實驗四網(wǎng)上安全技術(shù)防火墻

1、淮海工計算機(jī)-學(xué)院 匚程學(xué)院實驗報艮告二課程名：網(wǎng)絡(luò)安全技術(shù)題目：防火墻班級：學(xué)號：姓名：評語：成績：指導(dǎo)教師：0批閱時間：年月【實驗?zāi)康摹坷斫鈏p tables工作機(jī)理熟練掌握學(xué)會利用熟練掌握學(xué)會利用ip tables包過濾命令及規(guī)則ip tables對網(wǎng)絡(luò)事件進(jìn)行審計ip tables NAT工作原理及實現(xiàn)流程iptables+squid實現(xiàn) Web應(yīng)用代理【實驗人數(shù)】每組2人 合作方：韓云霄 2012122618【系統(tǒng)環(huán)境】Linux【網(wǎng)絡(luò)環(huán)境】交換網(wǎng)絡(luò)結(jié)構(gòu)【實驗工具】ip tablesNma pUlogd【實驗步驟】一、ip tables 包過濾本任務(wù)主機(jī) A、B為一組，C D為一組，

2、E、F為一組。首先使用“快照 X”恢復(fù)Linux系統(tǒng)環(huán)境。操作概述：為了應(yīng)用ip tables的包過濾功能，首先我們將filter鏈表的所有鏈規(guī)則清空,并設(shè)置鏈表默認(rèn)策略為DROP禁止)。通過向INPUT規(guī)則鏈插入新規(guī)則，依次允許同組主機(jī)iemp回顯請求、Web請求，最后開放信任接口 ethOiptables操作期間需同組主機(jī)進(jìn)行操作 驗證。文件(E)編輯型 查看 終端 標(biāo)簽趣 萍戲 jmt 斬鄧？UC port scan? jr(i.b1 es -t filter -F bmt 野;sphi 匚 port scan? i Icnr, ligcihO.ink cncQp:EJicruet HA

3、nedr OOiOC:29:77:BC:0EI not a(ljr:172, Itl. 0. 20 Bta ITZ. Itk 0. 133 :BO S 111=44 Ld=Z2jOC ip -44seq=332t)359tj2l vLi= 1024 Crrvis 11 aowendto TH send i ppacket ; send t (packet* 44 0, 172* Jti, 0, o3, 115) = Opeynt I cn not p?rini ttedDffondins 卩arkot ; T匸卩 172. 16,0. 20;fil303 IP, W* +6；J;53 S tt

4、l-5!? td-2lK3 iplcn 二M S3q=332ti359t2l vin-lOSe 172.0.(53 :25t5 S tt1-|0ill seq=332ti3.59ti2l vin-1021 un 5ciid_ip_packct: scud t；? (5, parkot, -J4, 0, 172, Iti. 0. ti3, 1(5) not pormiLtedOrfQftdiug packci: TCP 172, 16. 0.20:61303 172. Itk 0. & :21 S 111=19 Ld=55791 iplen =4J soq332ti359ti2J vin2018

5、 mss 11(50o；idio LU send_ip_packci: scud !：?(, piickot, -J J, 0, 172. Id. 0. dJ, Iti) ivjL jjrmLL ledOlTendlng packet: TC 172. le. 0. 20:01303 ? 172. Id. 0.5 111 = 32li-J 1 淀w-前聖旳:i勺悅4111-1021 viiss lW(biuziilLu ill iinLd_ ip_piiLkul: atii J t j (j, piiLkt? L, 44, 0, 172x IG. 0. ij3, 1G) no L permit

6、tedOifcridiiig ptickcL； IC 172. 16.0. 20161303 z IE. tk & :E3t5 5 til-5611= J 1sc?q-3326J59t5iJ J v iii= 1U2 1 Operaticnid-1571J iplc= OpeFa L i ciinPfpTding parlfRr : T卩 172, Iti. fl. 2D:in13f33 172. IH, n. :25 S ttl=n if1=3 1997 ir 1 pii -44seq=332l3359624 vLn-409t Cmss 1460send to in Eeiid ip pac

7、ket: send to (5, 口 acket* 44* 0, 172. 1(3. 0. 63, lt3jiQt permittedDffendins packet : TCP 172. Id, 0, 20:61303 173, Id. 0. ej：443 5 tt = a2 n=443eq=332fiJS9e24 win=l034 IT盤 I 譏 Lh 左：.1 Id S ltl=.i7n=l IV1T1=ZOIS1 lflO=/ Operat i on= 0卩erati.oni d=4U07y ipleping： PLUS： nine： ptng： pinysen n in SR: SC

