{"id":37951,"date":"2026-01-19T13:31:10","date_gmt":"2026-01-19T10:31:10","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/"},"modified":"2026-01-19T13:31:10","modified_gmt":"2026-01-19T10:31:10","slug":"belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/","title":{"rendered":"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi"},"content":{"rendered":"

Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi<\/h2>\n

Linux sistemlerde g\u00fcvenlik, kullan\u0131c\u0131lar\u0131n ve servislerin birbirlerinden izole edilmesiyle \u00f6nemli \u00f6l\u00e7\u00fcde art\u0131r\u0131labilir. \u00d6zellikle belirli bir kullan\u0131c\u0131n\u0131n veya bu kullan\u0131c\u0131 alt\u0131nda \u00e7al\u0131\u015fan bir servisin sadece ihtiya\u00e7 duydu\u011fu a\u011f ba\u011flant\u0131lar\u0131n\u0131 kurmas\u0131na izin vermek, olas\u0131 g\u00fcvenlik ihlallerinin etkisini s\u0131n\u0131rlamak i\u00e7in kritik bir ad\u0131md\u0131r. Bu makalede, iptables<\/code> kullanarak belirli bir Linux kullan\u0131c\u0131s\u0131n\u0131n giden (outbound) a\u011f trafi\u011fini nas\u0131l engelleyece\u011fimizi, ancak ayn\u0131 zamanda bu kullan\u0131c\u0131n\u0131n dinleme (listening) portlar\u0131 \u00fczerinden gelen ba\u011flant\u0131lara yan\u0131t verebilmesini nas\u0131l sa\u011flayaca\u011f\u0131m\u0131z\u0131 detayl\u0131ca inceleyece\u011fiz. Bu sayede, g\u00fcvenlikten \u00f6d\u00fcn vermeden servis s\u00fcreklili\u011fini sa\u011flaman\u0131n yollar\u0131n\u0131 ke\u015ffedece\u011fiz.<\/p>\n

Neden Belirli Bir Kullan\u0131c\u0131n\u0131n Giden Trafi\u011fini K\u0131s\u0131tlamal\u0131y\u0131z?<\/h3>\n

Bir Linux sisteminde kullan\u0131c\u0131 bazl\u0131 a\u011f trafi\u011fi k\u0131s\u0131tlamalar\u0131 uygulamak, g\u00fcvenlik duru\u015funu \u00f6nemli \u00f6l\u00e7\u00fcde g\u00fc\u00e7lendiren proaktif bir yakla\u015f\u0131md\u0131r. Bu t\u00fcr k\u0131s\u0131tlamalar, sistemin genel b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc korumak ve potansiyel tehditlerin yay\u0131lmas\u0131n\u0131 engellemek i\u00e7in hayati \u00f6neme sahiptir.<\/p>\n

G\u00fcvenlik \u0130zolasyonu<\/h4>\n

Kullan\u0131c\u0131 bazl\u0131 trafik engelleme, bir g\u00fcvenlik ihlali durumunda hasar\u0131n yay\u0131lmas\u0131n\u0131 s\u0131n\u0131rlar. \u00d6rne\u011fin, bir web uygulamas\u0131n\u0131n g\u00fcvenlik a\u00e7\u0131\u011f\u0131 nedeniyle ele ge\u00e7irilmesi durumunda, bu uygulaman\u0131n \u00e7al\u0131\u015ft\u0131\u011f\u0131 kullan\u0131c\u0131n\u0131n giden trafi\u011fi k\u0131s\u0131tlanm\u0131\u015fsa, sald\u0131rgan\u0131n sistemi d\u0131\u015f d\u00fcnyaya ba\u011flamak (command and control sunucular\u0131na ba\u011flanmak, veri s\u0131zd\u0131rmak vb.) i\u00e7in kullanabilece\u011fi kanallar daral\u0131r veya tamamen kapan\u0131r. Bu, sald\u0131rgan\u0131n hareket alan\u0131n\u0131 k\u0131s\u0131tlayarak ihlalin etkisini minimize eder.<\/p>\n

Kaynak Kontrol\u00fc ve K\u00f6t\u00fcye Kullan\u0131m\u0131 \u00d6nleme<\/h4>\n

Baz\u0131 uygulamalar veya servisler, beklenmedik veya istenmeyen a\u011f ba\u011flant\u0131lar\u0131 kurma potansiyeline sahiptir. \u00d6rne\u011fin, bir test kullan\u0131c\u0131s\u0131n\u0131n yanl\u0131\u015fl\u0131kla veya k\u00f6t\u00fc niyetle internete eri\u015ferek sistem kaynaklar\u0131n\u0131 t\u00fcketmesini veya hassas verilere ula\u015fmas\u0131n\u0131 engelleyebilirsiniz. Bu t\u00fcr k\u0131s\u0131tlamalar, sistem kaynaklar\u0131n\u0131n verimli kullan\u0131lmas\u0131n\u0131 sa\u011flar ve yetkisiz eri\u015fim denemelerini engeller.<\/p>\n

Politika Uygulama ve Uyumluluk<\/h4>\n

Kurumsal ortamlarda veya belirli uyumluluk standartlar\u0131na (GDPR, HIPAA vb.) tabi sistemlerde, kullan\u0131c\u0131lar\u0131n veya servislerin belirli a\u011f kaynaklar\u0131na eri\u015fimi kat\u0131 kurallarla belirlenmelidir. iptables<\/code> kurallar\u0131, bu politikalar\u0131n teknik d\u00fczeyde uygulanmas\u0131n\u0131 sa\u011flar. \u00d6rne\u011fin, bir veritaban\u0131 kullan\u0131c\u0131s\u0131n\u0131n sadece veritaban\u0131 sunucusuna ba\u011flanmas\u0131na izin verilirken, di\u011fer t\u00fcm giden ba\u011flant\u0131lar\u0131 engellenebilir. Bu, veri b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc ve gizlili\u011fini korumak i\u00e7in kritik bir ad\u0131md\u0131r.<\/p>\n

