{"id":11530,"date":"2026-09-17T09:00:00","date_gmt":"2026-09-17T09:00:00","guid":{"rendered":"https:\/\/otus.ru\/journal\/?p=11530"},"modified":"2026-09-25T15:47:14","modified_gmt":"2026-09-25T15:47:14","slug":"polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux","status":"publish","type":"post","link":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/","title":{"rendered":"iptables \u0432 Linux: \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0430\u0432\u0438\u043b \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 firewall"},"content":{"rendered":"<p><strong>iptables<\/strong> &#8212; \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 NAT, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 Netfilter \u0432 \u044f\u0434\u0440\u0435 Linux. \u041f\u0440\u0430\u0432\u0438\u043b\u043e \u0437\u0430\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u044f\u0434\u0440\u043e \u0441\u0434\u0435\u043b\u0430\u0435\u0442 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u043c: \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u0442\u044c, \u043e\u0442\u0431\u0440\u043e\u0441\u0438\u0442\u044c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c. Netfilter \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0432 \u044f\u0434\u0440\u043e \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 2.4 (2001 \u0433\u043e\u0434), \u043d\u043e \u0441\u0430\u043c \u043f\u0430\u043a\u0435\u0442 iptables \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0438 \u043c\u043e\u0436\u0435\u0442 \u043d\u0435 \u0432\u0445\u043e\u0434\u0438\u0442\u044c \u0432 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 &#8212; \u043f\u0435\u0440\u0435\u0434 \u0440\u0430\u0431\u043e\u0442\u043e\u0439 \u043f\u0440\u043e\u0432\u0435\u0440\u044c\u0442\u0435 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0438 backend: <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables --version<\/code>. \u0414\u043b\u044f \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u0432\u0438\u043b \u043d\u0443\u0436\u043d\u044b \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 &#8212; \u043e\u0431\u044b\u0447\u043d\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">sudo<\/code>; \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430 \u044d\u0442\u043e \u0441\u0432\u044f\u0437\u0430\u043d\u043e \u0441 capability CAP_NET_ADMIN.<\/p>\n<div class=\"oj-toc\" style=\"background:#f6f6f6;border-radius:8px;padding:14px 20px;margin:20px 0\">\n<p><strong>\u0421\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435<\/strong><\/p>\n<ol>\n<li><a href=\"#s1\">\u041a\u0430\u043a iptables \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442: \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0438<\/a><\/li>\n<li><a href=\"#s2\">\u0418\u0437 \u0447\u0435\u0433\u043e \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u043e<\/a><\/li>\n<li><a href=\"#s3\">\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 firewall \u0441 \u043d\u0443\u043b\u044f: \u043f\u043e\u0448\u0430\u0433\u043e\u0432\u043e<\/a><\/li>\n<li><a href=\"#s4\">NAT: \u043f\u0440\u043e\u0431\u0440\u043e\u0441 \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u043c\u0430\u0441\u043a\u0430\u0440\u0430\u0434\u0438\u043d\u0433<\/a><\/li>\n<li><a href=\"#s5\">\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f (targets)<\/a><\/li>\n<li><a href=\"#s6\">IPv6 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 backend<\/a><\/li>\n<li><a href=\"#s7\">\u041a\u0430\u043a \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430<\/a><\/li>\n<li><a href=\"#s8\">nftables \u043a\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u0430\u044f \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u0430<\/a><\/li>\n<li><a href=\"#s9\">\u0413\u0434\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f iptables \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435<\/a><\/li>\n<li><a href=\"#s10\">FAQ<\/a><\/li>\n<li><a href=\"#s11\">\u0412\u044b\u0432\u043e\u0434\u044b<\/a><\/li>\n<\/ol>\n<\/div>\n<p>\u041d\u0438\u0436\u0435 \u0440\u0430\u0437\u0431\u0435\u0440\u0443, \u043a\u0430\u043a iptables \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442 (\u0442\u0430\u0431\u043b\u0438\u0446\u044b \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0438), \u0438\u0437 \u0447\u0435\u0433\u043e \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u0438 \u0441\u043e\u0431\u0435\u0440\u0443 \u0441 \u043d\u0443\u043b\u044f \u0440\u0430\u0431\u043e\u0447\u0438\u0439 firewall \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430: \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043d\u0443\u0436\u043d\u044b\u0445 \u043f\u043e\u0440\u0442\u043e\u0432, NAT \u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b. \u0412 \u043a\u043e\u043d\u0446\u0435 &#8212; \u043a\u043e\u0433\u0434\u0430 \u0432\u043c\u0435\u0441\u0442\u043e iptables \u0441\u0442\u043e\u0438\u0442 \u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u043d\u0430 nftables.<\/p>\n<h2 id=\"s1\">\u041a\u0430\u043a iptables \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442: \u0442\u0430\u0431\u043b\u0438\u0446\u044b \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0438<\/h2>\n<p>\u041a\u0430\u0436\u0434\u044b\u0439 \u043f\u0430\u043a\u0435\u0442, \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 \u0441\u0438\u0441\u0442\u0435\u043c\u0443, \u043f\u043e\u043f\u0430\u0434\u0430\u0435\u0442 \u0432 \u043d\u0430\u0431\u043e\u0440 \u043f\u0440\u0430\u0432\u0438\u043b. \u042d\u0442\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0441\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432 <strong>\u0446\u0435\u043f\u043e\u0447\u043a\u0438<\/strong> (chains), \u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 &#8212; \u0432 <strong>\u0442\u0430\u0431\u043b\u0438\u0446\u044b<\/strong> (tables). \u0422\u0430\u0431\u043b\u0438\u0446\u0430 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0435\u0442, \u0437\u0430\u0447\u0435\u043c \u043e\u0431\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u0442\u0440\u0430\u0444\u0438\u043a, \u0430 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 &#8212; \u043d\u0430 \u043a\u0430\u043a\u043e\u043c \u044d\u0442\u0430\u043f\u0435 \u043f\u0443\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430 \u044d\u0442\u043e \u043f\u0440\u043e\u0438\u0441\u0445\u043e\u0434\u0438\u0442.<\/p>\n<p>\u041f\u044f\u0442\u044c \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0445 \u0446\u0435\u043f\u043e\u0447\u0435\u043a \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0442 \u0442\u043e\u0447\u043a\u0430\u043c \u043d\u0430 \u043f\u0443\u0442\u0438 \u043f\u0430\u043a\u0435\u0442\u0430:<\/p>\n<ul>\n<li><strong>INPUT<\/strong> &#8212; \u043f\u0430\u043a\u0435\u0442\u044b, \u0430\u0434\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0430\u043c\u043e\u043c\u0443 \u0445\u043e\u0441\u0442\u0443 (\u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 SSH, HTTP, ping \u043a \u0441\u0435\u0440\u0432\u0435\u0440\u0443);<\/li>\n<li><strong>OUTPUT<\/strong> &#8212; \u043f\u0430\u043a\u0435\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0445\u043e\u0441\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0441\u0430\u043c (\u0437\u0430\u043f\u0440\u043e\u0441 \u043a \u0432\u043d\u0435\u0448\u043d\u0435\u043c\u0443 API, \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f);<\/li>\n<li><strong>FORWARD<\/strong> &#8212; \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a, \u0438\u0434\u0443\u0449\u0438\u0439 \u0447\u0435\u0440\u0435\u0437 \u0445\u043e\u0441\u0442, \u043d\u043e \u043d\u0435 \u0435\u043c\u0443 (\u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e, \u043a\u043e\u0433\u0434\u0430 \u043c\u0430\u0448\u0438\u043d\u0430 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043a\u0430\u043a \u0440\u043e\u0443\u0442\u0435\u0440 \u0438\u043b\u0438 NAT-\u0448\u043b\u044e\u0437);<\/li>\n<li><strong>PREROUTING<\/strong> &#8212; \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u0434\u043e \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438, \u0434\u043e \u0442\u043e\u0433\u043e \u043a\u0430\u043a \u044f\u0434\u0440\u043e \u0440\u0435\u0448\u0438\u043b\u043e, \u043a\u0443\u0434\u0430 \u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442;<\/li>\n<li><strong>POSTROUTING<\/strong> &#8212; \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0430 \u043f\u043e\u0441\u043b\u0435 \u043c\u0430\u0440\u0448\u0440\u0443\u0442\u0438\u0437\u0430\u0446\u0438\u0438, \u043f\u0435\u0440\u0435\u0434 \u0432\u044b\u0445\u043e\u0434\u043e\u043c \u043f\u0430\u043a\u0435\u0442\u0430 \u0438\u0437 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430.<\/li>\n<\/ul>\n<p>\u0422\u0430\u0431\u043b\u0438\u0446 \u0442\u043e\u0436\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e, \u0438 \u0432 \u043a\u0430\u0436\u0434\u043e\u0439 \u0435\u0441\u0442\u044c \u0442\u043e\u043b\u044c\u043a\u043e \u0447\u0430\u0441\u0442\u044c \u0446\u0435\u043f\u043e\u0447\u0435\u043a:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u0422\u0430\u0431\u043b\u0438\u0446\u0430<\/th>\n<th>\u0417\u0430\u0447\u0435\u043c<\/th>\n<th>\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">filter<\/code><\/td>\n<td>\u0424\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044f: \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u0442\u044c, \u043e\u0442\u043a\u043b\u043e\u043d\u0438\u0442\u044c \u0438\u043b\u0438 \u043e\u0442\u0431\u0440\u043e\u0441\u0438\u0442\u044c (\u0442\u0430\u0431\u043b\u0438\u0446\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e)<\/td>\n<td>INPUT, OUTPUT, FORWARD<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nat<\/code><\/td>\n<td>\u0422\u0440\u0430\u043d\u0441\u043b\u044f\u0446\u0438\u044f \u0430\u0434\u0440\u0435\u0441\u043e\u0432: \u043f\u0440\u043e\u0431\u0440\u043e\u0441 \u043f\u043e\u0440\u0442\u043e\u0432, \u043c\u0430\u0441\u043a\u0430\u0440\u0430\u0434\u0438\u043d\u0433<\/td>\n<td>PREROUTING, INPUT, OUTPUT, POSTROUTING<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">mangle<\/code><\/td>\n<td>\u041f\u0440\u0430\u0432\u043a\u0430 \u0437\u0430\u0433\u043e\u043b\u043e\u0432\u043a\u043e\u0432 \u043f\u0430\u043a\u0435\u0442\u0430, \u043c\u0430\u0440\u043a\u0438\u0440\u043e\u0432\u043a\u0430 \u0438 \u043a\u043b\u0430\u0441\u0441\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044f \u0442\u0440\u0430\u0444\u0438\u043a\u0430 (\u043c\u0435\u0442\u043a\u0438 \u0434\u043b\u044f policy routing; \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u043e\u0447\u0435\u0440\u0435\u0434\u044f\u043c\u0438 \u0438 \u043f\u043e\u043b\u043e\u0441\u043e\u0439 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">tc<\/code> \u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">qdisc<\/code>)<\/td>\n<td>\u0432\u0441\u0435 \u043f\u044f\u0442\u044c<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">raw<\/code><\/td>\n<td>\u041e\u0442\u043c\u0435\u0442\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442\u044b \u0434\u043e \u0442\u0440\u0435\u043a\u0438\u043d\u0433\u0430 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (NOTRACK)<\/td>\n<td>PREROUTING, OUTPUT<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u0415\u0441\u043b\u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u0443 \u043d\u0435 \u0443\u043a\u0430\u0437\u0430\u0442\u044c \u044f\u0432\u043d\u043e \u043a\u043b\u044e\u0447\u043e\u043c <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-t<\/code>, iptables \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">filter<\/code>. \u0414\u043b\u044f \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 firewall \u0445\u0432\u0430\u0442\u0430\u0435\u0442 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">filter<\/code> (\u0447\u0442\u043e \u043f\u0443\u0441\u043a\u0430\u0442\u044c) \u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nat<\/code> (\u043f\u0440\u043e\u0431\u0440\u043e\u0441 \u0438 \u043c\u0430\u0441\u043a\u0430\u0440\u0430\u0434\u0438\u043d\u0433); <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">mangle<\/code> \u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">raw<\/code> \u043d\u0443\u0436\u043d\u044b \u0432 \u0441\u043f\u0435\u0446\u0438\u0444\u0438\u0447\u043d\u044b\u0445 \u0437\u0430\u0434\u0430\u0447\u0430\u0445. \u0423 \u0442\u0430\u0431\u043b\u0438\u0446\u044b <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nat<\/code> \u0447\u0435\u0442\u044b\u0440\u0435 \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u044b\u0435 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 &#8212; PREROUTING, INPUT, OUTPUT \u0438 POSTROUTING; \u0446\u0435\u043f\u043e\u0447\u043a\u0430 nat\/INPUT \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043a \u043f\u0430\u043a\u0435\u0442\u0430\u043c, \u0430\u0434\u0440\u0435\u0441\u043e\u0432\u0430\u043d\u043d\u044b\u043c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0443\u0437\u043b\u0443.