8、tldlTlfig： seticliTiSt: seridnisfi: sondmsR：uprint 1 cn Opcrtil i oil Opt LiLioii Operat i on flprrnt i nnHOT pcrmi TTCCI RO L pcrmiiloi noL perniL Lied, not permilied not permi1 ted172. ItJ. 0- 63 ping slatLsL its -42 pEickets t ran ETUI t Led, 0 receiItXJ 片 p ljc ke I ss, t ime 4 ltJ02rns(5)利用功能擴(kuò)展

9、命令選項 (ICMP)設(shè)置防火墻僅允許ICMP回顯請求及回顯應(yīng)答。ICMP回顯請求類型8 ;代碼0 。ICMP回顯應(yīng)答類型0 ；代碼0 。ip tables 命令ip tables -I input -p icm p icm p-type 8 /0 -j ACCEPTip tables -I OUTPUT -p iemp iem p-type 0/ 0 -j ACCE PT利用ping指令測試本機(jī)與同組主機(jī)的連通性。.roo LeExpNl C port sc an ff ip l Eibl ea -1 IK 卩 UT -p temp -Lcmp- type S/0 - j ACCEPT .r

10、oo LEjxpNl C port sc an Tt ip L Eihl es -1 OL 1PLT -p i emp -iemp- type U/U -j ACCLPT .roo LExpNl C port sc an ping 172. Id. 0. dJPING 172. 1(5. 0.(33 (172. 1(3. 0. t3) 5(3(84) bytes ! data, ping: sen dross： piHR：呂endm宙B： piHR： sendmR： ping: ping: pi HR： ping: 】J i ng: ：i iig:sendniF；B； sendmg: scnd

11、mg: sendmsg: scndrnsg: sendmsg:Operat i on Op erat i fn Operat i on Dperat i on 0卩erat i on 0卩erat i on 0卩era t i on 0卩oration 0卩c】at I onnot not not not not not not not notp errni tted 卩ermi tted perni tted perini tted 卩erni tted Perini tted permi tted peiini tted peTiTii tted(6)對外開放 Web服務(wù)(默認(rèn)端口 80/

12、tcp)。ip tables 命令iptables -I INPUT -p tcp -dport 80 -j ACCE PTiptables -I OUT PUT -p tcp -sport 80 -j ACCE PT同組主機(jī)利用nmap對當(dāng)前主機(jī)進(jìn)行端口掃描，查看掃描結(jié)果。root.(3Lxpll C por 1.scanTt iirriEip -e -T5 172. Id. 63SLtiirt 1 ng Nirtip 1 20 ( http:inscfUTe. org ) (i.t 2015-01-15 10:35 CST IiLL.erosL Ltig pur Ls uii 172- I

13、d. 0. C3 :NoL showii r 1092 c I osed portsSERVICEftplolnolhL Lprpebindhttps00:0C:29：eA:B5:F (Vilvaro)IFNT 21/tcp 23/lcp St)/Lt?p1 I 1/t cp 13/1 cpSTAT: open opon open epen openMAC Address:Nina卩 finished; I IP addrepf； ( I best up) fictinned in 0. 159 seconds moWE耳卩:MC|.r-ootifEspMC portscan iptables

14、 T 1PLT -p tup -dport HO -j ACCEPT .rgtOEspHlC port scan. iptables -1 OUTPUT -p ttp sport 80 -j ACCEPT .r-uutEjijjMC I Scan苻 tiiimp -;iS -T5 172. 1lICL&3Staiting Nmap 4* 20 ( http; V insecure* org ) at 201.5-0 |-15 10; 27 CST,Eeiidto in send fp 卩日 ckei： sondto(氐 p ackot, H, 0, 172】fi”(Ke 仏 Ifi)=Oper

15、al i on tbJl 卩 e I Tn i tiedOffondins 卩 acxot: TCP 172. IEilO, 20: 5O5O 172 1&0 飛 3:22 S tl1=43 i d-6.5399 iplon =11 就硏昨洶曲0 wirrlO刖 172. 1(5. 0. 63:3389 S ttl-17 on= J1 soq= (590630850 ifLif 109(5 (5, piickoi, 11, 0, 172. lb. 0.63, 16)ntil purmLiLcdpacket: TCP 172. 16.0. 20:15060 172. 16. 0. 63H13 I

16、L1=5511-4Jseq=69t?t330850 viz09廿 Ciiiss 1160iselid tj illiE?_E)acke1: 5elidLo(5, packeI, Il, 0, 172. 16. 0. 63, 16)110 L permL L tedfiend iiiK packet: TCP 172. Itj. U. 20:45060 172. 16. 0. 63:3S9 S t L1=S9 n=44 seq-l3i9dD30B50 win=Ui9d send to in send ip packet: sendtoCS, packet, 44, 0, 172. 1(3.0.