\u00d6rnek Senaryolar<\/h4>\n

* Web Sunucusu Kullan\u0131c\u0131lar\u0131:<\/strong> nginx<\/code> veya apache<\/code> gibi web sunucular\u0131n\u0131n genellikle www-data<\/code> veya apache<\/code> gibi \u00f6zel kullan\u0131c\u0131lar alt\u0131nda \u00e7al\u0131\u015ft\u0131r\u0131lmas\u0131 yayg\u0131nd\u0131r. Bu kullan\u0131c\u0131lar\u0131n, web i\u00e7eri\u011fi sunmak d\u0131\u015f\u0131nda d\u0131\u015far\u0131ya ba\u011flant\u0131 kurmalar\u0131 genellikle gereksizdir. Giden trafi\u011fi engellemek, olas\u0131 bir web shell sald\u0131r\u0131s\u0131n\u0131n d\u0131\u015far\u0131ya komut g\u00f6ndermesini zorla\u015ft\u0131r\u0131r.
\n* Veritaban\u0131 Kullan\u0131c\u0131lar\u0131:<\/strong> mysql<\/code> veya postgresql<\/code> gibi veritaban\u0131 servisleri, genellikle kendi \u00f6zel kullan\u0131c\u0131lar\u0131 alt\u0131nda \u00e7al\u0131\u015f\u0131r. Bu kullan\u0131c\u0131lar\u0131n sadece veritaban\u0131 dosyalar\u0131na ve gerekti\u011finde di\u011fer veritaban\u0131 sunucular\u0131na eri\u015fmesi yeterlidir. D\u0131\u015far\u0131ya olan t\u00fcm di\u011fer ba\u011flant\u0131lar\u0131n engellenmesi, veritaban\u0131 sunucusunun g\u00fcvenli\u011fini art\u0131r\u0131r.
\n* Kapsay\u0131c\u0131 (Container) Ortamlar\u0131:<\/strong> Docker veya Kubernetes gibi kapsay\u0131c\u0131 teknolojileri, uygulamalar\u0131 izole etmek i\u00e7in kullan\u0131c\u0131 bazl\u0131 k\u0131s\u0131tlamalar\u0131 tamamlay\u0131c\u0131 bir g\u00fcvenlik katman\u0131 olarak kullanabilir.<\/p>\n

iptables Temelleri ve Durum Takibi (Connection Tracking)<\/h3>\n

iptables<\/code>, Linux \u00e7ekirde\u011finin netfilter \u00e7er\u00e7evesi i\u00e7in bir kullan\u0131c\u0131 alan\u0131 program\u0131d\u0131r ve a\u011f paketlerini filtrelemek, de\u011fi\u015ftirmek veya y\u00f6nlendirmek i\u00e7in kullan\u0131l\u0131r. Belirli bir kullan\u0131c\u0131n\u0131n trafi\u011fini y\u00f6netmek i\u00e7in iptables<\/code>‘\u0131n temel bile\u015fenlerini ve \u00f6zellikle durum takibi \u00f6zelli\u011fini anlamak \u00f6nemlidir.<\/p>\n

iptables Zincirleri (Chains)<\/h4>\n

iptables<\/code> kurallar\u0131, belirli noktalarda a\u011f paketlerine uygulanan “zincirler” halinde d\u00fczenlenir. En yayg\u0131n kullan\u0131lan zincirler \u015funlard\u0131r:
\n* INPUT:<\/strong> Sisteme gelen paketler i\u00e7in.
\n* OUTPUT:<\/strong> Sistemden \u00e7\u0131kan paketler i\u00e7in.
\n* FORWARD:<\/strong> Sistem \u00fczerinden y\u00f6nlendirilen (ba\u015fka bir hedefe iletilen) paketler i\u00e7in.
\nBizim senaryomuzda, belirli bir kullan\u0131c\u0131n\u0131n giden trafi\u011fini engellemek istedi\u011fimiz i\u00e7in OUTPUT<\/strong> zinciri kritik \u00f6neme sahiptir.<\/p>\n

iptables Hedefleri (Targets)<\/h4>\n

Bir kural e\u015fle\u015fti\u011finde, iptables<\/code> pakete ne yapaca\u011f\u0131n\u0131 belirten bir “hedef” uygular:
\n* ACCEPT:<\/strong> Paketin ge\u00e7mesine izin verir.
\n* DROP:<\/strong> Paketi sessizce d\u00fc\u015f\u00fcr\u00fcr (paketi g\u00f6nderene herhangi bir bildirim g\u00f6ndermez).
\n* REJECT:<\/strong> Paketi d\u00fc\u015f\u00fcr\u00fcr ve g\u00f6nderene bir hata mesaj\u0131 (\u00f6rne\u011fin, “Connection refused”) g\u00f6nderir. G\u00fcvenlik a\u00e7\u0131s\u0131ndan genellikle DROP<\/code> tercih edilir, \u00e7\u00fcnk\u00fc sald\u0131rganlara daha az bilgi verir.
\n* LOG:<\/strong> Paketi sistem g\u00fcnl\u00fc\u011f\u00fcne kaydeder ve bir sonraki kurala ge\u00e7ilmesine izin verir.<\/p>\n

