VCENTER 防火墙配置

蓝天~白云

已于 2023-07-24 17:42:13 修改

阅读量1.2k

点赞数 1

文章标签：服务器 linux 运维

于 2023-07-24 17:38:52 首次发布

本文链接：https://blog.csdn.net/tby329262287/article/details/131901410

版权

文章展示了在LinuxPhoton系统上使用iptables命令设置防火墙规则，允许特定IP地址的TCP和UDP流量访问特定端口（如902,22,80,5480,443），同时接受已建立的连接和SSH连接。防火墙规则设置完成后，通过`iptables-L`命令进行验证。

摘要由CSDN通过智能技术生成

root@photon-machine [ /etc/systemd/scripts ]# uname -a
Linux photon-machine 4.4.302-2.ph1 #1-photon SMP Sun Mar 27 02:58:11 UTC 2022 x86_64 GNU/Linux

root@photon-machine [ /etc/systemd/scripts ]# ls
iptables iptables.stop
##编辑iptables配置文件，如下

iptables -A INPUT -s 172.16.64.0/24 -p tcp -m tcp --dport 902 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 902 -j DROP
iptables -A INPUT -s 172.16.64.0/24 -p udp -m udp --dport 902 -j ACCEPT
iptables -A INPUT -p udp -m udp --dport 902 -j DROP
iptables -A INPUT -s 172.16.64.0/24 -p tcp -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 22 -j DROP
iptables -A INPUT -s 172.16.64.0/24 -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j DROP
iptables -A INPUT -s 172.16.64.0/24 -p tcp -m tcp --dport 5480 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 5480 -j DROP
iptables -A INPUT -s 172.16.64.0/24 -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j DROP

iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

#Enable ssh connections
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
# End /etc/systemd/scripts/iptables
##重启后验证防火墙规则

root@photon-machine [ ~ ]# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- 172.16.64.0/24 anywhere tcp dpt:ideafarm-door
DROP tcp -- anywhere anywhere tcp dpt:ideafarm-door
ACCEPT udp -- 172.16.64.0/24 anywhere udp dpt:ideafarm-door
DROP udp -- anywhere anywhere udp dpt:ideafarm-door
ACCEPT tcp -- 172.16.64.0/24 anywhere tcp dpt:ssh
DROP tcp -- anywhere anywhere tcp dpt:ssh
ACCEPT tcp -- 172.16.64.0/24 anywhere tcp dpt:http
DROP tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- 172.16.64.0/24 anywhere tcp dpt:5480
DROP tcp -- anywhere anywhere tcp dpt:5480
ACCEPT tcp -- 172.16.64.0/24 anywhere tcp dpt:https
DROP tcp -- anywhere anywhere tcp dpt:https
ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED
ACCEPT tcp -- anywhere anywhere tcp dpt:ssh