linux防火墙拒绝访问权限,linux环境 封ip,限制访问,防刷接口,防火墙封ip

### 1在防火墙封

cat /etc/sysconfig/iptableshtml

## apache

# Firewall configuration written by system-config-firewall

2 # Manual customization of this file is not recommended.

3 *filter

4 :INPUT ACCEPT [0:0]

5 :FORWARD ACCEPT [0:0]

6 :OUTPUT ACCEPT [0:0]

7 #-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT

8 -A INPUT -p tcp -m tcp --dport 8084 -j ACCEPT

9 -A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPT

10 #-A INPUT -p tcp -m tcp --dport 21 -j ACCEPT

11 #-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

12 -A INPUT -s 117.135.144.51 -p TCP --dport 80 -j REJECT

13 -A INPUT -s 221.226.83.196 -p TCP --dport 80 -j REJECT

14 -A INPUT -s 183.21.229.224 -p TCP --dport 80 -j REJECT

15 #-A INPUT -s 211.157.135.2 -p TCP --dport 80 -j REJECT

16 -A INPUT -s 182.201.30.90 -p TCP --dport 80 -j REJECT

17 -A INPUT -s 58.135.84.45 -p TCP --dport 80 -j REJECT

18 -A INPUT -s 114.252.158.120 -p TCP --dport 80 -j REJECT

19 -A INPUT -s 124.127.182.6 -p TCP --dport 80 -j REJECT

20 -A INPUT -s 121.69.86.2 -p TCP --dport 80 -j REJECT

21 -A INPUT -s 221.226.83.196 -p TCP --dport 80 -j REJECT

22 -A INPUT -s 182.92.74.178 -p TCP --dport 80 -j REJECT

23 -A INPUT -s 111.126.72.42 -p TCP --dport 80 -j REJECT

24 -A INPUT -s 222.249.171.146 -p TCP --dport 80 -j REJECT

25 -A INPUT -s 113.9.245.3 -p TCP --dport 80 -j REJECT

26 -A INPUT -s 61.187.56.174 -p TCP --dport 80 -j REJECT

27 -A INPUT -s 183.129.217.146 -p TCP --dport 80 -j REJECT

28 -A INPUT -s 182.118.33.6 -p TCP --dport 80 -j REJECT

29 -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

30 -A INPUT -p tcp -m tcp --dport 873 -j ACCEPT

31 -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT

32 -A INPUT -p udp -m udp --dport 161 -j ACCEPT

33 #-A INPUT -p icmp -j REJECT

34 -A INPUT -p tcp -m tcp --dport 11211 -j ACCEPT

35 -A INPUT -p tcp -m tcp --dport 5666 -j ACCEPT

36 -A INPUT -p tcp -m tcp --dport 5901 -j ACCEPT

37 -A INPUT -p tcp -m tcp --dport 2049 -j ACCEPT

38 -A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT

39 -A INPUT -p tcp -m tcp --dport 9999 -j ACCEPT

40 -A INPUT -p tcp -m state --state NEW -m tcp --dport 20000:20500 -j ACCEPT

41 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

42 -A INPUT -p icmp -j ACCEPT

43 -A INPUT -i lo -j ACCEPT

44 -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

45 -A INPUT -m state --state NEW -m tcp -p tcp --dport 4948 -j ACCEPT

46 -A INPUT -j REJECT --reject-with icmp-host-prohibited

47 -A FORWARD -j REJECT --reject-with icmp-host-prohibited

48 COMMITless

要封ip 直接 复制一行 改ip就好了 而后重启 /etc/init.d/iptables restarttcp

cat access.log |awk '{print $1}'| sort | uniq -c |sort -nr |lesside

### 2apache配置文件封ip,拒绝访问

Options All

AllowOverride None

Order Deny,Allow

Deny From all

Allow From 192.168.0.0/24

Allow From 127.0.0.1

Allow From 59.37.x.x/28

上面这一段的意思是对/var/www目录下面的文件,只容许从192.168.0/24 和 127.0.一、59.37.x.x/28这几个IP段内的用户访问.

下面的这一段与上面的恰好相反,禁止从192.168.0 和 127.0.1这两个字段内的用户访问.

Options All

AllowOverride None

Order Deny,Allow

Allow From all

Deny From 192.168.0

Deny From 127.0.0.1

这里能够用include把想要限制访问的ip或者想要容许的ip写在一个文件里，把它包含进来，这样方便修改，例如

Options All

AllowOverride None

Order Deny,Allow

Deny From all

include conf/ip.conf

而后在ip.conf中增长想要allow的ip，好比：

Allow From 192.168.0.0/24

Allow From 127.0.0.1

Allow From 59.37.x.x/28

这样方便之后修改post