Redhat Linux防火墙管理

Redhat Linux防火墙管理

Redhat7以前使用iptables防火墙

添加允许通过端口

在/etc/sysconfig/iptables中添加配置

[root@localhost ~]# vi /etc/sysconfig/iptables
...
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A INPUT -m state --state NEW -m udp -p udp --dport 3306 -j ACCEPT

或通过iptables命令添加

[root@localhost sysconfig]# iptables -A INPUT -m state --state NEW -m udp -p udp --dport 5432 -j ACCEPT
[root@localhost sysconfig]# iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 5432 -j ACCEPT

保存配置，重启防火墙生效

[root@localhost etc]#  /etc/rc.d/init.d/iptables save
[root@localhost start-scripts]# service iptables restart

查看防火墙配置

[root@localhost start-scripts]# iptables --list
Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     all  --  anywhere             anywhere            state RELATED,ESTABLISHED 
ACCEPT     icmp --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:ssh 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:mysql 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:mysql 
REJECT     all  --  anywhere             anywhere            reject-with icmp-host-prohibited 
ACCEPT     udp  --  anywhere             anywhere            state NEW udp dpt:postgres 
ACCEPT     tcp  --  anywhere             anywhere            state NEW tcp dpt:postgres 

Redhhat7使用firewalld管理防火墙

查看防火墙允许端口

 firewall-cmd --list-all

添加允许通过端口

通过firewall-cmd –permanent添加永久允许通过端口

[root@localhost ~]# firewall-cmd --permanent --zone=public --add-port=5432/tcp

重新载入防火配置，使之生效

[root@localhost ~]# firewall-cmd --reload

或重启防火墙使之生效

[root@localhost ~]# service firewalld restart

删除端口

firewall-cmd --zone=public --remove-port=6022/tcp --permanent
firewall-cmd --reload