Durum Takibi (Connection Tracking – conntrack)<\/h4>\n

iptables<\/code>‘\u0131n en g\u00fc\u00e7l\u00fc \u00f6zelliklerinden biri durum takibidir (connection tracking). Bu \u00f6zellik sayesinde iptables<\/code>, TCP, UDP ve ICMP gibi protokoller i\u00e7in a\u011f ba\u011flant\u0131lar\u0131n\u0131n durumunu izleyebilir. Durum takibi, g\u00fcvenlik duvar\u0131n\u0131n yaln\u0131zca tek tek paketleri de\u011fil, ayn\u0131 zamanda ba\u011flant\u0131n\u0131n genel ba\u011flam\u0131n\u0131 da anlamas\u0131na olanak tan\u0131r. Durum mod\u00fcl\u00fc (-m state<\/code>) ile d\u00f6rt ana ba\u011flant\u0131 durumu vard\u0131r:
\n* NEW:<\/strong> Yeni bir ba\u011flant\u0131 ba\u015flatmaya \u00e7al\u0131\u015fan bir pakettir (\u00f6rne\u011fin, bir TCP SYN paketi).
\n* ESTABLISHED:<\/strong> Halihaz\u0131rda kurulmu\u015f bir ba\u011flant\u0131n\u0131n par\u00e7as\u0131 olan bir pakettir.
\n* RELATED:<\/strong> Mevcut bir ba\u011flant\u0131yla ili\u015fkili, ancak yeni bir ba\u011flant\u0131 ba\u015flatan bir pakettir (\u00f6rne\u011fin, bir FTP veri ba\u011flant\u0131s\u0131 veya ICMP hata mesaj\u0131).
\n* INVALID:<\/strong> Tan\u0131nmayan veya ge\u00e7ersiz bir ba\u011flant\u0131 durumu olan bir pakettir.<\/p>\n

Dinleme portlar\u0131n\u0131n \u00e7al\u0131\u015f\u0131r kalmas\u0131n\u0131 sa\u011flamak i\u00e7in ESTABLISHED<\/code> ve RELATED<\/code> durumlar\u0131 hayati \u00f6neme sahiptir. Bir sunucu bir dinleme portunda gelen bir ba\u011flant\u0131y\u0131 kabul etti\u011finde, bu ba\u011flant\u0131 ESTABLISHED<\/code> durumuna ge\u00e7er. Sunucunun bu ba\u011flant\u0131ya yan\u0131t g\u00f6ndermesi gerekti\u011finde, bu yan\u0131t paketleri de ESTABLISHED<\/code> durumunda kabul edilir ve giden trafik olarak say\u0131l\u0131r.<\/p>\n

Kullan\u0131c\u0131 Kimli\u011fi ile E\u015fle\u015ftirme<\/h4>\n

iptables<\/code>, owner<\/code> mod\u00fcl\u00fc (-m owner<\/code>) sayesinde paketi g\u00f6nderen s\u00fcrecin kullan\u0131c\u0131 kimli\u011fini (UID) veya grup kimli\u011fini (GID) e\u015fle\u015ftirebilir. Bu, bizim senaryomuz i\u00e7in temel ta\u015f\u0131d\u0131r:
\n* --uid-owner <\/code>: Belirtilen UID’ye sahip kullan\u0131c\u0131n\u0131n ba\u015flatt\u0131\u011f\u0131 paketleri e\u015fle\u015ftirir.
\n* --gid-owner <\/code>: Belirtilen GID’ye sahip grubun ba\u015flatt\u0131\u011f\u0131 paketleri e\u015fle\u015ftirir.
\nKullan\u0131c\u0131 ad\u0131n\u0131 UID’ye \u00e7evirmek i\u00e7in id -u <\/code> komutunu kullanabiliriz.<\/p>\n

Temel Engelleme Kural\u0131 ve Dinleme Portlar\u0131 Sorunu<\/h3>\n

Belirli bir kullan\u0131c\u0131n\u0131n giden trafi\u011fini engellemek ilk bak\u0131\u015fta basit g\u00f6r\u00fcnebilir, ancak dinleme portlar\u0131n\u0131n i\u015flevselli\u011fini korumak i\u00e7in dikkatli bir yakla\u015f\u0131m gerektirir.<\/p>\n

Kullan\u0131c\u0131 Bazl\u0131 Giden Trafi\u011fi Engelleme (\u0130lk Deneme)<\/h4>\n

Bir kullan\u0131c\u0131n\u0131n giden trafi\u011fini tamamen engellemek i\u00e7in kullan\u0131labilecek en basit kural \u015fudur:<\/p>\n

