CentOS-启用iptables防火墙

1.检查默认防火墙的启用情况

[root@localhost ~]# firewall-cmd —state

2.如果显示running，则需要关闭默认的firewall防火墙以及取消防火墙的开机启动属性

systemctl stop firewalld.service

systemctl disable firewalls.service

3.安装iptables防火墙

yum install -y iptables-services

iptables安装成功后，默认的配置文件在 /etc/sysconfig/iptables

4.查看iptables状态

[root@localhost ~]# systemctl status iptables.service

● iptables.service - IPv4 firewall with iptables

   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)

   Active: inactive (dead)

5.启动iptables

systemctl start(|stop|restart|status) iptables.service

6.设置开机自启动

[root@localhost ~]# systemctl enable iptables.service

Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.

7.添加过滤端口

默认情况下，iptables会自动允许22端口的访问

[root@localhost ~]# vi /etc/sysconfig/iptables

# sample configuration for iptables service

# you can edit this manually or use system-config-firewall

# please do not ask us to add additional ports/services to this default configuration

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT ＃主要参考这一条

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

比如我们要允许80端口的访问，需要添加

-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT

同时需要把新添加的纪录放在

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT

的 上一条或者下一条的位置，如果放在其它位置，有可能会导致配置不生效。

配置后，需要重启iptable才能使配置生效

systemctl restart iptables.service

注意：以后涉及到端口的允许，需要修改iptables的配置文件来实现