CentOS7的firewall和安装iptables

前言：CentOS7 的防火墙默认使用是firewall，而我们通常使用iptables；

本文记录了firewall基础的命令和iptables的安装和使用。

 

firewall部分：

part1 : 服务命令

systemctl start firewalld#启动

systemctl status firewalld #查看运行状态

systemctl stop firewalld.service #停止firewall

systemctl disable firewalld.service #禁用：禁止firewall开机启动

firewall-cmd --state #

firewall-cmd--reload 重启

part2 : 端口命令：

添加

firewall-cmd --zone=public --add-port=80/tcp --permanent   （--permanent永久生效，没有此参数重启后失效）

重新载入

firewall-cmd --reload

查看

firewall-cmd --zone= public --query-port=80/tcp

删除

firewall-cmd --zone= public --remove-port=80/tcp --permanent

 

part3:示例

 

示例：firewall端口操作完之后需要重启服务生效

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp  
2. no  
3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3307/tcp --permanent  
4. success  
5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp  
6. no  
7. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload  
8. success  
9. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp  
10. yes  

 

示例：mysql开放远程端口 

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3306/tcp --permanent  
2. success  
3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload  
4. success  
5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --state  
6. running  
7. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#  
8. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3306/tcp  
9. yes  
10. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#  

iptables部分

 

part1 : 服务命令

 

systemctl start iptables #启动

systemctl status iptables #查看运行状态

systemctl restart iptables.service #停止iptables

systemctl stop iptables.service #停止iptables

systemctl disable iptables.service #禁用：禁止iptables开机启动

systemctl enable iptables.service #

 

part2 : 安装

step1 ： 查看是否安装

 

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables  
2. Unit iptables.service could not be found.  
3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#  

没有相关服务

 

step2 : yum install 

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# yum install iptables-services  
2. Loaded plugins: fastestmirror  
3. base                                                                                                             | 3.6 kB  00:00:00       
4. epel                                                                                                             | 4.3 kB  00:00:00       
5. extras                                                                                                           | 3.4 kB  00:00:00       
6. mysql-connectors-community                                                                                       | 2.5 kB  00:00:00       
7. mysql-tools-community                                                                                            | 2.5 kB  00:00:00       
8. mysql56-community                                                                                                | 2.5 kB  00:00:00       
9. updates                                                                                                          | 3.4 kB  00:00:00       
10. updates/7/x86_64/primary_db                                                                                      | 6.4 MB  00:00:06       
11. Loading mirror speeds from cached hostfile  
12.  * base: mirrors.aliyuncs.com  
13.  * epel: mirrors.aliyuncs.com  
14.  * extras: mirrors.aliyuncs.com  
15.  * updates: mirrors.aliyuncs.com  
16. Resolving Dependencies  
17. --> Running transaction check  
18. ---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed  
19. --> Finished Dependency Resolution  
20.   
21. Dependencies Resolved  
22.   
23. ========================================================================================================================================  
24.  Package                                Arch                        Version                             Repository                 Size  
25. ========================================================================================================================================  
26. Installing:  
27.  iptables-services                      x86_64                      1.4.21-17.el7                       base                       50 k  
28.   
29. Transaction Summary  
30. ========================================================================================================================================  
31. Install  1 Package  
32.   
33. Total download size: 50 k  
34. Installed size: 24 k  
35. Is this ok [y/d/N]: Y  
36. Downloading packages:  
37. iptables-services-1.4.21-17.el7.x86_64.rpm                                                                       |  50 kB  00:00:00       
38. Running transaction check  
39. Running transaction test  
40. Transaction test succeeded  
41. Running transaction  
42.   Installing : iptables-services-1.4.21-17.el7.x86_64                                                                               1/1   
43. warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew  
44.   Verifying  : iptables-services-1.4.21-17.el7.x86_64                                                                               1/1   
45.   
46. Installed:  
47.   iptables-services.x86_64 0:1.4.21-17.el7                                                                                                
48.   
49. Complete!  
50. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#         

安装成功！

 

step3 : check 

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables  
2.    iptables.service - IPv4 firewall with iptables  
3.    Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)  
4.    Active: inactive (dead)  
5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#     

step4 : start 

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl start iptables  
2. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl enable iptables.service  
3. Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.  
4. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#   

 

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables  
2.    iptables.service - IPv4 firewall with iptables  
3.    Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)  
4.    Active: active (exited) since Wed 2017-06-21 15:44:41 CST; 1min 17s ago  
5.  Main PID: 506 (code=exited, status=0/SUCCESS)  
6.   
7. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Starting IPv4 firewall with iptables...  
8. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ iptables.init[506]: iptables: Applying firewall rules: [  OK  ]  
9. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Started IPv4 firewall with iptables.  
10. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#   

step5 : 修改配置文件

vi /etc/sysconfig/iptables 

systemctl restart iptables.service #重启防火墙使配置生效

 

step6 ： 关闭SELINUX

 

vi/etc/selinux/config

#SELINUX=enforcing #注释掉

#SELINUXTYPE=targeted #注释掉

SELINUX=disabled #增加

:wq! #保存退出 

setenforce 0 #使配置立即生效

 

备注：

SELINUX不关闭时，iptables不读取配置文件，一般采取关闭SELINUX的方式避免这种冲突

转载于:https://www.cnblogs.com/dengshihuang/p/8032262.html