iptables -A OUTPUT -m owner --uid-owner  -j DROP<\/pre>\n
<\/code>
\nBu kural, <\/code>'ye sahip kullan\u0131c\u0131n\u0131n ba\u015flatt\u0131\u011f\u0131 t\u00fcm giden paketleri OUTPUT zincirinin sonuna ekler ve bu paketleri d\u00fc\u015f\u00fcr\u00fcr.
\n\u00d6rnek:<\/strong> webuser<\/code> kullan\u0131c\u0131s\u0131n\u0131n UID'si 1001 ise:<\/p>\n
iptables -A OUTPUT -m owner --uid-owner 1001 -j DROP<\/pre>\n
<\/code>
\nBu kural uyguland\u0131\u011f\u0131nda, webuser<\/code> art\u0131k d\u0131\u015f d\u00fcnyaya herhangi bir ba\u011flant\u0131 kuramaz. ping google.com<\/code> veya curl example.com<\/code> gibi komutlar \u00e7al\u0131\u015fmayacakt\u0131r.<\/p>\n
Dinleme Portlar\u0131n\u0131n \u00c7al\u0131\u015fma Prensibi ve Sorun<\/h4>\n
Bir servis (\u00f6rne\u011fin, bir web sunucusu) belirli bir portu dinlerken, d\u0131\u015far\u0131dan gelen ba\u011flant\u0131lar\u0131 bekler. Bir istemci bu porta ba\u011fland\u0131\u011f\u0131nda, sunucu gelen paketi al\u0131r ve bu ba\u011flant\u0131ya yan\u0131t verir. Sunucunun g\u00f6nderdi\u011fi bu yan\u0131t paketleri, teknik olarak sistemden \u00e7\u0131kan \"giden trafik\" olarak kabul edilir.
\nYukar\u0131daki basit DROP<\/code> kural\u0131 uyguland\u0131\u011f\u0131nda, webuser<\/code> alt\u0131nda \u00e7al\u0131\u015fan bir web sunucusu gelen ba\u011flant\u0131lar\u0131 kabul edebilir, ancak bu ba\u011flant\u0131lara yan\u0131t g\u00f6ndermeye \u00e7al\u0131\u015ft\u0131\u011f\u0131nda, yan\u0131t paketleri OUTPUT<\/code> zincirindeki DROP<\/code> kural\u0131na tak\u0131lacak ve d\u00fc\u015f\u00fcr\u00fclecektir. Sonu\u00e7 olarak, istemci hi\u00e7bir zaman sunucudan yan\u0131t alamaz ve ba\u011flant\u0131 kuramaz. Dinleme portu teknik olarak a\u00e7\u0131k olsa da, pratik olarak i\u015flevsiz hale gelir.<\/p>\n
Sorunu Anlamak<\/h4>\n
Sorunun temelinde, iptables<\/code>'\u0131n kurallar\u0131 yukar\u0131dan a\u015fa\u011f\u0131ya do\u011fru i\u015flemesi ve DROP<\/code> kural\u0131n\u0131n ESTABLISHED<\/code> durumundaki yan\u0131t paketlerini de kaps\u0131yor olmas\u0131 yatar. Dinleme portunun do\u011fru \u00e7al\u0131\u015fmas\u0131 i\u00e7in, gelen ba\u011flant\u0131lara ait ESTABLISHED<\/code> durumundaki giden yan\u0131t paketlerine izin verilmesi gerekmektedir. Bu, DROP<\/code> kural\u0131ndan \u00f6nce bu t\u00fcr paketlere izin veren bir kural\u0131n eklenmesiyle \u00e7\u00f6z\u00fclebilir.<\/p>\n
\u00c7\u00f6z\u00fcm: Durum Takibi ile Ak\u0131ll\u0131 Engelleme<\/h3>\n
Dinleme portlar\u0131n\u0131n \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flarken belirli bir kullan\u0131c\u0131n\u0131n giden trafi\u011fini engellemek i\u00e7in, iptables<\/code>'\u0131n durum takibi (connection tracking) \u00f6zelli\u011fini kullanmam\u0131z gerekir. Bu yakla\u015f\u0131m, mevcut ve ili\u015fkili ba\u011flant\u0131lar\u0131n devam etmesine izin verirken, kullan\u0131c\u0131n\u0131n yeni giden ba\u011flant\u0131lar ba\u015flatmas\u0131n\u0131 engeller.<\/p>\n
Mevcut Ba\u011flant\u0131lara \u0130zin Verme<\/h4>\n
Anahtar nokta, belirli bir kullan\u0131c\u0131 taraf\u0131ndan zaten kurulmu\u015f veya kabul edilmi\u015f ba\u011flant\u0131lara ait giden trafi\u011fe izin vermektir. Bu, ESTABLISHED<\/code> ve RELATED<\/code> durumlar\u0131n\u0131 kullanarak yap\u0131l\u0131r:<\/p>\n
iptables -A OUTPUT -m owner --uid-owner  -m state --state ESTABLISHED,RELATED -j ACCEPT<\/pre>\n
<\/code>
\nBu kural, <\/code>'ye sahip kullan\u0131c\u0131n\u0131n ba\u015flatt\u0131\u011f\u0131 ve ESTABLISHED<\/code> (kurulmu\u015f) veya RELATED<\/code> (ili\u015fkili) durumda olan t\u00fcm giden paketlere izin verir. Bu kural\u0131n, yeni giden ba\u011flant\u0131lar\u0131 engelleyecek DROP<\/code> kural\u0131ndan \u00f6nce gelmesi \u00e7ok \u00f6nemlidir<\/strong>. iptables<\/code> kurallar\u0131 s\u0131ral\u0131 olarak i\u015flendi\u011fi i\u00e7in, \u00f6nce izin veren kural\u0131n e\u015fle\u015fmesi gerekir.<\/p>\n
Yeni Giden Ba\u011flant\u0131lar\u0131 Engelleme<\/h4>\n
Yukar\u0131daki ACCEPT<\/code> kural\u0131ndan sonra, ayn\u0131 kullan\u0131c\u0131n\u0131n yeni giden ba\u011flant\u0131lar\u0131n\u0131 engelleyen bir kural eklenir:<\/p>\n
iptables -A OUTPUT -m owner --uid-owner  -j DROP<\/pre>\n
<\/code>
\nBu kural, ESTABLISHED<\/code> veya RELATED<\/code> durumunda olmayan (yani NEW<\/code> durumunda olan) t\u00fcm giden paketleri d\u00fc\u015f\u00fcrecektir. Bu sayede, kullan\u0131c\u0131 d\u0131\u015far\u0131ya yeni ba\u011flant\u0131lar ba\u015flatamaz.<\/p>\n
Yerel (Loopback) Trafi\u011fe \u0130zin Verme<\/h4>\n
