ifconfig在centos6中是默認安裝的，centos7版本默認是沒有這個命令的，需要使用yum來進行安裝： yum install net-tools
使用ifdown和ifup單獨啟動個別網卡

[root@localhost /]# ifdown enp0s3 && ifup enp0s3
成功斷開設備 ‘enp0s3‘。
成功激活的連接（D-Bus 激活路徑：/org/freedesktop/NetworkManager/ActiveConnection/2）

設置虛擬網卡，拷貝原網卡文件，修改網卡配置文件中的網卡名稱再次重啟後生成虛擬網卡，生成的虛擬網卡是一個有獨立ip的設備 ，可以使用這個ip和其他主機進行通信

[root@localhost network-scripts]# cp ifcfg-enp0s3 ifcfg-enp0s3\:0
[root@localhost network-scripts]# vim ifcfg-enp0s3\:0
TYPE=Ethernet
BOOTPROTO=static
DEFROUTE=yes
PEERROUTES=yes
IPV4_FAILURE_FATAL=no
NAME=enp0s3:0
UUID=bf8adc16-a9c3-494a-b47e-f572fad38639
DEVICE=enp0s3:0
[root@localhost network-scripts]# ifdown enp0s3 && ifup enp0s3
成功斷開設備 ‘enp0s3‘。
成功激活的連接（D-Bus 激活路徑：/org/freedesktop/NetworkManager/ActiveConnection/3）
[root@localhost network-scripts]# ifconfig
enp0s3: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
        inet 192.168.1.223 netmask 255.255.255.0 broadcast 192.168.1.255
        ether 08:00:27:a7:f9:c2 txqueuelen 1000 (Ethernet)
        RX packets 20698 bytes 21236657 (20.2 MiB)
        RX errors 0 dropped 0 overruns 0 frame 0
        TX packets 9509 bytes 924400 (902.7 KiB)
        TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0

enp0s3:0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
        inet 192.168.1.233 netmask 255.255.255.0 broadcast 192.168.1.255
        ether 08:00:27:a7:f9:c2 txqueuelen 1000 (Ethernet)
 

臨時修改主機名hostname 主機名 ； 永久修改linux主機名vim /etc/hostname ，重啟或source /etc/profile 重新加載系統環境變量文件
DNS配置文件： /etc/resolv.conf這裏的DNS文件優先級會低於網卡配置文件中指定的DNS，如果發生重啟會被網卡中的DNS配置所覆蓋
linux中簡單解析文件：/etc/hosts ，修改的解析只在本機生效， 一行內一個ip可以配置多個對應域名

[root@localhost network-scripts]# vim /etc/hosts
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.1.233 www.bilibili.com www.abc.com www.123.com
[root@localhost network-scripts]# ping www.bilibili.com
PING www.bilibili.com (192.168.1.233) 56(84) bytes of data.
64 bytes from www.bilibili.com (192.168.1.233): icmp_seq=1 ttl=64 time=0.219 ms
 

firewalld和netfilter工具

關閉selinux工具，selinux默認開啟狀態，安裝某些服務selinux會影響服務正常啟動，臨時關閉selinux：

[root@localhost network-scripts]# setenforce 0
[root@localhost network-scripts]# getenforce 
Disabled

永久關閉selinux

[root@localhost ~]# vim /etc/selinux/config 

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#     enforcing - SELinux security policy is enforced.
#     permissive - SELinux prints warnings instead of enforcing.
#     disabled - No SELinux policy is loaded.
SELINUX=disabled
# SELINUXTYPE= can take one of three two values:
#     targeted - Targeted processes are protected,
#     minimum - Modification of targeted policy. Only selected processes are protected. 
#     mls - Multi Level Security protection.
SELINUXTYPE=targeted

停用firewalld改為使用netfilter工具，需要安裝iptables-services的yum包文件

[root@localhost network-scripts]# systemctl disable firewalld
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
Removed symlink /etc/systemd/system/basic.target.wants/firewalld.service.
[root@localhost network-scripts]# systemctl stop firewalld
[root@localhost network-scripts]# yum install -y iptables-services
已加載插件：fastestmirror
Loading mirror speeds from cached hostfile
 * base: mirrors.aliyun.com
 * epel: mirrors.ustc.edu.cn
 * extras: mirrors.aliyun.com
 * updates: mirrors.sohu.com
正在解決依賴關系
--> 正在檢查事務
---> 軟件包 iptables-services.x86_64.0.1.4.21-24.1.el7_5 將被 安裝
--> 正在處理依賴關系 iptables = 1.4.21-24.1.el7_5，它被軟件包 iptables-services-1.4.21-24.1.el7_5.x86_64 需要
--> 正在檢查事務
---> 軟件包 iptables.x86_64.0.1.4.21-17.el7 將被 升級
---> 軟件包 iptables.x86_64.0.1.4.21-24.1.el7_5 將被 更新
--> 解決依賴關系完成
已安裝:
  iptables-services.x86_64 0:1.4.21-24.1.el7_5                                                                                   

