手册小栈

中文

English

中文

English

Appearance

9. 网络基础 ​

9.1 网络配置查看 ​

bash
# 查看网络接口信息（推荐）
ip addr show
ip a       # 缩写

# 查看路由表
ip route show
ip r       # 缩写

# 老式命令（已逐渐淘汰，但仍在使用）
ifconfig
route -n
bash
$ ip a
1: lo:  mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
2: eth0:  mtu 1500 qdisc fq_codel state UP group default qlen 1000
    link/ether 08:00:27:a1:b2:c3 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.100/24 brd 192.168.1.255 scope global dynamic eth0
       valid_lft 86300sec preferred_lft 86300sec

$ ip r
default via 192.168.1.1 dev eth0 proto dhcp metric 100
192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.100 metric 100

9.2 网络诊断工具 ​

bash
# ping — 测试连通性
ping -c 4 google.com

# ss — 查看套接字信息（替代 netstat）
ss -tulnp       # t=TCP, u=UDP, l=监听, n=数字, p=进程

# netstat — 老式套接字查看
netstat -tulnp

# curl — HTTP 请求工具
curl https://httpbin.org/ip
curl -I https://example.com         # 只获取响应头
curl -o file.tar.gz https://example.com/file.tar.gz  # 下载文件

# wget — 下载工具
wget https://example.com/file.tar.gz
wget -c https://example.com/large.iso  # 断点续传

# dig / nslookup — DNS 查询
dig example.com
nslookup example.com

# traceroute — 追踪路由
traceroute google.com

# mtr — 实时路由追踪
mtr google.com
bash
$ ping -c 4 google.com
PING google.com (142.250.80.46) 56(84) bytes of data.
64 bytes from 142.250.80.46: icmp_seq=1 ttl=116 time=5.23 ms
64 bytes from 142.250.80.46: icmp_seq=2 ttl=116 time=5.45 ms
64 bytes from 142.250.80.46: icmp_seq=3 ttl=116 time=5.12 ms
64 bytes from 142.250.80.46: icmp_seq=4 ttl=116 time=5.34 ms

--- google.com ping statistics ---
4 packets transmitted, 4 received, 0% packet loss, time 3005ms
rtt min/avg/max/mdev = 5.120/5.285/5.450/0.123 ms

$ ss -tulnp
Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:Port Process
tcp   LISTEN 0      128          0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=1234,fd=3))
tcp   LISTEN 0      511          0.0.0.0:80         0.0.0.0:*    users:(("nginx",pid=5678,fd=6))
tcp   LISTEN 0      128             [::]:22            [::]:*    users:(("sshd",pid=1234,fd=4))

$ curl -s https://httpbin.org/ip
{
  "origin": "203.0.113.45"
}

$ dig example.com +short
93.184.216.34

9.3 防火墙基础（ufw / firewalld） ​

bash
# Ubuntu — ufw (Uncomplicated Firewall)
sudo ufw status
sudo ufw enable
sudo ufw allow 22/tcp            # 允许 SSH
sudo ufw allow 80,443/tcp        # 允许 HTTP/HTTPS
sudo ufw allow from 192.168.1.0/24  # 允许内网访问
sudo ufw deny 3306               # 禁止 MySQL 端口
sudo ufw delete allow 80/tcp     # 删除规则

# CentOS/RHEL — firewalld
sudo firewall-cmd --state
sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --add-port=8080/tcp --permanent
sudo firewall-cmd --reload

# iptables（底层工具，所有防火墙的底层）
sudo iptables -L -n -v            # 查看规则
sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT
sudo iptables -A INPUT -s 10.0.0.0/8 -j DROP
bash
$ sudo ufw status verbose
Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW IN    Anywhere
80,443/tcp                 ALLOW IN    Anywhere
192.168.1.0/24             ALLOW IN    Anywhere

⚠️ 注意： ⚠️ 重要：远程服务器配置防火墙时，务必先允许 SSH 端口，否则你会被锁在门外！

相关阅读