Bir\u00e7ok uygulama, yerel makine i\u00e7indeki di\u011fer servislerle ileti\u015fim kurmak i\u00e7in loopback<\/code> aray\u00fcz\u00fcn\u00fc (lo<\/code>) kullan\u0131r. Bu trafi\u011fin engellenmemesi genellikle istenir. Bu, genel bir kural olarak OUTPUT<\/code> zincirinin ba\u015f\u0131nda eklenebilir:<\/p>\n
iptables -A OUTPUT -o lo -j ACCEPT<\/pre>\n
<\/code>
\nBu kural\u0131, kullan\u0131c\u0131ya \u00f6zel engelleme kurallar\u0131ndan \u00f6nce eklemek, yerel ileti\u015fimin kesintiye u\u011framamas\u0131n\u0131 sa\u011flar.<\/p>\n
DNS \u00c7\u00f6z\u00fcmlemesine \u0130zin Verme (\u0130ste\u011fe Ba\u011fl\u0131)<\/h4>\n
Baz\u0131 durumlarda, k\u0131s\u0131tl\u0131 kullan\u0131c\u0131n\u0131n DNS sorgular\u0131 yapmas\u0131na izin vermek isteyebilirsiniz. \u00d6rne\u011fin, bir web sunucusu bazen harici bir API'ye ba\u011flanmak i\u00e7in DNS \u00e7\u00f6z\u00fcmlemesi yapmas\u0131 gerekebilir. DNS genellikle UDP port 53 \u00fczerinden \u00e7al\u0131\u015f\u0131r:<\/p>\n
iptables -A OUTPUT -m owner --uid-owner  -p udp --dport 53 -j ACCEPT<\/pre>\n
<\/code>
\nBu kural\u0131 da DROP<\/code> kural\u0131ndan \u00f6nce, ESTABLISHED,RELATED<\/code> kural\u0131ndan sonra ekleyebilirsiniz. Belirli DNS sunucular\u0131na (-d <\/code>) izin vermek daha g\u00fcvenli bir yakla\u015f\u0131md\u0131r.<\/p>\n
Ad\u0131m Ad\u0131m Uygulama ve \u00d6rnek Senaryo<\/h3>\n
\u015eimdi, webuser<\/code> ad\u0131nda bir kullan\u0131c\u0131n\u0131n giden trafi\u011fini k\u0131s\u0131tlarken, bu kullan\u0131c\u0131n\u0131n dinledi\u011fi portlara gelen ba\u011flant\u0131lar\u0131n sorunsuz \u00e7al\u0131\u015fmas\u0131n\u0131 sa\u011flayan kurallar\u0131 ad\u0131m ad\u0131m uygulayal\u0131m.<\/p>\n
Kullan\u0131c\u0131 ID'sini Bulma<\/h4>\n
\u0130lk olarak, hedef kullan\u0131c\u0131n\u0131n UID'sini (User ID) bulmam\u0131z gerekiyor.<\/p>\n
id -u webuser\n# \u00d6rnek \u00e7\u0131kt\u0131: 1001<\/pre>\n
<\/code>
\nBu \u00f6rnekte, webuser<\/code>'\u0131n UID'si 1001<\/code> olsun.<\/p>\n
\u00d6rnek Kullan\u0131c\u0131: webuser<\/code> \u0130\u00e7in iptables Kurallar\u0131<\/h4>\n
A\u015fa\u011f\u0131daki komutlar\u0131 root olarak veya sudo<\/code> ile \u00e7al\u0131\u015ft\u0131r\u0131n. Kurallar\u0131 uygulamadan \u00f6nce mevcut iptables<\/code> kurallar\u0131n\u0131z\u0131 yedeklemeniz iyi bir uygulamad\u0131r: iptables-save > \/root\/iptables.bak<\/code>.<\/p>\n
1.  Yerel (Loopback) Trafi\u011fe \u0130zin Ver:<\/strong><\/p>\n
sudo iptables -A OUTPUT -o lo -j ACCEPT<\/pre>\n
<\/code>
\n    Bu kural, OUTPUT<\/code> zincirinin ba\u015f\u0131na eklenecektir (veya mevcut kurallar\u0131n\u0131z\u0131n uygun bir yerine).<\/p>\n
2.  Mevcut ve \u0130li\u015fkili Ba\u011flant\u0131lara \u0130zin Ver:<\/strong><\/p>\n
sudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -m state --state ESTABLISHED,RELATED -j ACCEPT<\/pre>\n
<\/code>
\n    Bu kural, webuser<\/code> taraf\u0131ndan ba\u015flat\u0131lan veya kabul edilen mevcut ba\u011flant\u0131lar\u0131n devam etmesine izin verir. Bu, web sunucusunun gelen ba\u011flant\u0131lara yan\u0131t verebilmesini sa\u011flar.<\/p>\n
3.  DNS \u00c7\u00f6z\u00fcmlemesine \u0130zin Ver (\u0130ste\u011fe Ba\u011fl\u0131):<\/strong>
\n    E\u011fer webuser<\/code>'\u0131n DNS sorgular\u0131 yapmas\u0131 gerekiyorsa (\u00f6rne\u011fin, bir API'ye ba\u011flanmadan \u00f6nce alan ad\u0131n\u0131 \u00e7\u00f6z\u00fcmlemek i\u00e7in):<\/p>\n
sudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -p udp --dport 53 -j ACCEPT\n    # Veya belirli DNS sunucular\u0131na izin vermek i\u00e7in:\n    # sudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -p udp --dport 53 -d 8.8.8.8 -j ACCEPT\n    # sudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -p udp --dport 53 -d 8.8.4.4 -j ACCEPT<\/pre>\n
<\/code><\/p>\n
4.  Yeni Giden Ba\u011flant\u0131lar\u0131 Engelle:<\/strong><\/p>\n
sudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -j DROP<\/pre>\n
<\/code>
\n    Bu kural, webuser<\/code>'\u0131n yukar\u0131daki ACCEPT<\/code> kurallar\u0131na uymayan t\u00fcm yeni giden ba\u011flant\u0131lar\u0131n\u0131 engelleyecektir.<\/p>\n
T\u00fcm Kurallar Bir Arada (\u00d6rnek S\u0131ralama):<\/strong><\/p>\n
# Mevcut kurallar\u0131 temizlemek isterseniz (D\u0130KKATL\u0130 OLUN!)\n# sudo iptables -F OUTPUT\n\n# 1. Yerel trafi\u011fe izin ver\nsudo iptables -A OUTPUT -o lo -j ACCEPT\n\n# 2. 'webuser' i\u00e7in mevcut ve ili\u015fkili ba\u011flant\u0131lara izin ver\nsudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -m state --state ESTABLISHED,RELATED -j ACCEPT\n\n# 3. 'webuser' i\u00e7in DNS sorgular\u0131na izin ver (iste\u011fe ba\u011fl\u0131)\nsudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -p udp --dport 53 -j ACCEPT\n\n# 4. 'webuser' i\u00e7in di\u011fer t\u00fcm giden ba\u011flant\u0131lar\u0131 engelle\nsudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -j DROP\n\n# Kurallar\u0131 kontrol et\nsudo iptables -L OUTPUT -v -n<\/pre>\n
<\/code><\/p>\n