<\/p>\n<p>\u0412\u043d\u0443\u0442\u0440\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u044e\u0442\u0441\u044f <strong>\u0441\u0432\u0435\u0440\u0445\u0443 \u0432\u043d\u0438\u0437, \u0438 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043f\u0435\u0440\u0432\u043e\u0435 \u043f\u043e\u0434\u043e\u0448\u0435\u0434\u0448\u0435\u0435<\/strong> &#8212; \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u044b\u0435 \u0434\u043b\u044f \u044d\u0442\u043e\u0433\u043e \u043f\u0430\u043a\u0435\u0442\u0430 \u0443\u0436\u0435 \u043d\u0435 \u0441\u043c\u043e\u0442\u0440\u044f\u0442\u0441\u044f. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0440\u044f\u0434\u043e\u043a \u043f\u0440\u0430\u0432\u0438\u043b \u0432\u0430\u0436\u0435\u043d \u043d\u0435 \u043c\u0435\u043d\u044c\u0448\u0435, \u0447\u0435\u043c \u0438\u0445 \u0441\u043e\u0434\u0435\u0440\u0436\u0430\u043d\u0438\u0435.<\/p>\n<h2 id=\"s2\">\u0418\u0437 \u0447\u0435\u0433\u043e \u0441\u043e\u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u043e<\/h2>\n<p>\u041f\u0440\u0430\u0432\u0438\u043b\u043e &#8212; \u044d\u0442\u043e \u0443\u0441\u043b\u043e\u0432\u0438\u0435 \u043f\u043b\u044e\u0441 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435. \u042f\u0434\u0440\u043e \u0441\u0432\u0435\u0440\u044f\u0435\u0442 \u043f\u0430\u043a\u0435\u0442 \u0441 \u0443\u0441\u043b\u043e\u0432\u0438\u0435\u043c, \u0438 \u0435\u0441\u043b\u0438 \u0441\u043e\u0432\u043f\u0430\u043b\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0435 (target).<\/p>\n<table>\n<thead>\n<tr>\n<th>\u0427\u0430\u0441\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430<\/th>\n<th>\u0417\u0430 \u0447\u0442\u043e \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442<\/th>\n<th>\u041f\u0440\u0438\u043c\u0435\u0440\u044b<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u041a\u0440\u0438\u0442\u0435\u0440\u0438\u0439 (\u0443\u0441\u043b\u043e\u0432\u0438\u0435)<\/td>\n<td>\u041f\u043e \u043a\u0430\u043a\u0438\u043c \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u0430\u043c \u043e\u043f\u043e\u0437\u043d\u0430\u0442\u044c \u043f\u0430\u043a\u0435\u0442<\/td>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-p tcp<\/code>, <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-s 192.168.1.10<\/code>, <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">--dport 22<\/code>, <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-i eth0<\/code>, <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-m conntrack --ctstate NEW<\/code><\/td>\n<\/tr>\n<tr>\n<td>\u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0435 (<code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-j target<\/code>)<\/td>\n<td>\u0427\u0442\u043e \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0441 \u0441\u043e\u0432\u043f\u0430\u0432\u0448\u0438\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u043c<\/td>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">ACCEPT<\/code>, <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">DROP<\/code>, <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">REJECT<\/code>, <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">LOG<\/code>, <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">DNAT<\/code>, <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">MASQUERADE<\/code><\/td>\n<\/tr>\n<tr>\n<td>\u0421\u0447\u0435\u0442\u0447\u0438\u043a<\/td>\n<td>\u0421\u043a\u043e\u043b\u044c\u043a\u043e \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0438 \u0431\u0430\u0439\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u043e<\/td>\n<td>\u0432\u0438\u0434\u0435\u043d \u0432 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables -L -v<\/code><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u043a\u043b\u044e\u0447\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u043c\u0438:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u041a\u043b\u044e\u0447<\/th>\n<th>\u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0435<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-A &lt;\u0446\u0435\u043f\u043e\u0447\u043a\u0430&gt;<\/code><\/td>\n<td>\u0414\u043e\u0431\u0430\u0432\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0432 \u043a\u043e\u043d\u0435\u0446 \u0446\u0435\u043f\u043e\u0447\u043a\u0438<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-I &lt;\u0446\u0435\u043f\u043e\u0447\u043a\u0430&gt; [N]<\/code><\/td>\n<td>\u0412\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0432 \u043d\u0430\u0447\u0430\u043b\u043e \u0438\u043b\u0438 \u043d\u0430 \u043f\u043e\u0437\u0438\u0446\u0438\u044e N<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-D &lt;\u0446\u0435\u043f\u043e\u0447\u043a\u0430&gt;<\/code><\/td>\n<td>\u0423\u0434\u0430\u043b\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-R &lt;\u0446\u0435\u043f\u043e\u0447\u043a\u0430&gt; N<\/code><\/td>\n<td>\u0417\u0430\u043c\u0435\u043d\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u043f\u043e \u043d\u043e\u043c\u0435\u0440\u0443<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-F [\u0446\u0435\u043f\u043e\u0447\u043a\u0430]<\/code><\/td>\n<td>\u041e\u0447\u0438\u0441\u0442\u0438\u0442\u044c \u0446\u0435\u043f\u043e\u0447\u043a\u0443 (\u0443\u0434\u0430\u043b\u0438\u0442\u044c \u0432\u0441\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430)<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-P &lt;\u0446\u0435\u043f\u043e\u0447\u043a\u0430&gt; &lt;target&gt;<\/code><\/td>\n<td>\u0417\u0430\u0434\u0430\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e (ACCEPT \u0438\u043b\u0438 DROP)<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-L -v -n --line-numbers<\/code><\/td>\n<td>\u041f\u043e\u043a\u0430\u0437\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0441 \u0441\u0447\u0435\u0442\u0447\u0438\u043a\u0430\u043c\u0438 \u0438 \u043d\u043e\u043c\u0435\u0440\u0430\u043c\u0438<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>\u041f\u0440\u043e\u0441\u0442\u043e\u0439 \u043f\u0440\u0438\u043c\u0435\u0440 &#8212; \u0437\u0430\u043a\u0440\u044b\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043f\u043e\u0440\u0442\u0443 \u0431\u0430\u0437\u044b \u0434\u0430\u043d\u043d\u044b\u0445 (3306) \u0434\u043b\u044f \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u043e\u0433\u043e \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables<span style=\"color: #ABB2BF\"> <\/span>-A<span style=\"color: #ABB2BF\"> <\/span>INPUT<span style=\"color: #ABB2BF\"> <\/span>-p<span style=\"color: #ABB2BF\"> <\/span>tcp<span style=\"color: #ABB2BF\"> <\/span>-s<span style=\"color: #ABB2BF\"> <\/span><span style=\"color: #D19A66\">203<\/span>.0.113.7<span style=\"color: #ABB2BF\"> <\/span>--dport<span style=\"color: #ABB2BF\"> <\/span><span style=\"color: #D19A66\">3306<\/span><span style=\"color: #ABB2BF\"> <\/span>-j<span style=\"color: #ABB2BF\"> <\/span>DROP<\/code><\/pre>\n<p>\u0420\u0430\u0437\u0431\u043e\u0440 \u043f\u043e \u0447\u0430\u0441\u0442\u044f\u043c: <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-A INPUT<\/code> \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u0435\u043c \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0443 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0445; <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-p tcp<\/code> \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b TCP; <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-s 203.0.113.7<\/code> \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0430\u043a\u0435\u0442\u044b \u0441 \u044d\u0442\u043e\u0433\u043e IP; <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">--dport 3306<\/code> \u043f\u043e\u0440\u0442 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f 3306; <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-j DROP<\/code> \u043c\u043e\u043b\u0447\u0430 \u043e\u0442\u0431\u0440\u043e\u0441\u0438\u0442\u044c. \u0427\u0442\u043e\u0431\u044b \u0441\u043d\u044f\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0442 \u0442\u0443 \u0436\u0435 \u0441\u0442\u0440\u043e\u043a\u0443, \u0437\u0430\u043c\u0435\u043d\u0438\u0432 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-A<\/code> \u043d\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-D<\/code>. \u041f\u043e\u0440\u0442 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f (SSH, 22) \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u043c <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">DROP<\/code> \u0432\u0441\u043b\u0435\u043f\u0443\u044e \u043b\u0443\u0447\u0448\u0435 \u043d\u0435 \u0442\u0440\u043e\u0433\u0430\u0442\u044c &#8212; \u043a\u0430\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u043c\u0435\u043d\u044f\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a SSH \u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u0440\u0430\u0437\u0431\u0435\u0440\u0443 \u043d\u0438\u0436\u0435: \u0441 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0435\u0439 \u043d\u0430\u0431\u043e\u0440\u0430 \u043f\u0440\u0430\u0432\u0438\u043b \u0438 \u0430\u0432\u0442\u043e\u043e\u0442\u043a\u0430\u0442\u043e\u043c.<\/p>\n<p>\u0412\u0430\u0436\u043d\u043e \u043f\u0440\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u043a\u0443: <strong>DROP<\/strong> \u043e\u0442\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442 \u0431\u0435\u0437 \u043e\u0442\u0432\u0435\u0442\u0430 (\u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u0435\u043b\u044c \u0436\u0434\u0435\u0442 \u0442\u0430\u0439\u0430\u0443\u0442\u0430), \u0430 <strong>REJECT<\/strong> \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435\u043c (\u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e ICMP port unreachable, \u0434\u043b\u044f TCP \u043c\u043e\u0436\u043d\u043e \u0432\u0435\u0440\u043d\u0443\u0442\u044c RST). DROP \u0442\u0438\u0448\u0435 \u0438 \u0445\u0443\u0436\u0435 \u0432\u044b\u0434\u0430\u0435\u0442 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u0438\u043b\u044c\u0442\u0440\u0430 \u0441\u043a\u0430\u043d\u0435\u0440\u0430\u043c, REJECT \u043f\u043e\u043d\u044f\u0442\u043d\u0435\u0435 \u0434\u043b\u044f \u0441\u0432\u043e\u0438\u0445 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432.