云主机端口黑名单与白名单策略实现精细化访问控制

# CentOS 7默认使用firewalld，需先安装iptables-services
sudo yum install iptables-services -y
sudo systemctl stop firewalld
sudo systemctl disable firewalld
sudo systemctl enable iptables
sudo systemctl start iptables

# 添加规则：拦截IP 192.0.2.100的SSH访问
sudo iptables -A INPUT -p tcp --dport 22 -s 192.0.2.100 -j DROP

# 批量拦截多个IP（如从文件读取IP列表）
while read ip; do
  sudo iptables -A INPUT -p tcp --dport 22 -s "$ip" -j DROP
done < blacklist.txt  # blacklist.txt内容示例：192.0.2.100\n192.0.2.101

# 默认拒绝所有入站流量到3306
sudo iptables -A INPUT -p tcp --dport 3306 -j DROP

# 允许白名单IP（如192.168.1.100）访问
sudo iptables -I INPUT -p tcp --dport 3306 -s 192.168.1.100 -j ACCEPT

# 允许已建立的连接（避免中断现有会话）
sudo iptables -A INPUT -p tcp --dport 3306 -m state --state ESTABLISHED,RELATED -j ACCEPT

# CentOS 7
sudo service iptables save
# Ubuntu/Debian
sudo iptables-save > /etc/iptables/rules.v4

sudo iptables -L INPUT -v -n | grep 22  # 查看SSH端口规则
sudo iptables -L INPUT -v -n | grep 3306 # 查看MySQL端口规则

sudo apt update
sudo apt install nftables -y

# 创建黑名单集合
sudo nft add set inet filter blacklist_ips { type ipv4_addr\; flags dynamic\; }

# 添加恶意IP到集合（可动态更新）
sudo nft add element inet filter blacklist_ips \{ 192.0.2.100, 192.0.2.101 \}

# 创建规则：拦截黑名单IP访问80端口
sudo nft add rule inet filter INPUT tcp dport 80 ip saddr @blacklist_ips drop

# 创建白名单集合
sudo nft add set inet filter whitelist_ips { type ipv4_addr\; }

# 添加可信IP到集合
sudo nft add element inet filter whitelist_ips \{ 192.168.1.100, 192.168.1.101 \}

# 创建规则：仅允许白名单IP访问22端口
sudo nft add rule inet filter INPUT tcp dport 22 ip saddr ! @whitelist_ips drop
sudo nft add rule inet filter INPUT tcp dport 22 ip saddr @whitelist_ips accept

sudo nft list ruleset > /etc/nftables.conf

#!/bin/bash
# 示例：从文件读取新黑名单IP并更新iptables
BLACKLIST_FILE="/tmp/new_blacklist.txt"
while read ip; do
  if ! sudo iptables -L INPUT -v -n | grep -q "$ip"; then
    sudo iptables -I INPUT -p tcp --dport 22 -s "$ip" -j DROP
    echo "Blocked IP: $ip"
  fi
done < "$BLACKLIST_FILE"

# 安装Fail2Ban（以CentOS 7为例）
sudo yum install fail2ban -y

# 配置SSH监控（/etc/fail2ban/jail.local）
[sshd]
enabled = true
filter = sshd
action = iptables-multiport[name=SSH, port=22, protocol=tcp]
logpath = /var/log/secure
maxretry = 3  # 3次失败后封禁IP
bantime = 86400  # 封禁24小时