Kurallar\u0131 Kal\u0131c\u0131 Hale Getirme<\/h4>\n
iptables<\/code> kurallar\u0131 varsay\u0131lan olarak yeniden ba\u015flatmada kaybolur. Kurallar\u0131 kal\u0131c\u0131 hale getirmek i\u00e7in:
\n*   Debian\/Ubuntu:<\/strong> sudo apt install iptables-persistent<\/code> kurun ve sudo netfilter-persistent save<\/code> komutunu \u00e7al\u0131\u015ft\u0131r\u0131n.
\n*   CentOS\/RHEL:<\/strong> sudo yum install iptables-services<\/code> kurun, sudo systemctl enable iptables<\/code> ve sudo systemctl start iptables<\/code> komutlar\u0131n\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n, ard\u0131ndan sudo iptables-save > \/etc\/sysconfig\/iptables<\/code> komutuyla kaydedin.
\n*   Di\u011fer Y\u00f6ntemler:<\/strong> firewalld<\/code> (CentOS\/RHEL i\u00e7in varsay\u0131lan), ufw<\/code> (Ubuntu i\u00e7in basit aray\u00fcz) veya kendi ba\u015flang\u0131\u00e7 beti\u011finizi kullanabilirsiniz.<\/p>\n
Test Etme<\/h4>\n
Kurallar\u0131 uygulad\u0131ktan sonra, beklenen davran\u0131\u015f\u0131 test etmek \u00f6nemlidir:
\n1.  Giden Ba\u011flant\u0131 Denemesi (webuser<\/code> olarak):<\/strong>
\n    sudo su - webuser<\/code> ile webuser<\/code> kullan\u0131c\u0131s\u0131na ge\u00e7in.
\n    ping google.com<\/code> veya curl example.com<\/code> gibi komutlar\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n. Bunlar\u0131n ba\u015far\u0131s\u0131z olmas\u0131 gerekir (timeout veya ba\u011flant\u0131 reddedildi hatas\u0131).
\n2.  Dinleme Portu Denemesi (root veya ba\u015fka bir kullan\u0131c\u0131 olarak):<\/strong>
\n    webuser<\/code> alt\u0131nda bir web sunucusu (\u00f6rne\u011fin, Python'\u0131n basit HTTP sunucusu) \u00e7al\u0131\u015ft\u0131r\u0131n:
\n    sudo su - webuser -c \"python3 -m http.server 8000\"<\/code>
\n    Ba\u015fka bir terminalden veya d\u0131\u015far\u0131dan bu porta ba\u011flanmaya \u00e7al\u0131\u015f\u0131n:
\n    curl http:\/\/localhost:8000<\/code> (yerel makineden) veya curl http:\/\/:8000<\/code> (uzak makineden).
\n    Ba\u011flant\u0131n\u0131n ba\u015far\u0131l\u0131 olmas\u0131 ve web sayfas\u0131n\u0131n g\u00f6r\u00fcnt\u00fclenmesi gerekir.<\/p>\n
Dikkat Edilmesi Gerekenler ve \u0130leri Seviye Konular<\/h3>\n
iptables<\/code> kurallar\u0131n\u0131 uygularken ve y\u00f6netirken baz\u0131 \u00f6nemli noktalar\u0131 g\u00f6z \u00f6n\u00fcnde bulundurmak, beklenmedik sorunlar\u0131 \u00f6nlemenize ve g\u00fcvenli\u011fi daha da art\u0131rman\u0131za yard\u0131mc\u0131 olacakt\u0131r.<\/p>\n
Kural S\u0131ras\u0131<\/h4>\n
iptables<\/code> kurallar\u0131, zincir i\u00e7inde yukar\u0131dan a\u015fa\u011f\u0131ya do\u011fru s\u0131rayla i\u015flenir. Bir paket bir kurala e\u015fle\u015fti\u011finde, o kural\u0131n hedefi uygulan\u0131r ve genellikle zincirdeki sonraki kurallar atlan\u0131r (LOG hedefi hari\u00e7). Bu nedenle, ACCEPT<\/code> kurallar\u0131n\u0131n DROP<\/code> kurallar\u0131ndan \u00f6nce gelmesi hayati \u00f6nem ta\u015f\u0131r. Yanl\u0131\u015f s\u0131ralama, dinleme portlar\u0131n\u0131n \u00e7al\u0131\u015fmamas\u0131na veya istenmeyen trafi\u011fin ge\u00e7mesine neden olabilir.<\/p>\n
Varsay\u0131lan Politikalar<\/h4>\n
OUTPUT<\/code> zincirinin varsay\u0131lan politikas\u0131 genellikle ACCEPT<\/code>'tir. E\u011fer varsay\u0131lan politikay\u0131 DROP<\/code> veya REJECT<\/code> olarak ayarlarsan\u0131z (iptables -P OUTPUT DROP<\/code>), o zaman kullan\u0131c\u0131lara \u00f6zel izin kurallar\u0131n\u0131n yan\u0131 s\u0131ra, sistemin genel i\u015fleyi\u015fi i\u00e7in gerekli olan (\u00f6rne\u011fin, DNS, NTP, SSH ba\u011flant\u0131 yan\u0131tlar\u0131) t\u00fcm giden trafi\u011fe a\u00e7\u0131k\u00e7a izin veren kurallar eklemeniz gerekir. Bu daha g\u00fcvenli bir yakla\u015f\u0131md\u0131r ancak y\u00f6netimi daha karma\u015f\u0131kt\u0131r. Bu makaledeki \u00f6rnekler, OUTPUT<\/code> zincirinin varsay\u0131lan politikas\u0131n\u0131n ACCEPT<\/code> oldu\u011funu varsaymaktad\u0131r.<\/p>\n
Di\u011fer Zincirler ile Etkile\u015fim<\/h4>\n
Bu makale OUTPUT<\/code> zincirine odaklanm\u0131\u015f olsa da, sistemin genel g\u00fcvenli\u011fi i\u00e7in INPUT<\/code> zincirini de yap\u0131land\u0131rman\u0131z gerekebilir. \u00d6rne\u011fin, bir web sunucusunun 80 ve 443 portlar\u0131na gelen ba\u011flant\u0131lara izin vermek i\u00e7in INPUT<\/code> zincirinde kurallar\u0131n\u0131z olmal\u0131d\u0131r:<\/p>\n
iptables -A INPUT -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT\niptables -A INPUT -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT\niptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT<\/pre>\n
