CentOS7的firewall和安装iptables

CentOS7 的防火墙默认使用是firewall，而我们通常使用iptables；

本文记录了firewall基础的命令和iptables的安装和使用。

 

firewall部分：

part1 : 服务命令

systemctl start firewalld#启动

systemctl status firewalld #查看运行状态

systemctl stop firewalld.service #停止firewall

systemctl disable firewalld.service #禁用：禁止firewall开机启动

firewall-cmd --state #查看默认防火墙状态（关闭后显示notrunning，开启后显示running）

firewall-cmd--reload 重启
 

part2 : 端口命令：

添加

firewall-cmd --zone=public --add-port=80/tcp --permanent   （--permanent永久生效，没有此参数重启后失效）

重新载入

firewall-cmd --reload

查看

firewall-cmd --zone= public --query-port=80/tcp

删除

firewall-cmd --zone= public --remove-port=80/tcp --permanent

 

part3:示例

 

示例：firewall端口操作完之后需要重启服务生效

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp

2. no

3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3307/tcp --permanent

4. success

5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp

6. no

7. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload

8. success

9. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp

10. yes

 

示例：mysql开放远程端口

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3306/tcp --permanent

2. success

3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload

4. success

5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --state

6. running

7. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

8. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3306/tcp

9. yes

10. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

 

iptables部分

 

part1 : 服务命令

 

systemctl start iptables #启动

systemctl status iptables #查看运行状态

systemctl restart iptables.service #停止iptables

systemctl stop iptables.service #停止iptables

systemctl disable iptables.service #禁用：禁止iptables开机启动

systemctl enable iptables.service #启用：设置iptables开机启动

 

part2 : 安装

step1 ： 查看是否安装

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables

2. Unit iptables.service could not be found.

3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

没有相关服务

 

step2 : yum install

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# yum install iptables-services

2. Loaded plugins: fastestmirror

3. base | 3.6 kB 00:00:00

4. epel | 4.3 kB 00:00:00

5. extras | 3.4 kB 00:00:00

6. mysql-connectors-community | 2.5 kB 00:00:00

7. mysql-tools-community | 2.5 kB 00:00:00

8. mysql56-community | 2.5 kB 00:00:00

9. updates | 3.4 kB 00:00:00

10. updates/7/x86_64/primary_db | 6.4 MB 00:00:06

11. Loading mirror speeds from cached hostfile

12. * base: mirrors.aliyuncs.com

13. * epel: mirrors.aliyuncs.com

14. * extras: mirrors.aliyuncs.com

15. * updates: mirrors.aliyuncs.com

16. Resolving Dependencies

17. --> Running transaction check

18. ---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed

19. --> Finished Dependency Resolution

20.  

21. Dependencies Resolved

22.  

23. ========================================================================================================================================

24. Package Arch Version Repository Size

25. ========================================================================================================================================

26. Installing:

27. iptables-services x86_64 1.4.21-17.el7 base 50 k

28.  

29. Transaction Summary

30. ========================================================================================================================================

31. Install 1 Package

32.  

33. Total download size: 50 k

34. Installed size: 24 k

35. Is this ok [y/d/N]: Y

36. Downloading packages:

37. iptables-services-1.4.21-17.el7.x86_64.rpm | 50 kB 00:00:00

38. Running transaction check

39. Running transaction test

40. Transaction test succeeded

41. Running transaction

42. Installing : iptables-services-1.4.21-17.el7.x86_64 1/1

43. warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew

44. Verifying : iptables-services-1.4.21-17.el7.x86_64 1/1

45.  

46. Installed:

47. iptables-services.x86_64 0:1.4.21-17.el7

48.  

49. Complete!

50. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

安装成功！

 

step3 : check

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables

2. iptables.service - IPv4 firewall with iptables

3. Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)

4. Active: inactive (dead)

5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

step4 : start

 

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl start iptables

2. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl enable iptables.service

3. Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.

4. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables

2. iptables.service - IPv4 firewall with iptables

3. Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)

4. Active: active (exited) since Wed 2017-06-21 15:44:41 CST; 1min 17s ago

5. Main PID: 506 (code=exited, status=0/SUCCESS)

6.  

7. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Starting IPv4 firewall with iptables...

8. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ iptables.init[506]: iptables: Applying firewall rules: [ OK ]

9. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Started IPv4 firewall with iptables.

10. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

step5 : 修改配置文件

vi /etc/sysconfig/iptables 

systemctl restart iptables.service #重启防火墙使配置生效

 

step6 ： 关闭SELINUX

 

vi/etc/selinux/config

#SELINUX=enforcing #注释掉

#SELINUXTYPE=targeted #注释掉

SELINUX=disabled #增加

:wq! #保存退出 

setenforce 0 #使配置立即生效

 

备注：

SELINUX不关闭时，iptables不读取配置文件，一般采取关闭SELINUX的方式避免这种冲突