<\/p>\n<h2 id=\"s3\">\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 firewall \u0441 \u043d\u0443\u043b\u044f: \u043f\u043e\u0448\u0430\u0433\u043e\u0432\u043e<\/h2>\n<p>\u0421\u043e\u0431\u0435\u0440\u0443 \u0442\u0438\u043f\u0438\u0447\u043d\u0443\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u0430: \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0432\u0441\u0435 \u0432\u0445\u043e\u0434\u044f\u0449\u0435\u0435 \u0437\u0430\u043f\u0440\u0435\u0449\u0435\u043d\u043e, \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0443\u0436\u043d\u044b\u0435 \u0441\u043b\u0443\u0436\u0431\u044b. \u041a\u043e\u043c\u0430\u043d\u0434\u044b \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044e\u0442\u0441\u044f \u043e\u0442 root (\u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">sudo<\/code>).<\/p>\n<p>\u0428\u0430\u0433 0. \u041f\u0435\u0440\u0435\u0434 \u043b\u044e\u0431\u044b\u043c\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f\u043c\u0438 \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u0435 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043d\u0430\u0431\u043e\u0440 \u043f\u0440\u0430\u0432\u0438\u043b &#8212; \u043a \u043d\u0435\u043c\u0443 \u043c\u043e\u0436\u043d\u043e \u0431\u0443\u0434\u0435\u0442 \u043e\u0442\u043a\u0430\u0442\u0438\u0442\u044c\u0441\u044f:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">sudo<span style=\"color: #ABB2BF\"> <\/span>iptables-save<span style=\"color: #ABB2BF\"> <\/span>&gt;<span style=\"color: #ABB2BF\"> <\/span>\/root\/iptables.before<\/code><\/pre>\n<p>\u0412\u043e\u0441\u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u044c \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u043d\u043e\u0435 \u043f\u043e\u043c\u043e\u0436\u0435\u0442 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">sudo iptables-restore &lt; \/root\/iptables.before<\/code>. \u041d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0439\u0442\u0435 \u043d\u043e\u0432\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e \u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-apply<\/code>: \u0443\u0442\u0438\u043b\u0438\u0442\u0430 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0438, \u0435\u0441\u043b\u0438 \u0432\u044b \u043d\u0435 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0434\u0438\u0442\u0435 \u0438\u0445 \u0432 \u0442\u0435\u0447\u0435\u043d\u0438\u0435 \u0442\u0430\u0439\u043c\u0430\u0443\u0442\u0430 (\u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e 10 \u0441\u0435\u043a\u0443\u043d\u0434), \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043f\u0440\u0435\u0436\u043d\u0438\u0435 &#8212; \u0435\u0441\u043b\u0438 \u043d\u043e\u0432\u0430\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u043e\u0431\u043e\u0440\u0432\u0435\u0442 SSH-\u0441\u0435\u0441\u0441\u0438\u044e, \u0434\u043e\u0441\u0442\u0443\u043f \u0432\u0435\u0440\u043d\u0435\u0442\u0441\u044f \u0441\u0430\u043c.<\/p>\n<p>\u0428\u0430\u0433 1. \u041f\u043e\u043a\u0430 \u043d\u0435 \u0442\u0440\u043e\u0433\u0430\u0435\u043c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438, \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0434\u043e\u0431\u0430\u0432\u0438\u043c \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 &#8212; \u0438\u043d\u0430\u0447\u0435 \u043f\u0440\u0438 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0439 \u0440\u0430\u0431\u043e\u0442\u0435 \u043c\u043e\u0436\u043d\u043e \u043e\u0442\u0440\u0435\u0437\u0430\u0442\u044c \u0441\u0435\u0431\u0435 SSH. \u0420\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u043c \u0443\u0436\u0435 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0438 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0439 \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables<span style=\"color: #ABB2BF\"> <\/span>-A<span style=\"color: #ABB2BF\"> <\/span>INPUT<span style=\"color: #ABB2BF\"> <\/span>-m<span style=\"color: #ABB2BF\"> <\/span>conntrack<span style=\"color: #ABB2BF\"> <\/span>--ctstate<span style=\"color: #ABB2BF\"> <\/span>ESTABLISHED,RELATED<span style=\"color: #ABB2BF\"> <\/span>-j<span style=\"color: #ABB2BF\"> <\/span>ACCEPT\niptables<span style=\"color: #ABB2BF\"> <\/span>-A<span style=\"color: #ABB2BF\"> <\/span>INPUT<span style=\"color: #ABB2BF\"> <\/span>-i<span style=\"color: #ABB2BF\"> <\/span>lo<span style=\"color: #ABB2BF\"> <\/span>-j<span style=\"color: #ABB2BF\"> <\/span>ACCEPT<\/code><\/pre>\n<p>\u041f\u0435\u0440\u0432\u043e\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e &#8212; \u043a\u043b\u044e\u0447\u0435\u0432\u043e\u0435 \u0434\u043b\u044f stateful-\u0444\u0438\u043b\u044c\u0442\u0440\u0430: \u043c\u043e\u0434\u0443\u043b\u044c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u0439 (<code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">conntrack<\/code>) \u043f\u043e\u043c\u043d\u0438\u0442 \u0443\u0436\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u0441\u0435\u0430\u043d\u0441\u044b, \u0438 \u043e\u0442\u0432\u0435\u0442\u044b \u043d\u0430 \u0438\u0441\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0442 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438, \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043b\u044f \u043d\u0438\u0445 \u043d\u0435 \u043d\u0443\u0436\u043d\u044b. \u0412\u0442\u043e\u0440\u043e\u0435 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u0442 \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 loopback (<code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">lo<\/code>), \u0431\u0435\u0437 \u043d\u0435\u0433\u043e \u043b\u043e\u043c\u0430\u044e\u0442\u0441\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u044b\u0435 \u0441\u043b\u0443\u0436\u0431\u044b.<\/p>\n<p>\u0428\u0430\u0433 2. \u0420\u0430\u0437\u0440\u0435\u0448\u0430\u0435\u043c \u043d\u0443\u0436\u043d\u044b\u0435 \u043f\u043e\u0440\u0442\u044b &#8212; SSH, \u0430 \u0434\u043b\u044f \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u0435\u0449\u0435 HTTP \u0438 HTTPS. <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">--ctstate NEW<\/code> \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f. SSH \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0435\u0435 \u043e\u0442\u043a\u0440\u044b\u0432\u0430\u0442\u044c \u043d\u0435 \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443, \u0430 \u0442\u043e\u043b\u044c\u043a\u043e \u0441 \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430 \u0438\u043b\u0438 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f (\u043a\u043b\u044e\u0447 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-s<\/code>):<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables<span style=\"color: #ABB2BF\"> <\/span>-A<span style=\"color: #ABB2BF\"> <\/span>INPUT<span style=\"color: #ABB2BF\"> <\/span>-p<span style=\"color: #ABB2BF\"> <\/span>tcp<span style=\"color: #ABB2BF\"> <\/span>-s<span style=\"color: #ABB2BF\"> <\/span><span style=\"color: #D19A66\">203<\/span>.0.113.0\/24<span style=\"color: #ABB2BF\"> <\/span>--dport<span style=\"color: #ABB2BF\"> <\/span><span style=\"color: #D19A66\">22<\/span><span style=\"color: #ABB2BF\"> <\/span>-m<span style=\"color: #ABB2BF\"> <\/span>conntrack<span style=\"color: #ABB2BF\"> <\/span>--ctstate<span style=\"color: #ABB2BF\"> <\/span>NEW<span style=\"color: #ABB2BF\"> <\/span>-j<span style=\"color: #ABB2BF\"> <\/span>ACCEPT\niptables<span style=\"color: #ABB2BF\"> <\/span>-A<span style=\"color: #ABB2BF\"> <\/span>INPUT<span style=\"color: #ABB2BF\"> <\/span>-p<span style=\"color: #ABB2BF\"> <\/span>tcp<span style=\"color: #ABB2BF\"> <\/span>--dport<span style=\"color: #ABB2BF\"> <\/span><span style=\"color: #D19A66\">80<\/span><span style=\"color: #ABB2BF\"> <\/span>-m<span style=\"color: #ABB2BF\"> <\/span>conntrack<span style=\"color: #ABB2BF\"> <\/span>--ctstate<span style=\"color: #ABB2BF\"> <\/span>NEW<span style=\"color: #ABB2BF\"> <\/span>-j<span style=\"color: #ABB2BF\"> <\/span>ACCEPT\niptables<span style=\"color: #ABB2BF\"> <\/span>-A<span style=\"color: #ABB2BF\"> <\/span>INPUT<span style=\"color: #ABB2BF\"> <\/span>-p<span style=\"color: #ABB2BF\"> <\/span>tcp<span style=\"color: #ABB2BF\"> <\/span>--dport<span style=\"color: #ABB2BF\"> <\/span><span style=\"color: #D19A66\">443<\/span><span style=\"color: #ABB2BF\"> <\/span>-m<span style=\"color: #ABB2BF\"> <\/span>conntrack<span style=\"color: #ABB2BF\"> <\/span>--ctstate<span style=\"color: #ABB2BF\"> <\/span>NEW<span style=\"color: #ABB2BF\"> <\/span>-j<span style=\"color: #ABB2BF\"> <\/span>ACCEPT<\/code><\/pre>\n<p>\u0415\u0441\u043b\u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043f\u043e SSH \u043d\u0443\u0436\u0435\u043d \u0441 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0445 \u0430\u0434\u0440\u0435\u0441\u043e\u0432, \u043a\u043b\u044e\u0447 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-s<\/code> \u0443 \u043f\u0435\u0440\u0432\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0438 \u0443\u0431\u0438\u0440\u0430\u044e\u0442 &#8212; \u043d\u043e \u0442\u043e\u0433\u0434\u0430 \u043f\u043e\u0440\u0442 \u0441\u0442\u043e\u0438\u0442 \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u0438\u043a\u0440\u044b\u0442\u044c fail2ban \u0438\u043b\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u0435\u043c \u0447\u0430\u0441\u0442\u043e\u0442\u044b \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0439.<\/p>\n<p>\u0428\u0430\u0433 3. \u0420\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u044b, \u0442\u0435\u043f\u0435\u0440\u044c \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043a\u0440\u044b\u0442\u044c \u0432\u0441\u0435 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u043e\u0435 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u043e\u0439 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e. \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f \u043a \u043f\u0430\u043a\u0435\u0442\u0443, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0435 \u043f\u043e\u0434\u043e\u0448\u0435\u043b \u043d\u0438 \u043f\u043e\u0434 \u043e\u0434\u043d\u043e \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0438:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables<span style=\"color: #ABB2BF\"> <\/span>-P<span style=\"color: #ABB2BF\"> <\/span>INPUT<span style=\"color: #ABB2BF\"> <\/span>DROP\niptables<span style=\"color: #ABB2BF\"> <\/span>-P<span style=\"color: #ABB2BF\"> <\/span>FORWARD<span style=\"color: #ABB2BF\"> <\/span>DROP\niptables<span style=\"color: #ABB2BF\"> <\/span>-P<span style=\"color: #ABB2BF\"> <\/span>OUTPUT<span style=\"color: #ABB2BF\"> <\/span>ACCEPT<\/code><\/pre>\n<p>\u041f\u043e\u0440\u044f\u0434\u043e\u043a \u0438\u043c\u0435\u043d\u043d\u043e \u0442\u0430\u043a\u043e\u0439: \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c SSH \u0438 established, \u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0442\u043e\u043c \u0441\u0442\u0430\u0432\u0438\u0442\u044c <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-P INPUT DROP<\/code>. \u0415\u0441\u043b\u0438 \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0430\u043e\u0431\u043e\u0440\u043e\u0442 \u043d\u0430 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435, \u0442\u0435\u043a\u0443\u0449\u0430\u044f SSH-\u0441\u0435\u0441\u0441\u0438\u044f \u043e\u0431\u043e\u0440\u0432\u0435\u0442\u0441\u044f. \u041d\u0430 \u043d\u0435\u0437\u043d\u0430\u043a\u043e\u043c\u043e\u0439 \u043c\u0430\u0448\u0438\u043d\u0435 \u0434\u043b\u044f \u043f\u043e\u0434\u0441\u0442\u0440\u0430\u0445\u043e\u0432\u043a\u0438 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u044e\u0442 \u043e\u0442\u043b\u043e\u0436\u0435\u043d\u043d\u044b\u0439 \u0441\u0431\u0440\u043e\u0441 \u043f\u0440\u0430\u0432\u0438\u043b (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0437\u0430\u0434\u0430\u043d\u0438\u0435 \u0432 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">at<\/code> \u0447\u0435\u0440\u0435\u0437 5 \u043c\u0438\u043d\u0443\u0442), \u0447\u0442\u043e\u0431\u044b \u0432\u0435\u0440\u043d\u0443\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f, \u0435\u0441\u043b\u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043e\u043a\u0430\u0436\u0443\u0442\u0441\u044f \u043d\u0435\u0432\u0435\u0440\u043d\u044b\u043c\u0438.