centos 6.9 防火墙策略增加

版权声明:本文为博主原创文章,未经博主允许不得转载。 https://blog.csdn.net/laokaizzz/article/details/77568556

vi /etc/sysconfig/iptables



# Generated by iptables-save v1.4.7 on Fri Aug 25 10:54:48 2017
*filter
:INPUT ACCEPT [6128:1521617]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5824:2626314]
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -s xx.xxx.xx.xx/32 -p tcp -m conntrack --ctstate NEW -m tcp --dport 1521 -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 1521 -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT


另外一种,好像和上面一样,只是先后顺序不一样 --source 对应 -s 估计是简写吧


# Generated by iptables-save v1.4.7 on Wed Aug 23 18:00:46 2017
*filter
:INPUT ACCEPT [90:26030]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [61:9044]
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 1521 --source xx.xxx.xx.xx/32 -j ACCEPT


-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 1521 -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 27017 -j REJECT --reject-with icmp-host-prohibited


-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Aug 23 18:00:46 2017
~                                          


修改配置后。直接service iptables restart 就可以了            

阅读更多 登录后自动展开
想对作者说点什么? 我来说一句

没有更多推荐了,返回首页