10月29日任务

最新推荐文章于 2024-04-13 03:16:35 发布

chuqian2480

最新推荐文章于 2024-04-13 03:16:35 发布

阅读量205

点赞数

文章标签：运维网络 ldap

原文链接：https://my.oschina.net/u/3803396/blog/2253320

版权

10.19 iptables规则备份和恢复

保存和备份iptables规则

service iptables save //会把规则保存到/etc/sysconfig/iptables

把iptables规则备份到my.ipt文件中 iptables-save > my.ipt

恢复刚才备份的规则 iptables-restore < my.ipt

[root @test ~]# service iptables save 会将规则保存至配置文件[root @test ~]# cat /etc/sysconfig/iptables

将规则备份至其他文件中

[root@test ~]# iptables-save > /tmp/ipt.txt

[root @test ~]# cat !$

cat /tmp/ipt.txt

# Generated by iptables-save v1.4.21 on Sat Oct 27 13:56:42 2018

*filter

:INPUT ACCEPT [37471:2893984]

:FORWARD ACCEPT [132:17511]

:OUTPUT ACCEPT [7652:604535]

COMMIT

# Completed on Sat Oct 27 13:56:42 2018

# Generated by iptables-save v1.4.21 on Sat Oct 27 13:56:42 2018

*nat

:PREROUTING ACCEPT [5281:411531]

:INPUT ACCEPT [4894:368961]

:OUTPUT ACCEPT [402:34072]

:POSTROUTING ACCEPT [405:34204]

-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN

-A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN

-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535

-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535

-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE

-A POSTROUTING -s 192.168.122.0/24 -d 224.0.0.0/24 -j RETURN

-A POSTROUTING -s 192.168.122.0/24 -d 255.255.255.255/32 -j RETURN

-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535

-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535

-A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE

COMMIT

# Completed on Sat Oct 27 13:56:42 2018

# Generated by iptables-save v1.4.21 on Sat Oct 27 13:56:42 2018

*mangle

:PREROUTING ACCEPT [65893:5243791]

:INPUT ACCEPT [37649:2910863]

:FORWARD ACCEPT [132:17511]

:OUTPUT ACCEPT [7750:618753]

:POSTROUTING ACCEPT [7896:638963]

-A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill

COMMIT

# Completed on Sat Oct 27 13:56:42 2018

恢复规则（ 重启后还是会 /etc/sysconfig/iptables中的规则配置 ）

[root@test ~]# iptables-restore < /tmp/ipt.txt

10.20 firewalld的9个zone

用service iptables stop 和systemctl stop iptables 有什么区别吗 service这种是早期centos版本管理服务的工具。 centos7 也可以兼容。具体可以对哪些服务使用，你可以chkconfig --list 看看。

打开firewalld

systemctl disable iptables （iptables开机不启动）

systemctl stop iptables （停止iptables）

systemctl enable firewalld （firewalld开机启动）

systemctl start firewalld （开启firewalld）

firewalld默认有9个zone

默认zone为public

firewall-cmd --get-zones //查看所有zone

firewall-cmd --get-default-zone//查看默认zone

开启firewalld

1.关闭iptables

[root@test ~]# systemctl disable iptables

Removed symlink /etc/systemd/system/basic.target.wants/iptables.service.

[root@test ~]# systemctl stop iptables

2.开启 firewalld

[root@test ~]# systemctl enable firewalld

Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.

Created symlink from /etc/systemd/system/multi-user.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.

[root@test ~]# systemctl start firewalld

firewalld结构

[root@test ~]# iptables -nvL

Chain INPUT (policy ACCEPT 29 packets, 3907 bytes)