<\/p>\n<p>\u041f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u0441 \u043d\u043e\u043c\u0435\u0440\u0430\u043c\u0438 \u0441\u0442\u0440\u043e\u043a \u0438 \u0441\u0447\u0435\u0442\u0447\u0438\u043a\u0430\u043c\u0438:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables<span style=\"color: #ABB2BF\"> <\/span>-L<span style=\"color: #ABB2BF\"> <\/span>INPUT<span style=\"color: #ABB2BF\"> <\/span>-v<span style=\"color: #ABB2BF\"> <\/span>-n<span style=\"color: #ABB2BF\"> <\/span>--line-numbers<\/code><\/pre>\n<h2 id=\"s4\">NAT: \u043f\u0440\u043e\u0431\u0440\u043e\u0441 \u043f\u043e\u0440\u0442\u043e\u0432 \u0438 \u043c\u0430\u0441\u043a\u0430\u0440\u0430\u0434\u0438\u043d\u0433<\/h2>\n<p>\u0422\u0430\u0431\u043b\u0438\u0446\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nat<\/code> \u043d\u0443\u0436\u043d\u0430, \u043a\u043e\u0433\u0434\u0430 \u0445\u043e\u0441\u0442 \u0440\u0430\u0437\u0434\u0430\u0435\u0442 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0438\u043b\u0438 \u043f\u0440\u044f\u0447\u0435\u0442 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b. \u041f\u0440\u0430\u0432\u0438\u043b\u0430 \u0441\u0442\u0430\u0432\u044f\u0442 \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 PREROUTING (\u043f\u0440\u0430\u0432\u043a\u0430 \u0430\u0434\u0440\u0435\u0441\u0430 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f) \u0438 POSTROUTING (\u043f\u0440\u0430\u0432\u043a\u0430 \u0430\u0434\u0440\u0435\u0441\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430).<\/p>\n<p><strong>\u041c\u0430\u0441\u043a\u0430\u0440\u0430\u0434\u0438\u043d\u0433<\/strong> &#8212; \u043f\u043e\u0434\u043c\u0435\u043d\u0430 \u0430\u0434\u0440\u0435\u0441\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430 \u043d\u0430 IP \u0432\u043d\u0435\u0448\u043d\u0435\u0433\u043e \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430, \u0447\u0442\u043e\u0431\u044b \u043c\u0430\u0448\u0438\u043d\u044b \u0438\u0437 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u0441\u0435\u0442\u0438 \u0432\u044b\u0445\u043e\u0434\u0438\u043b\u0438 \u0432 \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442 \u0447\u0435\u0440\u0435\u0437 \u0448\u043b\u044e\u0437. \u042d\u0442\u043e \u0440\u0430\u0437\u043d\u043e\u0432\u0438\u0434\u043d\u043e\u0441\u0442\u044c SNAT, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0441\u0430\u043c\u0430 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 IP \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430 (\u0443\u0434\u043e\u0431\u043d\u043e \u0434\u043b\u044f \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430):<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables<span style=\"color: #ABB2BF\"> <\/span>-t<span style=\"color: #ABB2BF\"> <\/span>nat<span style=\"color: #ABB2BF\"> <\/span>-A<span style=\"color: #ABB2BF\"> <\/span>POSTROUTING<span style=\"color: #ABB2BF\"> <\/span>-s<span style=\"color: #ABB2BF\"> <\/span><span style=\"color: #D19A66\">192<\/span>.168.1.0\/24<span style=\"color: #ABB2BF\"> <\/span>-o<span style=\"color: #ABB2BF\"> <\/span>eth0<span style=\"color: #ABB2BF\"> <\/span>-j<span style=\"color: #ABB2BF\"> <\/span>MASQUERADE<\/code><\/pre>\n<p>\u041a\u043b\u044e\u0447 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-s 192.168.1.0\/24<\/code> \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442 \u043c\u0430\u0441\u043a\u0430\u0440\u0430\u0434\u0438\u043d\u0433 \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u0432\u043e\u0435\u0439 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0439 \u043f\u043e\u0434\u0441\u0435\u0442\u044c\u044e, \u0430 \u043d\u0435 \u0432\u0441\u0435\u043c \u043f\u0440\u043e\u0445\u043e\u0434\u044f\u0449\u0438\u043c \u0442\u0440\u0430\u0444\u0438\u043a\u043e\u043c; \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">eth0<\/code> \u0438 \u0430\u0434\u0440\u0435\u0441 \u043f\u043e\u0434\u0441\u0435\u0442\u0438 \u043f\u043e\u0434\u0441\u0442\u0430\u0432\u044c\u0442\u0435 \u043f\u043e\u0434 \u0441\u0432\u043e\u044e \u0441\u0445\u0435\u043c\u0443.<\/p>\n<p>\u041e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u043d\u0443\u0436\u043d\u043e \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u044c \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u043a\u0443 \u043f\u0430\u043a\u0435\u0442\u043e\u0432 \u0432 \u044f\u0434\u0440\u0435, \u0438\u043d\u0430\u0447\u0435 \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0435 \u043f\u043e\u0439\u0434\u0435\u0442:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">sysctl<span style=\"color: #ABB2BF\"> <\/span>-w<span style=\"color: #ABB2BF\"> <\/span>net.ipv4.ip_forward<span style=\"color: #56B6C2\">=<\/span><span style=\"color: #D19A66\">1<\/span><\/code><\/pre>\n<p>\u0427\u0442\u043e\u0431\u044b \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u043b\u043e\u0441\u044c \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0435\u0433\u043e \u043f\u0440\u043e\u043f\u0438\u0441\u044b\u0432\u0430\u044e\u0442 \u0432 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">\/etc\/sysctl.conf<\/code> \u0438\u043b\u0438 \u0444\u0430\u0439\u043b \u0432 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">\/etc\/sysctl.d\/<\/code>.<\/p>\n<p><strong>\u041f\u0440\u043e\u0431\u0440\u043e\u0441 \u043f\u043e\u0440\u0442\u0430 (DNAT)<\/strong> &#8212; \u043f\u0435\u0440\u0435\u043d\u0430\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0432\u043d\u0435\u0448\u043d\u0438\u0435 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0439 \u0441\u0435\u0440\u0432\u0435\u0440. \u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0432\u0445\u043e\u0434\u044f\u0449\u0438\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u043f\u043e\u0440\u0442 80 \u0448\u043b\u044e\u0437\u0430 \u043e\u0442\u0434\u0430\u0442\u044c \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u044e\u044e \u043c\u0430\u0448\u0438\u043d\u0443:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables<span style=\"color: #ABB2BF\"> <\/span>-t<span style=\"color: #ABB2BF\"> <\/span>nat<span style=\"color: #ABB2BF\"> <\/span>-A<span style=\"color: #ABB2BF\"> <\/span>PREROUTING<span style=\"color: #ABB2BF\"> <\/span>-i<span style=\"color: #ABB2BF\"> <\/span>eth0<span style=\"color: #ABB2BF\"> <\/span>-p<span style=\"color: #ABB2BF\"> <\/span>tcp<span style=\"color: #ABB2BF\"> <\/span>--dport<span style=\"color: #ABB2BF\"> <\/span><span style=\"color: #D19A66\">80<\/span><span style=\"color: #ABB2BF\"> <\/span>-j<span style=\"color: #ABB2BF\"> <\/span>DNAT<span style=\"color: #ABB2BF\"> <\/span>--to-destination<span style=\"color: #ABB2BF\"> <\/span><span style=\"color: #D19A66\">192<\/span>.168.1.100:80<\/code><\/pre>\n<p>\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0441\u0430\u043c \u0442\u0440\u0430\u043d\u0437\u0438\u0442\u043d\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 \u0434\u043e\u043b\u0436\u043d\u0430 \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0430 FORWARD (\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0443 \u043d\u0430\u0441 DROP), \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u0434\u043b\u044f \u043f\u0440\u043e\u0431\u0440\u043e\u0448\u0435\u043d\u043d\u043e\u0433\u043e \u0442\u0440\u0430\u0444\u0438\u043a\u0430 \u0434\u043e\u0431\u0430\u0432\u043b\u044f\u044e\u0442 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0435\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0432 FORWARD.<\/p>\n<h2 id=\"s5\">\u041e\u0441\u043d\u043e\u0432\u043d\u044b\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u044f (targets)<\/h2>\n<p>\u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0430\u0435\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0438 \u0440\u0435\u0448\u0430\u0435\u0442 \u0441\u0443\u0434\u044c\u0431\u0443 \u043f\u0430\u043a\u0435\u0442\u0430. <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">filter<\/code> &#8212; \u043e\u0441\u043d\u043e\u0432\u043d\u0430\u044f \u0442\u0430\u0431\u043b\u0438\u0446\u0430 \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u0439 ACCEPT\/DROP, \u043d\u043e \u044d\u0442\u043e \u0446\u0435\u043b\u0438-\u0432\u0435\u0440\u0434\u0438\u043a\u0442\u044b, \u0438 \u0432\u0441\u0442\u0440\u0435\u0447\u0430\u044e\u0442\u0441\u044f \u043e\u043d\u0438 \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0430\u0445 \u0440\u0430\u0437\u043d\u044b\u0445 \u0442\u0430\u0431\u043b\u0438\u0446; SNAT \u0438 DNAT \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442\u0441\u044f \u0432 \u0442\u0430\u0431\u043b\u0438\u0446\u0435 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nat<\/code> \u0432 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u043c\u044b\u0445 \u0446\u0435\u043f\u043e\u0447\u043a\u0430\u0445:<\/p>\n<table>\n<thead>\n<tr>\n<th>\u0414\u0435\u0439\u0441\u0442\u0432\u0438\u0435<\/th>\n<th>\u0427\u0442\u043e \u0434\u0435\u043b\u0430\u0435\u0442<\/th>\n<th>\u0413\u0434\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0442<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">ACCEPT<\/code><\/td>\n<td>\u041f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442<\/td>\n<td>\u043b\u044e\u0431\u0430\u044f (\u0432\u0435\u0440\u0434\u0438\u043a\u0442)<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">DROP<\/code><\/td>\n<td>\u041c\u043e\u043b\u0447\u0430 \u043e\u0442\u0431\u0440\u043e\u0441\u0438\u0442\u044c, \u0431\u0435\u0437 \u043e\u0442\u0432\u0435\u0442\u0430<\/td>\n<td>\u043b\u044e\u0431\u0430\u044f (\u0432\u0435\u0440\u0434\u0438\u043a\u0442)<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">REJECT<\/code><\/td>\n<td>\u041e\u0442\u043a\u043b\u043e\u043d\u0438\u0442\u044c \u0441 \u0443\u0432\u0435\u0434\u043e\u043c\u043b\u0435\u043d\u0438\u0435\u043c (ICMP \u0438\u043b\u0438 TCP RST)<\/td>\n<td>filter, mangle<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">LOG<\/code><\/td>\n<td>\u0417\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0439 \u0436\u0443\u0440\u043d\u0430\u043b, \u043d\u0435 \u043c\u0435\u043d\u044f\u044f \u0441\u0443\u0434\u044c\u0431\u0443 \u043f\u0430\u043a\u0435\u0442\u0430<\/td>\n<td>\u043b\u044e\u0431\u0430\u044f<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">RETURN<\/code><\/td>\n<td>\u041f\u0440\u0435\u0440\u0432\u0430\u0442\u044c \u0442\u0435\u043a\u0443\u0449\u0443\u044e \u0446\u0435\u043f\u043e\u0447\u043a\u0443 (\u0441\u043c. \u043f\u043e\u044f\u0441\u043d\u0435\u043d\u0438\u0435 \u043d\u0438\u0436\u0435)<\/td>\n<td>\u043b\u044e\u0431\u0430\u044f<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">DNAT<\/code><\/td>\n<td>\u041f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0430\u0434\u0440\u0435\u0441 \u043d\u0430\u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f (\u043f\u0440\u043e\u0431\u0440\u043e\u0441)<\/td>\n<td>nat, PREROUTING<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">SNAT<\/code><\/td>\n<td>\u041f\u043e\u0434\u043c\u0435\u043d\u0438\u0442\u044c \u0430\u0434\u0440\u0435\u0441 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0430 (\u0441\u0442\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0439 IP)<\/td>\n<td>nat, POSTROUTING<\/td>\n<\/tr>\n<tr>\n<td><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">MASQUERADE<\/code><\/td>\n<td>SNAT \u0441 \u0430\u0432\u0442\u043e\u043f\u043e\u0434\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u043e\u0439 IP \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0430<\/td>\n<td>nat, POSTROUTING<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">RETURN<\/code> \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u043f\u043e-\u0440\u0430\u0437\u043d\u043e\u043c\u0443 \u0432 \u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442 \u0446\u0435\u043f\u043e\u0447\u043a\u0438: \u0432 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u043e\u043d \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u043a\u0443 \u043a \u0441\u043b\u0435\u0434\u0443\u044e\u0449\u0435\u043c\u0443 \u043f\u0440\u0430\u0432\u0438\u043b\u0443 \u0432\u044b\u0437\u0432\u0430\u0432\u0448\u0435\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438, \u0430 \u0432\u043e \u0432\u0441\u0442\u0440\u043e\u0435\u043d\u043d\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0435 \u00ab\u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0435\u0439\u00bb \u043d\u0435\u0442 &#8212; \u0442\u0430\u043c <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">RETURN<\/code> \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u043f\u0440\u0438\u043c\u0435\u043d\u0435\u043d\u0438\u044e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u044d\u0442\u043e\u0439 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.<\/p>\n<p><code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">LOG<\/code> \u043e\u0431\u044b\u0447\u043d\u043e \u0441\u0442\u0430\u0432\u044f\u0442 \u043f\u0435\u0440\u0435\u0434 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">DROP<\/code> \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u043e\u043c, \u0447\u0442\u043e\u0431\u044b \u0438 \u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u043f\u043e\u043f\u044b\u0442\u043a\u0443, \u0438 \u043e\u0442\u0431\u0440\u043e\u0441\u0438\u0442\u044c \u043f\u0430\u043a\u0435\u0442: \u0441\u0430\u043c <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">LOG<\/code> \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043f\u0430\u043a\u0435\u0442 \u0434\u0430\u043b\u044c\u0448\u0435 \u043f\u043e \u0446\u0435\u043f\u043e\u0447\u043a\u0435.<\/p>\n<h2 id=\"s6\">IPv6 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0430 backend<\/h2>\n<p>iptables \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e IPv4. \u0414\u043b\u044f IPv6 \u0435\u0441\u0442\u044c \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">ip6tables<\/code> \u0441\u043e \u0441\u0432\u043e\u0438\u043c\u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u043c\u0438 \u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0430\u043c\u0438 &#8212; \u0438 \u044d\u0442\u043e \u0447\u0430\u0441\u0442\u0430\u044f \u0431\u0440\u0435\u0448\u044c: \u0435\u0441\u043b\u0438 \u0445\u043e\u0441\u0442 \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u043f\u043e IPv6, \u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0437\u0430\u0434\u0430\u043d\u044b \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043b\u044f IPv4, \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0443\u0442\u044c \u0432 \u043e\u0431\u0445\u043e\u0434 \u0432\u0441\u0435\u0439 IPv4-\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0430\u044e\u0449\u0438\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u043e\u0432\u0442\u043e\u0440\u044f\u044e\u0442 \u0438 \u0434\u043b\u044f IPv6 \u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">ip6tables<\/code>, \u043b\u0438\u0431\u043e IPv6 \u043e\u0441\u043e\u0437\u043d\u0430\u043d\u043d\u043e \u043e\u0442\u043a\u043b\u044e\u0447\u0430\u044e\u0442 &#8212; \u043d\u043e \u0442\u043e\u043b\u044c\u043a\u043e \u043a\u043e\u0433\u0434\u0430 \u044d\u0442\u043e \u043e\u0431\u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043e \u0430\u0440\u0445\u0438\u0442\u0435\u043a\u0442\u0443\u0440\u043e\u0439.<\/p>\n<p>\u041f\u0435\u0440\u0435\u0434 \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u043e\u0439 \u0441\u0442\u043e\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u043a\u0430\u043a\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 \u0438 \u043a\u0430\u043a\u043e\u0439 backend \u0430\u043a\u0442\u0438\u0432\u043d\u044b:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables<span style=\"color: #ABB2BF\"> <\/span>--version\nip6tables<span style=\"color: #ABB2BF\"> <\/span>-L<span style=\"color: #ABB2BF\"> <\/span>-n\nnft<span style=\"color: #ABB2BF\"> <\/span>list<span style=\"color: #ABB2BF\"> <\/span>ruleset<\/code><\/pre>\n<p>\u0412 \u0432\u044b\u0432\u043e\u0434\u0435 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables --version<\/code> \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043c\u0435\u0442\u043a\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nf_tables<\/code> \u0438\u043b\u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">legacy<\/code>. \u041d\u0435 \u0441\u043c\u0435\u0448\u0438\u0432\u0430\u0439\u0442\u0435 legacy- \u0438 nft-backend: \u043f\u0440\u0430\u0432\u0438\u043b\u0430, \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0435 \u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-legacy<\/code> \u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-nft<\/code>, \u0436\u0438\u0432\u0443\u0442 \u0432 \u0440\u0430\u0437\u043d\u044b\u0445 \u043d\u0430\u0431\u043e\u0440\u0430\u0445 \u0438 \u043d\u0435 \u0432\u0438\u0434\u044f\u0442 \u0434\u0440\u0443\u0433 \u0434\u0440\u0443\u0433\u0430, \u0438\u0437-\u0437\u0430 \u0447\u0435\u0433\u043e \u0447\u0430\u0441\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b \u043c\u043e\u0436\u0435\u0442 \u043c\u043e\u043b\u0447\u0430 \u043d\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f. <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nft list ruleset<\/code> \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0438\u0442\u043e\u0433\u043e\u0432\u044b\u0439 \u043d\u0430\u0431\u043e\u0440 \u0432 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u0445 nftables &#8212; \u0443\u0434\u043e\u0431\u043d\u043e \u0441\u0432\u0435\u0440\u0438\u0442\u044c\u0441\u044f, \u0447\u0442\u043e \u0432\u0441\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u043d\u0430 \u043c\u0435\u0441\u0442\u0435.<\/p>\n<h2 id=\"s7\">\u041a\u0430\u043a \u0441\u043e\u0445\u0440\u0430\u043d\u0438\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430<\/h2>\n<p>\u041f\u0440\u0430\u0432\u0438\u043b\u0430 iptables \u0436\u0438\u0432\u0443\u0442 \u0432 \u043f\u0430\u043c\u044f\u0442\u0438 \u044f\u0434\u0440\u0430 \u0438 \u0441\u0431\u0440\u0430\u0441\u044b\u0432\u0430\u044e\u0442\u0441\u044f \u043f\u0440\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0435. \u0421\u043d\u0430\u0447\u0430\u043b\u0430 \u043f\u043e\u0441\u043c\u043e\u0442\u0440\u0438\u0442\u0435 \u0442\u0435\u043a\u0443\u0449\u0438\u0439 \u043d\u0430\u0431\u043e\u0440 &#8212; \u0435\u0433\u043e \u043f\u0435\u0447\u0430\u0442\u0430\u0435\u0442 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-save<\/code>:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables-save<\/code><\/pre>\n<p>\u0415\u0434\u0438\u043d\u043e\u0439 \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u043d\u0435\u0442: \u0441\u043f\u043e\u0441\u043e\u0431 \u0437\u0430\u0432\u0438\u0441\u0438\u0442 \u043e\u0442 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430. \u0412 Debian \u0438 Ubuntu \u0441\u0442\u0430\u0432\u044f\u0442 \u043f\u0430\u043a\u0435\u0442 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-persistent<\/code> (\u0441\u043b\u0443\u0436\u0431\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">netfilter-persistent<\/code>), \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0434\u0435\u0440\u0436\u0438\u0442 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0432 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">\/etc\/iptables\/rules.v4<\/code> \u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">rules.v6<\/code> \u0438 \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u0435\u0442 \u0438\u0445 \u043f\u0440\u0438 \u0441\u0442\u0430\u0440\u0442\u0435. \u0412 RHEL, CentOS \u0438 Fedora \u0437\u0430 \u044d\u0442\u043e \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0441\u043b\u0443\u0436\u0431\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables<\/code> \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-services<\/code> (\u043a\u043e\u043c\u0430\u043d\u0434\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">service iptables save<\/code> \u043f\u0438\u0448\u0435\u0442 \u0432 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">\/etc\/sysconfig\/iptables<\/code>). \u0414\u043b\u044f IPv6 &#8212; \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u0438 \u0443\u0442\u0438\u043b\u0438\u0442\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">ip6tables-save<\/code>.<\/p>\n<p>\u0420\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442 \u043e\u0431\u044f\u0437\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u044e\u0442 \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438: \u0434\u0435\u043b\u0430\u044e\u0442 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">reboot<\/code> \u0438 \u0443\u0431\u0435\u0436\u0434\u0430\u044e\u0442\u0441\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u0430\u043c\u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables -L -n<\/code> \u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">ip6tables -L -n<\/code>, \u0447\u0442\u043e \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u043e\u0434\u043d\u044f\u043b\u0438\u0441\u044c &#8212; \u0438\u043d\u0430\u0447\u0435 \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0432\u043e\u0433\u043e \u0436\u0435 \u0440\u0435\u0441\u0442\u0430\u0440\u0442\u0430 \u0441\u0435\u0440\u0432\u0435\u0440 \u043e\u0441\u0442\u0430\u043d\u0435\u0442\u0441\u044f \u0431\u0435\u0437 firewall.