<\/code>
\nBu kurallar, gelen ba\u011flant\u0131lara izin verirken, OUTPUT<\/code> zincirindeki kurallar bu gelen ba\u011flant\u0131lara yan\u0131t verilmesini sa\u011flar.<\/p>\n
Loglama (G\u00fcnl\u00fck Kayd\u0131)<\/h4>\n
Engellenen veya kabul edilen paketleri g\u00f6rmek i\u00e7in LOG<\/code> hedefini kullanabilirsiniz. Bu, sorun giderme ve g\u00fcvenlik denetimi i\u00e7in \u00e7ok de\u011ferlidir. DROP<\/code> kural\u0131ndan hemen \u00f6nce bir LOG<\/code> kural\u0131 ekleyerek, hangi giden ba\u011flant\u0131lar\u0131n engellendi\u011fini g\u00f6rebilirsiniz:<\/p>\n
iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -j LOG --log-prefix \"IPTABLES_BLOCKED_OUTBOUND: \"\niptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -j DROP<\/pre>\n
<\/code>
\nG\u00fcnl\u00fck kay\u0131tlar\u0131n\u0131 dmesg<\/code> veya \/var\/log\/syslog<\/code> (veya \/var\/log\/messages<\/code>) dosyalar\u0131nda bulabilirsiniz.<\/p>\n
G\u00fcvenlik A\u00e7\u0131klar\u0131 ve S\u0131n\u0131rlamalar<\/h4>\n
iptables -m owner<\/code> mod\u00fcl\u00fc, yaln\u0131zca paketi ba\u015flatan s\u00fcrecin UID'sini kontrol edebilir. E\u011fer bir kullan\u0131c\u0131, setuid<\/code> bitine sahip bir program arac\u0131l\u0131\u011f\u0131yla ba\u015fka bir kullan\u0131c\u0131n\u0131n (\u00f6rne\u011fin, root<\/code>) yetkileriyle kod \u00e7al\u0131\u015ft\u0131rabilirse, bu iptables<\/code> kural\u0131 atlat\u0131labilir. Bu nedenle, sistem genelinde kullan\u0131c\u0131 yetkilendirmelerine ve program izinlerine dikkat etmek \u00e7ok \u00f6nemlidir. iptables<\/code> tek ba\u015f\u0131na bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fc de\u011fildir; di\u011fer g\u00fcvenlik \u00f6nlemleriyle (SELinux\/AppArmor, iyi parola politikalar\u0131, d\u00fczenli g\u00fcncellemeler) birlikte kullan\u0131lmal\u0131d\u0131r.<\/p>\n
Sonu\u00e7<\/h3>\n
Belirli bir Linux kullan\u0131c\u0131s\u0131n\u0131n giden trafi\u011fini iptables<\/code> ile engellerken, dinleme portlar\u0131n\u0131n i\u015flevselli\u011fini korumak, sistem g\u00fcvenli\u011fini art\u0131rmak ve servis s\u00fcreklili\u011fini sa\u011flamak i\u00e7in kritik bir beceridir. iptables<\/code>'\u0131n owner<\/code> mod\u00fcl\u00fc ve durum takibi (connection tracking) \u00f6zelliklerini birle\u015ftirerek, bu dengeyi ba\u015far\u0131yla kurabiliriz. Uygulanan kurallar sayesinde, k\u0131s\u0131tl\u0131 kullan\u0131c\u0131lar yaln\u0131zca mevcut ba\u011flant\u0131lar\u0131na yan\u0131t verebilirken, yeni ve potansiyel olarak tehlikeli giden ba\u011flant\u0131lar kurmalar\u0131 engellenir. Bu yakla\u015f\u0131m, \u00f6zellikle web sunucular\u0131, veritaban\u0131 servisleri veya di\u011fer kritik uygulamalar i\u00e7in g\u00fc\u00e7l\u00fc bir g\u00fcvenlik katman\u0131 sa\u011flar. Unutmay\u0131n ki g\u00fcvenlik s\u00fcrekli bir s\u00fcre\u00e7tir ve iptables<\/code> kurallar\u0131n\u0131z\u0131 d\u00fczenli olarak g\u00f6zden ge\u00e7irmek ve test etmek, sisteminizin g\u00fcvende kalmas\u0131n\u0131 sa\u011flayacakt\u0131r.<\/p>\n
S\u0131k Sorulan Sorular (SSS)<\/h3>\n
Bu kurallar sistemin di\u011fer kullan\u0131c\u0131lar\u0131n\u0131 etkiler mi?<\/h4>\n
Hay\u0131r, --uid-owner<\/code> parametresi sayesinde bu kurallar sadece belirtilen kullan\u0131c\u0131 kimli\u011fine sahip s\u00fcre\u00e7ler i\u00e7in ge\u00e7erlidir. Sistemdeki di\u011fer kullan\u0131c\u0131lar\u0131n veya root<\/code> kullan\u0131c\u0131s\u0131n\u0131n giden trafi\u011fi etkilenmez.<\/p>\n
Dinleme portu olan bir servis ba\u015flatamazsam veya ba\u011flant\u0131 kuramazsam ne yapmal\u0131y\u0131m?<\/h4>\n
E\u011fer servisiniz dinleme portunda ba\u015flat\u0131lam\u0131yorsa, bu genellikle INPUT<\/code> zincirindeki bir kuraldan veya servis yap\u0131land\u0131rmas\u0131ndan kaynaklan\u0131r, OUTPUT<\/code> zinciriyle do\u011frudan ilgili de\u011fildir. INPUT<\/code> zincirinizin ilgili porta gelen ba\u011flant\u0131lara izin verdi\u011finden emin olun. E\u011fer servis ba\u015flat\u0131labiliyor ancak d\u0131\u015far\u0131dan ba\u011flant\u0131 kurulam\u0131yorsa, yine INPUT<\/code> zincirini veya a\u011f yap\u0131land\u0131rman\u0131z\u0131 kontrol edin.<\/p>\n
Kurallar\u0131 nas\u0131l temizlerim veya devre d\u0131\u015f\u0131 b\u0131rak\u0131r\u0131m?<\/h4>\n
T\u00fcm OUTPUT<\/code> zinciri kurallar\u0131n\u0131 temizlemek i\u00e7in:<\/p>\n
sudo iptables -F OUTPUT<\/pre>\n
<\/code>
\nBelirli bir kural\u0131 silmek i\u00e7in, \u00f6nce kural\u0131n numaras\u0131n\u0131 bulman\u0131z gerekir:<\/p>\n
sudo iptables -L OUTPUT --line-numbers<\/pre>\n
<\/code>
\nArd\u0131ndan, silmek istedi\u011finiz kural\u0131n numaras\u0131n\u0131 kullanarak silebilirsiniz:<\/p>\n
