Linux下通过iptables开放端口

1.iptablesan安装

# 检查是否安装
@shylin:/etc# sudo whereis iptables
iptables: /sbin/iptables /usr/share/iptables /usr/share/man/man8/iptables.8.gz

# 安装
sudo apt-get install iptables

2.查看防火墙的配置信息

root@shylin:/etc# /sbin/iptables -L -n
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination  

3.新建规则文件

# 新建目录和文件
mkdir /etc/iptables & vi /etc/iptables/rules.conf

加入内容并保存：
*filter
#默认INPUT 的策略是DROP 即拒绝所有的外来请求
:INPUT DROP [0:0]
#一般情况下用不到FORWARD 可以配置为默认DROP
:FORWARD DROP [0:0]
#本机对其他机器访问设置为默认ACCEPT
:OUTPUT ACCEPT [0:0]
#允许已经建立和相关的连接
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#允许icmp协议(即ping)
-A INPUT -p icmp -j ACCEPT
#允许回环请求
-A INPUT -i lo -j ACCEPT
#开放端口22 80(如果要开放其他端口 继续添加开放规则即可)
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
COMMIT

4.使防火墙生效

iptables-restore < /etc/iptables/rules.conf

5.创建文件，添加以下内容，使防火墙开机启动

vi /etc/network/if-pre-up.d/iptables

#!/bin/bash
iptables-restore < /etc/iptables/rules.conf

6、添加执行权限

chmod +x /etc/network/if-pre-up.d/iptables

7、查看规则是否生效

iptables -L -n

root@shylin:/etc/iptables# iptables -L -n
Chain INPUT (policy DROP)
target     prot opt source               destination         
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:22
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:80

Chain FORWARD (policy DROP)
target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination       

---

Shylin