<\/p>\n<h2 id=\"s8\">nftables \u043a\u0430\u043a \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u0430\u044f \u0430\u043b\u044c\u0442\u0435\u0440\u043d\u0430\u0442\u0438\u0432\u0430<\/h2>\n<p>\u0421 \u044f\u0434\u0440\u0430 3.13 (2014 \u0433\u043e\u0434) \u0432 Linux \u0435\u0441\u0442\u044c <strong>nftables<\/strong> &#8212; \u0435\u0434\u0438\u043d\u044b\u0439 \u0444\u0440\u0435\u0439\u043c\u0432\u043e\u0440\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0437\u0430\u043c\u0435\u043d\u044f\u0435\u0442 \u0441\u0440\u0430\u0437\u0443 iptables, ip6tables, arptables \u0438 ebtables \u043e\u0434\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u043e\u0439 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nft<\/code> \u0438 \u043e\u0434\u043d\u0438\u043c \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441\u043e\u043c. Netfilter Project \u043f\u0435\u0440\u0435\u0432\u0435\u043b iptables \u0432 \u0440\u0435\u0436\u0438\u043c legacy-\u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u0438 \u0438 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0434\u0435\u043b\u0430\u0442\u044c \u043d\u0430 nftables.<\/p>\n<p>\u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u0440\u0435\u0437\u043a\u043e\u0439 \u043b\u043e\u043c\u043a\u0438 \u043d\u0435\u0442. \u0412 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 (Debian 10, Ubuntu 20.10, RHEL 8 \u0438 \u043d\u043e\u0432\u0435\u0435) \u043a\u043e\u043c\u0430\u043d\u0434\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables<\/code> \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e &#8212; \u044d\u0442\u043e \u0443\u0436\u0435 \u043e\u0431\u0435\u0440\u0442\u043a\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-nft<\/code>: \u043f\u0440\u0438\u0432\u044b\u0447\u043d\u044b\u0439 \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f, \u0430 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u043e\u0434 \u043a\u0430\u043f\u043e\u0442\u043e\u043c \u0442\u0440\u0430\u043d\u0441\u043b\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 nftables. \u041f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c, \u043a\u0430\u043a\u043e\u0439 \u0440\u0435\u0436\u0438\u043c \u0430\u043a\u0442\u0438\u0432\u0435\u043d, \u043c\u043e\u0436\u043d\u043e \u0442\u0430\u043a:<\/p>\n<pre style=\"background:#282c34;color:#abb2bf;border-radius:8px;padding:16px 20px;margin:20px 0;overflow-x:auto;font-size:14px;line-height:1.55;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\"><code style=\"background:none\">iptables<span style=\"color: #ABB2BF\"> <\/span>--version<\/code><\/pre>\n<p>\u0412 \u0432\u044b\u0432\u043e\u0434\u0435 \u0431\u0443\u0434\u0435\u0442 \u043f\u043e\u043c\u0435\u0442\u043a\u0430 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nf_tables<\/code> \u0438\u043b\u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">legacy<\/code>. \u0413\u043e\u0442\u043e\u0432\u0443\u044e \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e iptables \u0443\u0434\u043e\u0431\u043d\u043e \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0438\u0442\u044c \u043d\u0430 \u043d\u043e\u0432\u044b\u0439 \u0441\u0438\u043d\u0442\u0430\u043a\u0441\u0438\u0441 \u0443\u0442\u0438\u043b\u0438\u0442\u043e\u0439 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-translate<\/code>, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u0435\u0447\u0430\u0442\u0430\u0435\u0442 \u044d\u043a\u0432\u0438\u0432\u0430\u043b\u0435\u043d\u0442\u043d\u0443\u044e \u043a\u043e\u043c\u0430\u043d\u0434\u0443 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">nft<\/code>. \u0418\u0437\u0443\u0447\u0430\u0442\u044c iptables \u043f\u043e-\u043f\u0440\u0435\u0436\u043d\u0435\u043c\u0443 \u0441\u0442\u043e\u0438\u0442: \u043e\u043d \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0432 \u0445\u043e\u0434\u0443 \u043d\u0430 \u043c\u043d\u043e\u0436\u0435\u0441\u0442\u0432\u0435 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0438 \u0432 \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u0438, \u0430 \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0442\u0430\u0431\u043b\u0438\u0446 \u0438 \u0446\u0435\u043f\u043e\u0447\u0435\u043a \u043d\u0430\u043f\u0440\u044f\u043c\u0443\u044e \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043d\u0430 nftables.<\/p>\n<h2 id=\"s9\">\u0413\u0434\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442\u0441\u044f iptables \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435<\/h2>\n<p>\u041d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 firewall \u043d\u0430 iptables &#8212; \u0431\u0430\u0437\u043e\u0432\u044b\u0439 \u043d\u0430\u0432\u044b\u043a \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u043e\u0433\u043e \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u0438 DevOps-\u0438\u043d\u0436\u0435\u043d\u0435\u0440\u0430: \u0437\u0430\u043a\u0440\u044b\u0442\u044c \u043b\u0438\u0448\u043d\u0438\u0435 \u043f\u043e\u0440\u0442\u044b \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u043f\u0440\u043e\u0431\u0440\u043e\u0441\u0438\u0442\u044c \u0442\u0440\u0430\u0444\u0438\u043a \u043d\u0430 \u0432\u043d\u0443\u0442\u0440\u0435\u043d\u043d\u0438\u0435 \u0441\u0435\u0440\u0432\u0438\u0441\u044b, \u043f\u043e\u0434\u043d\u044f\u0442\u044c NAT-\u0448\u043b\u044e\u0437, \u0437\u0430\u043b\u043e\u0433\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u044f, \u0441\u0432\u044f\u0437\u0430\u0442\u044c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0441 fail2ban \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 \u043f\u0435\u0440\u0435\u0431\u043e\u0440\u0430 \u043f\u0430\u0440\u043e\u043b\u0435\u0439. \u041f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u0435 \u0442\u0430\u0431\u043b\u0438\u0446, \u0446\u0435\u043f\u043e\u0447\u0435\u043a \u0438 \u043f\u043e\u0440\u044f\u0434\u043a\u0430 \u043f\u0440\u0430\u0432\u0438\u043b \u043f\u0435\u0440\u0435\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u0438 \u043d\u0430 nftables, \u0438 \u043d\u0430 \u043d\u0430\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u0432\u0440\u043e\u0434\u0435 firewalld \u0438 ufw.<\/p>\n<div class=\"oj-cta\" style=\"background:#fbf4e4;border-left:4px solid #c9962b;border-radius:8px;padding:16px 20px;margin:24px 0\">\n<p style=\"margin:0 0 8px\"><strong>\u041e\u0441\u0432\u043e\u0439\u0442\u0435 \u0442\u0435\u043c\u0443 \u043d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0435<\/strong><\/p>\n<p>\u0420\u0430\u0437\u043e\u0431\u0440\u0430\u0442\u044c \u0441\u0435\u0442\u0435\u0432\u0443\u044e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c, iptables \u0438 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 Linux \u043f\u043e \u0448\u0430\u0433\u0430\u043c \u043f\u043e\u043c\u043e\u0433\u0430\u0435\u0442 \u043a\u0443\u0440\u0441 <a href=\"https:\/\/otus.ru\/lessons\/linux-professional\/?int_article=polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux&amp;int_place=article&amp;int_variant=v1\">\u0410\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440 Linux<\/a> \u0432 Otus. \u041f\u043e\u0441\u043c\u043e\u0442\u0440\u0435\u0442\u044c \u0444\u043e\u0440\u043c\u0430\u0442 \u0437\u0430\u043d\u044f\u0442\u0438\u0439 \u0438 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0434\u043e \u043e\u043f\u043b\u0430\u0442\u044b \u043c\u043e\u0436\u043d\u043e \u043d\u0430 <a href=\"https:\/\/otus.ru\/events\/?int_article=polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux&amp;int_place=article&amp;int_variant=v1\">\u0431\u0435\u0441\u043f\u043b\u0430\u0442\u043d\u044b\u0445 \u0432\u0435\u0431\u0438\u043d\u0430\u0440\u0430\u0445<\/a> &#8212; \u0442\u0430\u043c \u0440\u0430\u0437\u0431\u0438\u0440\u0430\u044e\u0442 \u043a\u043e\u043d\u043a\u0440\u0435\u0442\u043d\u044b\u0435 \u0437\u0430\u0434\u0430\u0447\u0438 \u0438 \u043e\u0442\u0432\u0435\u0447\u0430\u044e\u0442 \u043d\u0430 \u0432\u043e\u043f\u0440\u043e\u0441\u044b.<\/p>\n<\/div>\n<p>\u0421\u043c\u0435\u0436\u043d\u044b\u0435 \u0442\u0435\u043c\u044b: <a href=\"https:\/\/otus.ru\/journal\/skripty-i-yazyki-ih-napisaniya-chto-nuzhno-znat-sistemnym-administratoram-i-razrabotchikam\/\">\u0421\u043a\u0440\u0438\u043f\u0442\u043e\u0432\u044b\u0435 \u044f\u0437\u044b\u043a\u0438 \u0434\u043b\u044f \u0430\u0434\u043c\u0438\u043d\u043e\u0432 \u0438 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u043e\u0432<\/a>, <a href=\"https:\/\/otus.ru\/journal\/ustanovka-linux-s-fleshki-chto-nuzhno-znat-polzovatelju\/\">\u0423\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0430 Linux \u0441 \u0444\u043b\u0435\u0448\u043a\u0438<\/a>.<\/p>\n<h2 id=\"s10\">FAQ<\/h2>\n<p><strong>\u0412 \u0447\u0435\u043c \u0440\u0430\u0437\u043d\u0438\u0446\u0430 \u043c\u0435\u0436\u0434\u0443 stateless- \u0438 stateful-\u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0435\u0439?<\/strong><br \/>\nStateless-\u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0441\u043c\u043e\u0442\u0440\u0438\u0442 \u043d\u0430 \u043a\u0430\u0436\u0434\u044b\u0439 \u043f\u0430\u043a\u0435\u0442 \u043f\u043e \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0438 (IP, \u043f\u043e\u0440\u0442, \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b) \u0438 \u043d\u0435 \u0437\u043d\u0430\u0435\u0442 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0430. Stateful-\u0444\u0438\u043b\u044c\u0442\u0440 \u0447\u0435\u0440\u0435\u0437 \u043c\u043e\u0434\u0443\u043b\u044c <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">conntrack<\/code> \u043f\u043e\u043c\u043d\u0438\u0442 \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0441\u043e\u0435\u0434\u0438\u043d\u0435\u043d\u0438\u044f \u0438 \u0440\u0430\u0437\u043b\u0438\u0447\u0430\u0435\u0442 \u043d\u043e\u0432\u044b\u0435 \u043f\u0430\u043a\u0435\u0442\u044b \u0438 \u043e\u0442\u0432\u0435\u0442\u044b \u043d\u0430 \u0443\u0436\u0435 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u0441\u0435\u0430\u043d\u0441\u044b, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043f\u0440\u0430\u0432\u0438\u043b\u043e \u0441 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">--ctstate ESTABLISHED,RELATED<\/code> \u043f\u0440\u043e\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043e\u0442\u0432\u0435\u0442\u043d\u044b\u0439 \u0442\u0440\u0430\u0444\u0438\u043a \u0431\u0435\u0437 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0445 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439.<\/p>\n<p><strong>\u0427\u0435\u043c <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-m state<\/code> \u043e\u0442\u043b\u0438\u0447\u0430\u0435\u0442\u0441\u044f \u043e\u0442 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-m conntrack<\/code>?<\/strong><br \/>\n\u042d\u0442\u043e \u0434\u0432\u0430 \u043c\u043e\u0434\u0443\u043b\u044f \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0439. \u0421\u0442\u0430\u0440\u044b\u0439 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-m state --state<\/code> \u0441\u0447\u0438\u0442\u0430\u0435\u0442\u0441\u044f \u0443\u0441\u0442\u0430\u0440\u0435\u0432\u0448\u0438\u043c, \u043d\u043e \u0435\u0449\u0435 \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442; \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 &#8212; <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-m conntrack --ctstate<\/code> \u0441 \u0442\u0435\u043c\u0438 \u0436\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f\u043c\u0438 (NEW, ESTABLISHED, RELATED, INVALID) \u0438 \u0431\u043e\u043b\u0435\u0435 \u0448\u0438\u0440\u043e\u043a\u0438\u043c\u0438 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044f\u043c\u0438. \u0412 \u043d\u043e\u0432\u044b\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430\u0445 \u043b\u0443\u0447\u0448\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">conntrack<\/code>.