CentOS7安装iptables防火墙

由于centos7默认是使用firewall作为防火墙，而不是iptables，下面介绍如何将系统的防火墙设置为iptables。

1.关闭和禁用firewalld

1）查看firewalld状态：
[root@localhost sysconfig]# systemctl status firewalld.service 
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: active (running) since 五 2017-12-22 03:39:35 CST; 2s ago
     Docs: man:firewalld(1)
 Main PID: 3861 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─3861 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid
上面信息Active: active (running)表示firewalld没有关闭
2）关闭firewalld
[root@localhost sysconfig]# systemctl stop firewalld.service 
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since 五 2017-12-22 03:26:08 CST; 8min ago
     Docs: man:firewalld(1)
 Main PID: 829 (code=exited, status=0/SUCCESS)
 上面信息Active: inactive (dead)表示firewalld没有关闭
 3）禁止firewall开机启动 
 [root@localhost sysconfig]# systemctl disable firewalld.service 

2.安装防火墙iptables和iptables-services

1）查看是否安装iptables
[root@localhost sysconfig]# systemctl status iptables.service
2）若没有安装，进行安装
[root@localhost ~]# yum install -y iptables
[root@localhost ~]# yum install iptables-services
3）配置允许访问的端口
[root@localhost ~]# vim /etc/sysconfig/iptables 
..............
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 1521 -j ACCEPT
...............
...............
:wq保存
4）重启防火墙使配置文件生效 
[root@localhost ~]# systemctl restart iptables.service
5）设置开机自启动iptables防火墙
[root@localhost ~]# systemctl enable iptables.service
6）查看iptables状态
[root@localhost ~]# systemctl status iptables.service
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
   Active: active (exited) since 五 2017-12-22 03:53:05 CST; 1s ago
  Process: 4460 ExecStop=/usr/libexec/iptables/iptables.init stop (code=exited, status=0/SUCCESS)
  Process: 4534 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
 Main PID: 4534 (code=exited, status=0/SUCCESS)
7）启动iptables防火墙
[root@localhost ~]# systemctl start iptables.service
8）关闭iptables防火墙
[root@localhost ~]# systemctl stop iptables.service