sudo iptables -D OUTPUT <\/pre>\n
<\/code>
\n\u00d6rne\u011fin, 5. kural\u0131 silmek i\u00e7in: sudo iptables -D OUTPUT 5<\/code>.<\/p>\n
Neden REJECT<\/code> yerine DROP<\/code> kullanmal\u0131y\u0131m?<\/h4>\n
G\u00fcvenlik a\u00e7\u0131s\u0131ndan DROP<\/code> genellikle REJECT<\/code>'e tercih edilir. DROP<\/code> paketi sessizce d\u00fc\u015f\u00fcr\u00fcr ve g\u00f6nderene hi\u00e7bir yan\u0131t g\u00f6ndermez. Bu, bir sald\u0131rgan\u0131n sisteminiz hakk\u0131nda bilgi toplamas\u0131n\u0131 (\u00f6rne\u011fin, bir portun a\u00e7\u0131k olup olmad\u0131\u011f\u0131n\u0131 veya g\u00fcvenlik duvar\u0131n\u0131n varl\u0131\u011f\u0131n\u0131 anlamas\u0131n\u0131) zorla\u015ft\u0131r\u0131r. REJECT<\/code> ise bir hata mesaj\u0131 g\u00f6ndererek, engellemenin varl\u0131\u011f\u0131n\u0131 ve nedenini (\u00f6rne\u011fin, ba\u011flant\u0131n\u0131n reddedildi\u011fini) a\u00e7\u0131\u011fa \u00e7\u0131kar\u0131r.<\/p>\n
Belirli bir IP adresine veya porta izin vermek istersem ne yapmal\u0131y\u0131m?<\/h4>\n
E\u011fer k\u0131s\u0131tl\u0131 kullan\u0131c\u0131n\u0131n belirli bir IP adresine veya belirli bir porta (\u00f6rne\u011fin, bir veritaban\u0131 sunucusuna) ba\u011flanmas\u0131na izin vermek istiyorsan\u0131z, DROP<\/code> kural\u0131ndan \u00f6nce bir ACCEPT<\/code> kural\u0131 eklemeniz gerekir:<\/p>\n
# \u00d6rnek: 'webuser'\u0131n 192.168.1.100 adresindeki 3306 (MySQL) portuna ba\u011flanmas\u0131na izin ver\nsudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -d 192.168.1.100 -p tcp --dport 3306 -j ACCEPT\n\n# Ard\u0131ndan genel engelleme kural\u0131\nsudo iptables -A OUTPUT -m owner --uid-owner $(id -u webuser) -j DROP<\/pre>\n
<\/code>
\nBu kural\u0131, ESTABLISHED,RELATED<\/code> kural\u0131ndan sonra ve genel DROP<\/code> kural\u0131ndan \u00f6nce eklemelisiniz.<\/p>\n","protected":false},"excerpt":{"rendered":"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi\nLinux sistemlerde g\u00fcvenlik, k…","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[241],"tags":[],"class_list":{"0":"post-37951","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-linux","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\nBelirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi\" \/>\n<meta property=\"og:description\" content=\"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi Linux sistemlerde g\u00fcvenlik, k...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-19T10:31:10+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi\",\"datePublished\":\"2026-01-19T10:31:10+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/\"},\"wordCount\":3114,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Linux\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/#respond\"]}],\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/\",\"name\":\"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2026-01-19T10:31:10+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/","og_locale":"tr_TR","og_type":"article","og_title":"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi","og_description":"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi Linux sistemlerde g\u00fcvenlik, k...","og_url":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2026-01-19T10:31:10+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"18 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi","datePublished":"2026-01-19T10:31:10+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/"},"wordCount":3114,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Linux"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/#respond"]}],"copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/","url":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/","name":"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2026-01-19T10:31:10+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/belirli-bir-linux-kullanicisi-icin-giden-trafigi-iptables-ile-engelleme-dinleme-portlarini-calisir-tutma-rehberi\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Belirli Bir Linux Kullan\u0131c\u0131s\u0131 \u0130\u00e7in Giden Trafi\u011fi iptables ile Engelleme: Dinleme Portlar\u0131n\u0131 \u00c7al\u0131\u015f\u0131r Tutma Rehberi"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37951","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=37951"}],"version-history":[{"count":0,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/37951\/revisions"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=37951"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=37951"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=37951"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}