<\/p>\n<p><strong>\u0427\u0442\u043e \u0432\u044b\u0431\u0440\u0430\u0442\u044c \u043d\u043e\u0432\u0438\u0447\u043a\u0443 &#8212; iptables, nftables \u0438\u043b\u0438 firewalld?<\/strong><br \/>\n\u0414\u043b\u044f \u043e\u0434\u0438\u043d\u043e\u0447\u043d\u043e\u0433\u043e \u0441\u0435\u0440\u0432\u0435\u0440\u0430 \u043f\u0440\u043e\u0449\u0435 \u043d\u0430\u0447\u0430\u0442\u044c \u0441 \u0432\u044b\u0441\u043e\u043a\u043e\u0443\u0440\u043e\u0432\u043d\u0435\u0432\u043e\u0439 \u043d\u0430\u0434\u0441\u0442\u0440\u043e\u0439\u043a\u0438: ufw \u0432 Ubuntu \u0438\u043b\u0438 firewalld \u0432 RHEL \u0438 Fedora. iptables \u0438 nftables \u0434\u0430\u044e\u0442 \u043f\u043e\u043b\u043d\u044b\u0439 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c \u0438 \u043d\u0443\u0436\u043d\u044b, \u043a\u043e\u0433\u0434\u0430 \u0441\u0442\u0430\u043d\u0434\u0430\u0440\u0442\u043d\u044b\u0445 \u043f\u0440\u043e\u0444\u0438\u043b\u0435\u0439 \u043d\u0435 \u0445\u0432\u0430\u0442\u0430\u0435\u0442. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c firewalld \u0438 ufw \u043f\u043e\u0434 \u043a\u0430\u043f\u043e\u0442\u043e\u043c \u043e\u043f\u0438\u0440\u0430\u044e\u0442\u0441\u044f \u043d\u0430 \u0442\u043e\u0442 \u0436\u0435 netfilter.<\/p>\n<h2 id=\"s11\">\u0412\u044b\u0432\u043e\u0434\u044b<\/h2>\n<ul>\n<li>iptables &#8212; \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430; \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 Netfilter \u0432 \u044f\u0434\u0440\u0435, \u0430 \u043c\u0435\u043d\u044f\u0442\u044c \u0438\u0445 \u043c\u043e\u0436\u043d\u043e \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 (\u043e\u0431\u044b\u0447\u043d\u043e \u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">sudo<\/code>).<\/li>\n<li>\u041f\u0440\u0430\u0432\u0438\u043b\u0430 \u0441\u0433\u0440\u0443\u043f\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u0432 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 (INPUT, OUTPUT, FORWARD, PREROUTING, POSTROUTING) \u0438 \u0442\u0430\u0431\u043b\u0438\u0446\u044b (filter, nat, mangle, raw); \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f filter.<\/li>\n<li>\u0412\u043d\u0443\u0442\u0440\u0438 \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0441\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u0435\u0442 \u043f\u0435\u0440\u0432\u043e\u0435 \u043f\u043e\u0434\u043e\u0448\u0435\u0434\u0448\u0435\u0435 \u043f\u0440\u0430\u0432\u0438\u043b\u043e, \u043f\u043e\u044d\u0442\u043e\u043c\u0443 \u043f\u043e\u0440\u044f\u0434\u043e\u043a \u0432\u0430\u0436\u0435\u043d; \u043d\u0430 \u0432\u0441\u0435 \u043d\u0435\u0441\u043e\u0432\u043f\u0430\u0432\u0448\u0435\u0435 \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u0435\u0442 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e (<code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-P<\/code>).<\/li>\n<li>\u0411\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0439 \u043f\u043e\u0440\u044f\u0434\u043e\u043a \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438: \u0441\u0434\u0435\u043b\u0430\u0442\u044c \u0431\u044d\u043a\u0430\u043f (<code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-save<\/code>) \u0438 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-apply<\/code>, \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0440\u0430\u0437\u0440\u0435\u0448\u0438\u0442\u044c established, loopback \u0438 SSH \u0441 \u043d\u0443\u0436\u043d\u043e\u0433\u043e \u0430\u0434\u0440\u0435\u0441\u0430, \u0438 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u043e\u0442\u043e\u043c \u0441\u0442\u0430\u0432\u0438\u0442\u044c <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-P INPUT DROP<\/code>.<\/li>\n<li>NAT (\u043c\u0430\u0441\u043a\u0430\u0440\u0430\u0434\u0438\u043d\u0433 \u0438 \u043f\u0440\u043e\u0431\u0440\u043e\u0441 \u043f\u043e\u0440\u0442\u043e\u0432) \u0436\u0438\u0432\u0435\u0442 \u0432 \u0442\u0430\u0431\u043b\u0438\u0446\u0435 nat \u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442 \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u043e\u0439 \u043f\u0435\u0440\u0435\u0441\u044b\u043b\u043a\u0438 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">net.ipv4.ip_forward=1<\/code>; \u043c\u0430\u0441\u043a\u0430\u0440\u0430\u0434\u0438\u043d\u0433 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u044e\u0442 \u0441\u0432\u043e\u0435\u0439 \u043f\u043e\u0434\u0441\u0435\u0442\u044c\u044e \u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">-s<\/code>.<\/li>\n<li>IPv6 \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u044e\u0442 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e \u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">ip6tables<\/code>, \u0438\u043d\u0430\u0447\u0435 \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0439 \u043f\u0443\u0442\u044c \u0432 \u043e\u0431\u0445\u043e\u0434 IPv4-\u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438; backend (legacy \u0438\u043b\u0438 nf_tables) \u043d\u0435 \u0441\u043c\u0435\u0448\u0438\u0432\u0430\u044e\u0442.<\/li>\n<li>\u041f\u0440\u0430\u0432\u0438\u043b\u0430 \u043d\u0435 \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u044e\u0442\u0441\u044f \u0441\u0430\u043c\u0438: \u0438\u0445 \u0432\u044b\u0433\u0440\u0443\u0436\u0430\u044e\u0442 \u0447\u0435\u0440\u0435\u0437 <code style=\"background:#eef0f3;color:#24292f;border-radius:4px;padding:1px 5px;font-size:0.92em;font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace\">iptables-save<\/code>, \u043f\u043e\u0434\u043d\u0438\u043c\u0430\u044e\u0442 \u043f\u0440\u0438 \u0441\u0442\u0430\u0440\u0442\u0435 \u043f\u0430\u043a\u0435\u0442\u043e\u043c \u0430\u0432\u0442\u043e\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u043f\u043e\u0434 \u0441\u0432\u043e\u0439 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432 \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u044e\u0442 \u043f\u043e\u0441\u043b\u0435 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438.<\/li>\n<li>\u0412 \u0441\u043e\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u0430\u0445 iptables &#8212; \u044d\u0442\u043e \u043e\u0431\u0435\u0440\u0442\u043a\u0430 \u043d\u0430\u0434 nftables; \u0434\u043b\u044f \u043d\u043e\u0432\u044b\u0445 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0439 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f nftables, \u043d\u043e \u043f\u043e\u043d\u0438\u043c\u0430\u043d\u0438\u0435 iptables \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u0431\u0430\u0437\u043e\u0439.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>iptables &#8212; \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u0441\u043a\u0430\u044f \u0443\u0442\u0438\u043b\u0438\u0442\u0430 \u0434\u043b\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043f\u0440\u0430\u0432\u0438\u043b \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u0438 \u0438 NAT, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u0442 \u043f\u043e\u0434\u0441\u0438\u0441\u0442\u0435\u043c\u0430 Netfilter \u0432 \u044f\u0434\u0440\u0435 Linux. \u041f\u0440\u0430\u0432\u0438\u043b\u043e \u0437\u0430\u0434\u0430\u0435\u0442, \u0447\u0442\u043e \u044f\u0434\u0440\u043e \u0441\u0434\u0435\u043b\u0430\u0435\u0442 \u0441 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u043f\u0430\u043a\u0435\u0442\u043e\u043c: \u043f\u0440\u043e\u043f\u0443\u0441\u0442\u0438\u0442\u044c, \u043e\u0442\u0431\u0440\u043e\u0441\u0438\u0442\u044c \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0438\u0442\u044c. Netfilter \u0432\u0441\u0442\u0440\u043e\u0435\u043d \u0432 \u044f\u0434\u0440\u043e \u0441 \u0432\u0435\u0440\u0441\u0438\u0438 2.4 (2001 \u0433\u043e\u0434), \u043d\u043e \u0441\u0430\u043c \u043f\u0430\u043a\u0435\u0442 iptables \u0434\u043e\u0441\u0442\u0443\u043f\u0435\u043d \u0432 \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u0435 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 \u0438 \u043c\u043e\u0436\u0435\u0442 \u043d\u0435 \u0432\u0445\u043e\u0434\u0438\u0442\u044c \u0432 \u043c\u0438\u043d\u0438\u043c\u0430\u043b\u044c\u043d\u0443\u044e \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 &#8212; \u043f\u0435\u0440\u0435\u0434 [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-11530","post","type-post","status-publish","format-standard","","category-pro-it"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u0442\u0430\u0431\u043b\u0438\u0446\u044b, \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 iptables, \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u044b\u0439 firewall \u0434\u043b\u044f IPv4 \u0438 IPv6, \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e, \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0438 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043e\u0442\u043a\u0430\u0442.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Nicolay Alexandrov\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#article\",\"name\":\"iptables \\u0432 Linux: firewall \\u0431\\u0435\\u0437 \\u043f\\u043e\\u0442\\u0435\\u0440\\u0438 \\u0434\\u043e\\u0441\\u0442\\u0443\\u043f\\u0430 | Otus\",\"headline\":\"iptables \\u0432 Linux: \\u0443\\u0441\\u0442\\u0440\\u043e\\u0439\\u0441\\u0442\\u0432\\u043e \\u043f\\u0440\\u0430\\u0432\\u0438\\u043b \\u0438 \\u0431\\u0435\\u0437\\u043e\\u043f\\u0430\\u0441\\u043d\\u0430\\u044f \\u043d\\u0430\\u0441\\u0442\\u0440\\u043e\\u0439\\u043a\\u0430 firewall\",\"author\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/author\\\/nick-alex\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/otus.ru\\\/journal\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/OTUS-journal-logo-180x180-1.png\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/#articleImage\",\"width\":180,\"height\":180},\"datePublished\":\"2026-09-17T09:00:00+00:00\",\"dateModified\":\"2026-09-25T15:47:14+00:00\",\"inLanguage\":\"ru-RU\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#webpage\"},\"articleSection\":\"\\u041f\\u0440\\u043e IT\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/otus.ru\\\/journal\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/category\\\/pro-it\\\/#listItem\",\"name\":\"\\u041f\\u0440\\u043e IT\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/category\\\/pro-it\\\/#listItem\",\"position\":2,\"name\":\"\\u041f\\u0440\\u043e IT\",\"item\":\"https:\\\/\\\/otus.ru\\\/journal\\\/category\\\/pro-it\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#listItem\",\"name\":\"iptables \\u0432 Linux: \\u0443\\u0441\\u0442\\u0440\\u043e\\u0439\\u0441\\u0442\\u0432\\u043e \\u043f\\u0440\\u0430\\u0432\\u0438\\u043b \\u0438 \\u0431\\u0435\\u0437\\u043e\\u043f\\u0430\\u0441\\u043d\\u0430\\u044f \\u043d\\u0430\\u0441\\u0442\\u0440\\u043e\\u0439\\u043a\\u0430 firewall\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#listItem\",\"position\":3,\"name\":\"iptables \\u0432 Linux: \\u0443\\u0441\\u0442\\u0440\\u043e\\u0439\\u0441\\u0442\\u0432\\u043e \\u043f\\u0440\\u0430\\u0432\\u0438\\u043b \\u0438 \\u0431\\u0435\\u0437\\u043e\\u043f\\u0430\\u0441\\u043d\\u0430\\u044f \\u043d\\u0430\\u0441\\u0442\\u0440\\u043e\\u0439\\u043a\\u0430 firewall\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/category\\\/pro-it\\\/#listItem\",\"name\":\"\\u041f\\u0440\\u043e IT\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/#organization\",\"name\":\"\\u041e\\u0442\\u0443\\u0441 \\u043e\\u043d\\u043b\\u0430\\u0439\\u043d-\\u043e\\u0431\\u0440\\u0430\\u0437\\u043e\\u0432\\u0430\\u043d\\u0438\\u0435\",\"description\":\"\\u0411\\u043b\\u043e\\u0433 \\u043f\\u0440\\u043e IT\",\"url\":\"https:\\\/\\\/otus.ru\\\/journal\\\/\",\"telephone\":\"+74999389202\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/otus.ru\\\/journal\\\/wp-content\\\/uploads\\\/2026\\\/04\\\/OTUS-journal-logo-180x180-1.png\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#organizationLogo\",\"width\":180,\"height\":180},\"image\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/channel\\\/UCetgtvy93o3i3CvyGXKFU3g\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/author\\\/nick-alex\\\/#author\",\"url\":\"https:\\\/\\\/otus.ru\\\/journal\\\/author\\\/nick-alex\\\/\",\"name\":\"Nicolay Alexandrov\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/6995f71ff1d23ddbc1c20fa25d779855e75a2fe5da02a98cb12d974d1f1b5057?