1.检查默认防火墙的启用情况
[root@localhost ~]#
firewall-cmd —state
2.如果显示running,则需要关闭默认的firewall防火墙以及取消防火墙的开机启动属性
systemctl stop firewalld.service
systemctl disable firewalls.service
3.安装iptables防火墙
yum install -y iptables-services
iptables安装成功后,默认的配置文件在 /etc/sysconfig/iptables
4.查看iptables状态
[root@localhost ~]# systemctl status iptables.service
● iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
Active: inactive (dead)
5.启动iptables
systemctl start(|stop|restart|status) iptables.service
6.设置开机自启动
[root@localhost ~]# systemctl enable iptables.service
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
7.添加过滤端口
默认情况下,iptables会自动允许22端口的访问
[root@localhost ~]# vi /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT #主要参考这一条
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
比如我们要允许80端口的访问,需要添加
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
同时需要把新添加的纪录放在
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
的
上一条或者下一条的位置,如果放在其它位置,有可能会导致配置不生效。
配置后,需要重启iptable才能使配置生效
systemctl restart iptables.service
注意:以后涉及到端口的允许,需要修改iptables的配置文件来实现