作為依賴被升級:
  iptables.x86_64 0:1.4.21-24.1.el7_5                                                                                            

完畢！
[root@localhost network-scripts]# systemctl enable iptables
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
[root@localhost network-scripts]# systemctl start iptables
[root@localhost network-scripts]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   51  3496 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     icmp --  *      *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
    8   699 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 29 packets, 2876 bytes)
 pkts bytes target     prot opt in     out     source               destination 

iptables只是netfilter使用的一個工具，只是在使用的時候我們通常稱為iptables

netfilter5表5鏈介紹

filter表：默認的一張表，表中包含INPUT、OUTPUT和FORWARD鏈
INPUT表示進入本機流量的過濾鏈，檢測端口或來源ip
FORWARD轉發鏈，檢查是否為本機流量，非本機流量將會被轉發
OUTPUT本機出流量，可禁止到某ip的數據包

nat表：流量數據包轉發
PREROUTING數據包進入時更改來源ip
POSTROUTING數據包轉發出去是修改目的ip
實現內網服務器和公網服務器之間互相通信，需要在一臺出口設備上做端口映射，也就是使用PREROUTING和POSTROUTING鏈

mangle表：給數據包做標記，如數據類型
raw表：可以實現不追蹤某些數據包
security表：加強訪問控制的(MAC)網絡規則

iptables語法
iptables -nvL查看默認filter表的規則

[root@localhost network-scripts]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination         
  984 83612 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
    0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0           
    0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0           
    0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
 3211 287K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination         
    0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 772 packets, 175K bytes)
 pkts bytes target prot opt in out source destination 

iptables -F 清空規則
iptables -t nat -nvL 指定表查看規則

[root@localhost network-scripts]# iptables -t nat -nvL
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination         

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination         

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination         

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination 

iptables -Z 清零計數器
記錄通過規則鏈的數據流累計信息，可以通過記錄數判斷數據量大小，可以根據數據量發送接收大小來做限制

iptables -A INPUT -s 192.168.1.112 -p tcp --sport 1234 -d 192.168.1.223 --dport 80 -j DROP/REJECT 禁止1.112通過1234端口向223發送數據

[root@localhost network-scripts]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination         
 1142 95952 ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
    0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0           
    0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0           
    0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
 4450 397K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
    0 0 DROP tcp -- * * 192.168.1.112 192.168.1.223 tcp spt:1234 dpt:80

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination         
    0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 17 packets, 1676 bytes)
 pkts bytes target prot opt in out source destination

-A 在現有規則後新增一條新規則
-I 在現有規則最前面插入一條規則
-I和-A的區別：匹配規則時會優先從最前面規則進行匹配，如果匹配到規則後就不會再往下匹配了

刪除iptables規則
iptables -D INPUT 規則序號

[root@localhost network-scripts]# iptables -D INPUT 6
[root@localhost network-scripts]# iptables -nvL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination         
 1200 100K ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
    0 0 ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0           
    0 0 ACCEPT all -- lo * 0.0.0.0/0 0.0.0.0/0           
    0 0 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
 4606 409K REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target prot opt in out source destination         
    0 0 REJECT all -- * * 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT 4 packets, 512 bytes)
 pkts bytes target prot opt in out source destination   

修改鏈默認的匹配規則，註意如果寫入拒絕語句之前，請放行需要使用的端口，否則會造成通信中斷(如ssh服務的22端口)
iptables -P INPUT DROP

[root@localhost ~]# iptables -A INPUT -p tcp --dport 22 -j ACCEPT
[root@localhost ~]# iptables -A OUTPUT -p tcp --dport 22 -j ACCEPT
[root@localhost ~]# iptables -A OUTPUT -p tcp --sport 22 -j ACCEPT
[root@localhost ~]# iptables -A INPUT -p tcp --sport 22 -j ACCEPT
[root@localhost ~]# iptables -P INPUT DROP
[root@localhost ~]# iptables -nvL
Chain INPUT (policy DROP 0 packets, 0 bytes)

iptables基本用法和linux網絡相關