17、GJ, IB)not peiTTii 1 ledDpcraxionid-3SC81 I pl= Opera lionip io1(1=戈351 ip Im二Operat i onOffend fns 卩 acxot: TCP 172.10.20:150650、172. IG. 0. 6?: 21 S tt 1 = 57 i dSJ 19& ip Iw =44 昶q=l5沁6J0E50 win=20l8 ,seiidto ill senid_ip_packet: send to (5. p ackot, 4-1, 0. 172.0. ci3, 15)nfit pei-mi itelOffQiid

18、ins pacxot: TCP 172. Ifi，. fl. ：O： 5060、172. 16. 0. 63 : 113 S lt1 一3S =1!IF 111=3072 172. 1(5. 0, d2:55J S Hl-311J seq=iti90630850 Tiii=3072 send to in seiid_fp _p ackot i sonclto(5, pac koi, 1 J, 0、 172. 16. 0. 63,ntil permittedOrfoiidiiig packol: TCP 172. Id. 0. 20: 5060172. 16. 0. 62:23 S til4 J

19、 Stq=69tj630850 111=2048 5曲 1 Ji30a end to ill send_ip_packel: 5uiidlt)(5, piic t o l, II, 0, 172. 16. 0. 63,liti I pellnL t Led= Dperali nq d-fll 2 i p 1 on= Dperali oniid-S5O ploR-= OperaTion5 Ld-3079 I pl ell-16) = Operatio：!OricndliiS packet: TCP 172. 16.0. 20:15060 172. 16. 0. 6? 15J Lll=6 id5J

20、rSd iplczi -44 secFty6t3JDK50 *i:i=3072 send to in seiud ip packe I: send to(5, packet, 44, 0, 172. 16. 0. 63, IB) - Operat i on nciI peiTTiitted(7)設(shè)置防火墻允許來自ethO(假設(shè)ethO為內(nèi)部網(wǎng)絡(luò)接口)的任何數(shù)據(jù)通過。ip tables 命令ip tables -A INPUT -i eth0 -j ACCE PTiptables -A OUT PUT -o ethO -j ACCE PT同組主機(jī)利用STATE open op on open o

21、poilpollpm21/tcp23/tcp8t)/tcplJ3/LtpMAC Address:nmap對當(dāng)前主機(jī)進(jìn)行端口掃描，查看掃描結(jié)果。SERVLCKftptai nethttprpcbLiiJH L. LpS00:0：29:開：卩9 (VMware)Nmn卩 finished: I TP id(lress Cl host up) scfinned fn 0. spconds一.事件審計實驗操作概述：利用ip tables的日志功能檢測、記錄網(wǎng)絡(luò)端口掃描事件，日志路徑/var/log/iptables.log。(1) 清空filter表所有規(guī)則鏈規(guī)則。ip tables 命令(2) 根據(jù)

22、實驗原理(TCP擴(kuò)展)設(shè)計ip tables包過濾規(guī)則，并應(yīng)用日志生成工具ULOG對ip tables捕獲的網(wǎng)絡(luò)事件進(jìn)行響應(yīng)。ip tables 命令交件 編輯 查看終端標(biāo)篡舊幫取.run LE?ipNTC j.ir Lst(iii 1tiibl us FI rootExpNIC i3rtscaiifl iplabloi T 9卩UT -p t：-p = ag A【丄 SYN -J ULOGulog -proTlx *SY RoquesLBud cirauinont SYN Riqucsl/Try ：p idblcs TT or ip lablos -holi 172. Iti. 0. 63:

23、443 S ltl-4d =41 seq=2yyiy7ti34J Ln-3U72 seiidto Ln send ip p acket: send to (5, pac tcel, 44, 0.1?2. IB* th Id)not peiTiii t ted- Orerat.innid=3 2S54 L pl Ell= 叩era t i onOffend iTiR 卩 ack&t： JCP 172, la 0. 2C： 563 75 172. 16, 0, i53：25 S tt=52 i fl= 1 I 903 ip：en 14 spfFZA9197tS34； v 111=1024 5點只

24、MtSGPiidlo in ppiid ip picket: st?ntlto(3,卩acket, 4-1, n, 72. IS. 0, Iti) not permitted()t rending 卩 acket: I CH 172. 1 也山 ZU:防;汀仃；H監(jiān)血 Ci曲13 S ttl-15Opcro t ion=J J sc?q=299197C3 JJ T1=2)-Jfi sciidto u 3cii 172, liiJD. (13：32 S 1 t1- I 1 id3R525 inlm戶 U 蟲0=299197迢win20J8 Operation not peiinl l Ledor

25、ielidlliE packet： TCP 172. Id. U. 20：5tflJT5 ? 1T2. Id. 0. e3：22 S ill-IT Lcl=丄朋91 Ipleti 44 seq=29y U v ii= 1096 1 了盅 IH. D.閃沼 0 S tt=44 id=ll60 ip；en= H secfZM】前閃-門 wii=1024 f；eiidto ill 后起 rid= ip packet; sendtf(5,卩 acket. 44, U. J7 簽 1庁+山(i仏 Iti)=Op erat loh not 卩ei mi i leUOffend ins 卩 ocket: T

26、CP 172. Hi fl. 20：.5627.5 】了2 I氏乩 閃汩凹 S ttl=39 id=abl51 iplen =1 I scq-299I97d3-3 *5二IE自 5s：s 1 I帥、seiidto in send id packet: sond；f(5* packet- 1 J. 0. 172. Io* 0. Iti) not 卩ermittQdOffending packet: IC? 172. 16. 0. 20:5d3?5 172. le. 0. 3:3339 S ttlSl11 J J 0滬藝viR J09ti -mss 13 60；-suiid LU Ln SLnid

27、_ Lp_puckeL; suiitipdcke L, M, 0. 1. 1(3. 0. G3 Id)not peiiiii L Led01 lend ilia packet: TCP 172. Id. 0. 20:5d375 172. 16. 0. t53:63cS S LtlUO Ml seq-29919763-lJviti=10215注 116Oseidto 111 seiid_ ip_packet: send to (5, pic ke L, 44, U, IT 龍 Itk 0.(53, Id) not penni t LedOffend i 11K packet: ICP 172.

28、U. MU:甜骯估 172. Id. tJ.S ttl=4U-4 J197034 J wltR1024 =Operat ionicl=3O87J iplc- OlJeiilL Glid-oOSOl (plen= OperaLiotiid=tiDyVy iplenip tables日志，對端口掃描事件進(jìn)行（4）在同組主機(jī)端口掃描完成后，當(dāng)前主機(jī)查看 審計，日志內(nèi)容如圖所示。二.狀態(tài)檢測實驗操作概述：分別對新建和已建的網(wǎng)絡(luò)會話進(jìn)行狀態(tài)檢測。 1對新建的網(wǎng)絡(luò)會話進(jìn)行狀態(tài)檢測（1）清空filter規(guī)則鏈全部內(nèi)容。ip tables 命令（2）設(shè)置全部鏈表默認(rèn)規(guī)則為允許。ip tables 命令（3）設(shè)

29、置規(guī)則禁止任何新建連接通過。ip tables 命令.Toot0t?cpKlC 卩ort TnotKspM C JDOtEjpKT C JPCH毗卞 MIC ruoLL?;pKlC TootLspkl C-P-P-P-P-Ai P t ab 1 e S i mail I es iptahlPS ijitibles iplables”:S C ail tfportscaiilffport sc ail ffUortsciiLilffport sc aLi J(4)同組主機(jī)對當(dāng)前主機(jī)防火墻規(guī)則進(jìn)行測試，驗證規(guī)則正確性。 itoteJ：KpMC ptriscEiiilffroclStKpMCFjrf

30、Ol：0EX 卩 KI Crfot(ripMC i(ot0tJ：3；pM 匚port sc LILI.port sc ail It pfrt5：cai 存 pnrtscair portstEJii. poriscEiii.ffipLtiblfis i口tables iptables iptnblcs iptablcs nniihp - sS-P-P-PI MUT A住卩TFORAARD ACCEPTOLTPUiT JCCEPTINPUT -m state slate MEN -j DROPINPUT ACCEPTKDRAAKl) ACCh：PTOtTPLlT ACCriTINPUT -rn s