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Nicolay Alexandrov\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#webpage\",\"url\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/\",\"name\":\"iptables \\u0432 Linux: firewall \\u0431\\u0435\\u0437 \\u043f\\u043e\\u0442\\u0435\\u0440\\u0438 \\u0434\\u043e\\u0441\\u0442\\u0443\\u043f\\u0430 | Otus\",\"description\":\"\\u0420\\u0430\\u0437\\u0431\\u0438\\u0440\\u0430\\u0435\\u043c \\u0442\\u0430\\u0431\\u043b\\u0438\\u0446\\u044b, \\u0446\\u0435\\u043f\\u043e\\u0447\\u043a\\u0438 \\u0438 \\u043f\\u0440\\u0430\\u0432\\u0438\\u043b\\u0430 iptables, \\u043d\\u0430\\u0441\\u0442\\u0440\\u0430\\u0438\\u0432\\u0430\\u0435\\u043c \\u0431\\u0430\\u0437\\u043e\\u0432\\u044b\\u0439 firewall \\u0434\\u043b\\u044f IPv4 \\u0438 IPv6, \\u043f\\u0440\\u043e\\u0432\\u0435\\u0440\\u044f\\u0435\\u043c \\u043a\\u043e\\u043d\\u0444\\u0438\\u0433\\u0443\\u0440\\u0430\\u0446\\u0438\\u044e, \\u0441\\u043e\\u0445\\u0440\\u0430\\u043d\\u044f\\u0435\\u043c \\u043f\\u0440\\u0430\\u0432\\u0438\\u043b\\u0430 \\u0438 \\u0433\\u043e\\u0442\\u043e\\u0432\\u0438\\u043c \\u043e\\u0442\\u043a\\u0430\\u0442.\",\"inLanguage\":\"ru-RU\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/author\\\/nick-alex\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/author\\\/nick-alex\\\/#author\"},\"datePublished\":\"2026-09-17T09:00:00+00:00\",\"dateModified\":\"2026-09-25T15:47:14+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/#website\",\"url\":\"https:\\\/\\\/otus.ru\\\/journal\\\/\",\"name\":\"OTUS \\u0416\\u0443\\u0440\\u043d\\u0430\\u043b - \\u0411\\u043b\\u043e\\u0433 \\u043f\\u0440\\u043e IT\",\"alternateName\":\"OTUS \\u0416\\u0443\\u0440\\u043d\\u0430\\u043b\",\"description\":\"\\u0411\\u043b\\u043e\\u0433 \\u043f\\u0440\\u043e IT\",\"inLanguage\":\"ru-RU\",\"publisher\":{\"@id\":\"https:\\\/\\\/otus.ru\\\/journal\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"iptables \u0432 Linux: firewall \u0431\u0435\u0437 \u043f\u043e\u0442\u0435\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | Otus","description":"\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u0442\u0430\u0431\u043b\u0438\u0446\u044b, \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 iptables, \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u044b\u0439 firewall \u0434\u043b\u044f IPv4 \u0438 IPv6, \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e, \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0438 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043e\u0442\u043a\u0430\u0442.","canonical_url":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#article","name":"iptables \u0432 Linux: firewall \u0431\u0435\u0437 \u043f\u043e\u0442\u0435\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | Otus","headline":"iptables \u0432 Linux: \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0430\u0432\u0438\u043b \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 firewall","author":{"@id":"https:\/\/otus.ru\/journal\/author\/nick-alex\/#author"},"publisher":{"@id":"https:\/\/otus.ru\/journal\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/otus.ru\/journal\/wp-content\/uploads\/2026\/04\/OTUS-journal-logo-180x180-1.png","@id":"https:\/\/otus.ru\/journal\/#articleImage","width":180,"height":180},"datePublished":"2026-09-17T09:00:00+00:00","dateModified":"2026-09-25T15:47:14+00:00","inLanguage":"ru-RU","mainEntityOfPage":{"@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#webpage"},"isPartOf":{"@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#webpage"},"articleSection":"\u041f\u0440\u043e IT"},{"@type":"BreadcrumbList","@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/otus.ru\/journal\/#listItem","position":1,"name":"Home","item":"https:\/\/otus.ru\/journal\/","nextItem":{"@type":"ListItem","@id":"https:\/\/otus.ru\/journal\/category\/pro-it\/#listItem","name":"\u041f\u0440\u043e IT"}},{"@type":"ListItem","@id":"https:\/\/otus.ru\/journal\/category\/pro-it\/#listItem","position":2,"name":"\u041f\u0440\u043e IT","item":"https:\/\/otus.ru\/journal\/category\/pro-it\/","nextItem":{"@type":"ListItem","@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#listItem","name":"iptables \u0432 Linux: \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0430\u0432\u0438\u043b \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 firewall"},"previousItem":{"@type":"ListItem","@id":"https:\/\/otus.ru\/journal\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#listItem","position":3,"name":"iptables \u0432 Linux: \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0430\u0432\u0438\u043b \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 firewall","previousItem":{"@type":"ListItem","@id":"https:\/\/otus.ru\/journal\/category\/pro-it\/#listItem","name":"\u041f\u0440\u043e IT"}}]},{"@type":"Organization","@id":"https:\/\/otus.ru\/journal\/#organization","name":"\u041e\u0442\u0443\u0441 \u043e\u043d\u043b\u0430\u0439\u043d-\u043e\u0431\u0440\u0430\u0437\u043e\u0432\u0430\u043d\u0438\u0435","description":"\u0411\u043b\u043e\u0433 \u043f\u0440\u043e IT","url":"https:\/\/otus.ru\/journal\/","telephone":"+74999389202","logo":{"@type":"ImageObject","url":"https:\/\/otus.ru\/journal\/wp-content\/uploads\/2026\/04\/OTUS-journal-logo-180x180-1.png","@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#organizationLogo","width":180,"height":180},"image":{"@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#organizationLogo"},"sameAs":["https:\/\/www.youtube.com\/channel\/UCetgtvy93o3i3CvyGXKFU3g"]},{"@type":"Person","@id":"https:\/\/otus.ru\/journal\/author\/nick-alex\/#author","url":"https:\/\/otus.ru\/journal\/author\/nick-alex\/","name":"Nicolay Alexandrov","image":{"@type":"ImageObject","@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/6995f71ff1d23ddbc1c20fa25d779855e75a2fe5da02a98cb12d974d1f1b5057?s=96&d=mm&r=g","width":96,"height":96,"caption":"Nicolay Alexandrov"}},{"@type":"WebPage","@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#webpage","url":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/","name":"iptables \u0432 Linux: firewall \u0431\u0435\u0437 \u043f\u043e\u0442\u0435\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | Otus","description":"\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u0442\u0430\u0431\u043b\u0438\u0446\u044b, \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 iptables, \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u044b\u0439 firewall \u0434\u043b\u044f IPv4 \u0438 IPv6, \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e, \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0438 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043e\u0442\u043a\u0430\u0442.","inLanguage":"ru-RU","isPartOf":{"@id":"https:\/\/otus.ru\/journal\/#website"},"breadcrumb":{"@id":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/#breadcrumblist"},"author":{"@id":"https:\/\/otus.ru\/journal\/author\/nick-alex\/#author"},"creator":{"@id":"https:\/\/otus.ru\/journal\/author\/nick-alex\/#author"},"datePublished":"2026-09-17T09:00:00+00:00","dateModified":"2026-09-25T15:47:14+00:00"},{"@type":"WebSite","@id":"https:\/\/otus.ru\/journal\/#website","url":"https:\/\/otus.ru\/journal\/","name":"OTUS \u0416\u0443\u0440\u043d\u0430\u043b - \u0411\u043b\u043e\u0433 \u043f\u0440\u043e IT","alternateName":"OTUS \u0416\u0443\u0440\u043d\u0430\u043b","description":"\u0411\u043b\u043e\u0433 \u043f\u0440\u043e IT","inLanguage":"ru-RU","publisher":{"@id":"https:\/\/otus.ru\/journal\/#organization"}}]}},"aioseo_meta_data":{"post_id":"11530","title":"iptables \u0432 Linux: firewall \u0431\u0435\u0437 \u043f\u043e\u0442\u0435\u0440\u0438 \u0434\u043e\u0441\u0442\u0443\u043f\u0430 | Otus","description":"\u0420\u0430\u0437\u0431\u0438\u0440\u0430\u0435\u043c \u0442\u0430\u0431\u043b\u0438\u0446\u044b, \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0438 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 iptables, \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u0435\u043c \u0431\u0430\u0437\u043e\u0432\u044b\u0439 firewall \u0434\u043b\u044f IPv4 \u0438 IPv6, \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u043c \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u044e, \u0441\u043e\u0445\u0440\u0430\u043d\u044f\u0435\u043c \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0438 \u0433\u043e\u0442\u043e\u0432\u0438\u043c \u043e\u0442\u043a\u0430\u0442.","keywords":[],"keyphrases":{"focus":[],"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":[],"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","location":null,"local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":null,"created":"2025-04-23 09:02:04","updated":"2026-09-25 16:24:15","seo_analyzer_scan_date":null,"focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/otus.ru\/journal\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/otus.ru\/journal\/category\/pro-it\/\" title=\"\u041f\u0440\u043e IT\">\u041f\u0440\u043e IT<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tiptables \u0432 Linux: \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0430\u0432\u0438\u043b \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 firewall\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/otus.ru\/journal\/"},{"label":"\u041f\u0440\u043e IT","link":"https:\/\/otus.ru\/journal\/category\/pro-it\/"},{"label":"iptables \u0432 Linux: \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u043e \u043f\u0440\u0430\u0432\u0438\u043b \u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u0430\u044f \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0430 firewall","link":"https:\/\/otus.ru\/journal\/polnoe-rukovodstvo-po-iptables-kak-nastroit-firewall-v-linux\/"}],"_links":{"self":[{"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/posts\/11530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/comments?post=11530"}],"version-history":[{"count":4,"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/posts\/11530\/revisions"}],"predecessor-version":[{"id":13325,"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/posts\/11530\/revisions\/13325"}],"wp:attachment":[{"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/media?parent=11530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/categories?post=11530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/otus.ru\/journal\/wp-json\/wp\/v2\/tags?post=11530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}