linux 7-12c rac环境配置iptables

配置iptables的注意点：1、需要对lo网卡的配置  2、心跳网络需要完全放行

rac环境的ip地址信息

172.16.126.48    zjdb1          
172.16.126.49    zjdb2          
172.16.126.50    zjdb1-vip
172.16.126.51    zjdb2-vip
172.16.126.58    scan
100.100.100.203    zjdb1-priv     --bond1
100.100.100.204    zjdb2-priv     --bond1

  ##关闭firewalld启用iptables
# systemctl stop firewalld
# yum -y install iptables-services
# systemctl enable iptables
# systemctl start iptables
# service iptables save

  ###lo 网卡配置
# iptables  -A INPUT -i lo -j ACCEPT
# iptables -A OUTPUT -o lo -j ACCEPT
# iptables -A INPUT -s 127.0.0.1/32 -d 127.0.0.1/32 -j ACCEPT

  ###private ip互通
# iptables -A INPUT -i bond1 -j ACCEPT
# iptables -A INPUT -i bond1:1 -j ACCEPT
# iptables -A INPUT -s 100.100.100.204/32 -j ACCEPT
# iptables -A INPUT -s 100.100.100.203/32 -j ACCEPT
# ###private ip互通-ifconfig查看私网网络ip地址
# iptables -A INPUT -s 169.254.154.64/32 -j ACCEPT     
# iptables -A INPUT -s 169.254.106.66/32 -j ACCEPT

  ###public ip互通
# iptables -A INPUT -s 172.16.126.48/32 -j ACCEPT
# iptables -A INPUT -s 172.16.126.49/32 -j ACCEPT
# iptables -A INPUT -s 172.16.126.50/32 -j ACCEPT
# iptables -A INPUT -s 172.16.126.51/32 -j ACCEPT
# iptables -A INPUT -s 172.16.126.58/32 -j ACCEPT

  ###可以ssh机器
# iptables -A INPUT -s 172.16.115.23/32 -p tcp -m tcp --dport 21,22 -j ACCEPT
# iptables -A INPUT -s 172.16.121.24/32 -p tcp -m tcp --dport 21,22,1521 -j ACCEPT

 ###可通过1521连接数据库应用机器
# iptables -A INPUT -s 172.16.121.131/32 -p tcp -m tcp --dport 1521 -j ACCEPT
# iptables -A INPUT -s 172.16.121.132/32 -p tcp -m tcp --dport 1521 -j ACCEPT
# iptables -A INPUT -s 172.16.121.133/32 -p tcp -m tcp --dport 1521 -j ACCEPT
# iptables -A INPUT -s 172.16.121.134/32 -p tcp -m tcp --dport 1521 -j ACCEPT
# iptables -A INPUT -s 172.16.121.101/32 -p tcp -m tcp --dport 1521 -j ACCEPT
# iptables -A INPUT -s 172.16.121.102/32 -p tcp -m tcp --dport 1521 -j ACCEPT
# iptables -A INPUT -s 172.16.121.103/32 -p tcp -m tcp --dport 1521 -j ACCEPT
# iptables -A INPUT -s 172.16.121.104/32 -p tcp -m tcp --dport 1521 -j ACCEPT
# iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
# iptables -A INPUT -m state --state INVALID -j DROP
# iptables -A INPUT -p icmp -j ACCEPT
# iptables -A OUTPUT -p icmp -j ACCEPT
# iptables -A FORWARD -m state --state INVALID -j DROP
# iptables -A OUTPUT -m state --state INVALID -j DROP
# iptables -A INPUT -p tcp --dport 22 -j DROP
# iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
# iptables -A FORWARD -j REJECT --reject-with icmp-port-unreachable
# iptables-save
#/bin/systemctl restart iptables.service
# /bin/systemctl start iptables.service
# /bin/systemctl is-enabled iptables.service

   ###查看需要的端口
# netstat -an |grep 172.16.124.108

   ###附：
# iptables -F       清除预设表filter中的所有规则链的规则
# iptables -X       清除预设表filter中使用者自定链中的规则

9月1日增加业务配置

#####最终版本--linux 7版本
yum -y install iptables-services   不存在时安装

[root@rs2 ~]#  vi /opt/iptables.sh
systemctl disable firewalld
systemctl stop firewalld
systemctl enable iptables  &&systemctl start iptables
iptables -F
iptables -A INPUT -s 100.100.200.1/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.2/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.4/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.5/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.6/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.7/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.8/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.9/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.11/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.12/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.26/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.27/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.28/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.29/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.45/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.10/32 -p tcp -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -s 100.100.200.10/32 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
iptables -A FORWARD -j REJECT --reject-with icmp-port-unreachable
service iptables save
systemctl stop iptables  &&  systemctl start iptables
/bin/sleep 600
systemctl stop iptables
 

#####最终版本--linux 6版本
 chkconfig iptables on  &&  chkconfig --list|grep iptables   查看/配置自启动

[root@authserver2 ~]#  vi /opt/iptables.sh
service iptables restart
iptables -F
iptables -A INPUT -s 100.100.200.1/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.2/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.4/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.5/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.6/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.7/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.8/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.9/32 -j ACCEPT    
iptables -A INPUT -s 100.100.200.11/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.12/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.26/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.27/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.28/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.29/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.45/32 -j ACCEPT
iptables -A INPUT -s 100.100.200.10/32 -p tcp -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -s 100.100.200.10/32 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A FORWARD -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A INPUT -p tcp --dport 22 -j DROP
iptables -A INPUT -j REJECT --reject-with icmp-port-unreachable
iptables -A FORWARD -j REJECT --reject-with icmp-port-unreachable
service iptables save
service iptables stop && service iptables start
/bin/sleep 600
service iptables stop

service iptables status   ---查看防火墙状态