31、iaio -staito MEO = j DROP=15 172, LtJ- 0. t33StEirt ing Nr膽卩 4. 20 ( http;/ insecure, org ) at. 2015-04-JS 1 1:-J I C5TAl 1 1(197 scanned fiwts: on 172. 10. 0. ti3 arc f i I teredMAC Address: 00:0匚：29:竹此：兩：F9 (VSIviLVo)NmEip fiuiLshed: 1 IP addreijs (1 hus I up) sc 社 rnieid i li IX. 7冒 2 s&coiLds rn

32、ot(3K3tpM C pnrtjcaii fF |2.對已建的網(wǎng)絡(luò)會話進(jìn)行狀態(tài)檢測（1）清空filter規(guī)則鏈全部內(nèi)容，并設(shè)置默認(rèn)規(guī)則為允許。當(dāng)出現(xiàn)“l(fā)ogin: ”界面時，暫停登錄操作。（2）同組主機(jī)首先telnet遠(yuǎn)程登錄當(dāng)前主機(jī)，telnet登錄命令rooltJipMCroolHspNIC ,rcolE?tpM C roo LEKt?MC IOQ LEjipMCport scan, port scan, port scan, port sc dll por tscdiL.iptabLes iptabi afi ipt話blcs ipL逗bLoLeieiiL 172* Id. 0. 63

33、-p-p-pINPUT ACCLPT FflRKNRD ACCEPT OUTPUT ACCEPT甲？h ; lie I eii t: cninnwnd not found .rootE?tpNTC poTt.,sca.ii tcliict 172. It5. 0. (53 ryhig 172. Id. 0.鬧.outiec Led to 172. 16. U. t53Iti. 0. tiJ).f h :ira 匚 te丁 i 5*riTP release 竹(Io7de(iux)2. b. 15=1. 205 J rC5 oil m LfiSd:寓capeedoratOlLlol（3）ip t

34、ables添加新規(guī)則（狀態(tài)檢測）一一僅禁止新建網(wǎng)絡(luò)會話請求。ip tables 命令或guest ” 及口令同組主機(jī)續(xù)步驟（2）繼續(xù)執(zhí)行登錄操作，嘗試輸入登錄用戶名“ guestpass”，登錄是否成功？jOotSExpNlC:C rootExpNT C roo I 他 ExpNl C roo LKiphil Cport scan, poitscaiv porLsctitv iJurLscair port scan.iptabies -H fptnbles -卩 rplablcs -卩LpLtibiea -卩r?JPIT ACCEl FORMRD MOTT OUTIW ACtkPTtel ne

35、t 7Z, Jd, 0. ti3TryinR 1 了瓷1仏(X冇罠Coniipctc*d to 172.0. 63 C172. IS. 0. d3).EscapeFedoraKernel login: _ Pai5S 申 urd: piiestSEspNIC $ Icliu.ra.cLei- LiS J .Core- red ease 5 CBordeaii)2*15-L 2051 FC5 on an iH曲gugl同組主機(jī)啟動Web瀏覽器訪問當(dāng)前主機(jī) Web服務(wù)，訪問是否成功? 上述現(xiàn)象。解釋丈fT()SB ?172.1fc.t.bJ/IT 門注和丿ru Rifciz P2*口 F*dgj 加p 狗陽.J 匚wwMuriifv Su(t|“Fp|-tora C(ir+ 5Hai 從糾胡葉御T 口2一Hi血備 的服網(wǎng)圧阿訓(xùn)：口 ittri至Kkt不可屮毀舍丈rt出Hta世*也5任壬法裁入住史肖諳iSS妁1蠱雜勺FT塑連按- 應(yīng)和十Bt酢粧.優(yōu)第睨卿E気尉冋護(hù)，閒tu Fire* 就祝為問網(wǎng)（4）刪除步驟ip tables 命令或中添加的規(guī)則。(5) 同組主機(jī)重新tel net遠(yuǎn)程登錄當(dāng)前主機(jī)，當(dāng)出現(xiàn)“l(fā)ogi n: ”界面時，暫停登錄操作。Trying 172. 16. 0. S3.Cuiui?c Led Lo IT匕 IF. 0.