒久的

iptables-persistentを利用する
debian8から/etc/init.d/ではなく、netfilter-persistentコマンドで制御するため注意

root@hostname:/home/shimizu# aptitude install iptables-persistent
以下の新規パッケージがインストールされます:
  iptables-persistent netfilter-persistent{a}
...

root@hostname:/home/shimizu# cat /etc/iptables/rules.v4
*filter
-A INPUT -p icmp -j DROP
COMMIT

root@hostname:/home/shimizu# netfilter-persistent reload
run-parts: executing /usr/share/netfilter-persistent/plugins.d/15-ip4tables start
run-parts: executing /usr/share/netfilter-persistent/plugins.d/25-ip6tables start
root@hostname:/home/shimizu# iptables -L
Chain INPUT (policy ACCEPT)
target     prot opt source               destination
DROP       icmp --  anywhere             anywhere

Chain FORWARD (policy DROP)
target     prot opt source               destination

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination