1.允许ssh通过

[root@server ~]# iptables -t filter -A INPUT –s 10.106.42.169 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT

[root@server ~]#

[root@server ~]# iptables -t filter -A OUTPUT -d 10.106.42.169 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT

--避免反弹***

[root@server ~]# iptables -P INPUT DROP

[root@server ~]# iptables -P OUTPUT DROP

[root@server ~]# iptables -P FORWARD DROP

 

2.允许127.0.0.1与用户进程通信

[root@server ~]# ping 127.0.0.1

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.

ping: sendmsg: Operation not permitted

[root@server ~]# iptables -t filter -A INPUT -i lo -j ACCEPT

[root@server ~]# iptables -t filter -A OUTPUT -o lo -j ACCEPT

--apache 和用户的其他进程启动不了，需要把其打开

[root@server ~]# ping 127.0.0.1

PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.

64 bytes from 127.0.0.1: icmp_seq=1 ttl=64 time=0.035 ms

64 bytes from 127.0.0.1: icmp_seq=2 ttl=64 time=0.061 ms

^C

--- 127.0.0.1 ping statistics ---

2 packets transmitted, 2 received, 0% packet loss, time 999ms

rtt min/avg/max/mdev = 0.035/0.048/0.061/0.013 ms

[root@server ~]#

 

 

3.允许ping通过

网络层协议

Icmp、Arp、rp、 ip

Icmp没有端口号

 

Ping 请求的是8、 回应是 0

-p  icmp  --icmp-type [!] typename

              echo-reply / 0

             echo-request  /8

[root@server ~]# iptables -t filter -A INPUT -s 10.106.42.175 -p icmp --icmp-type echo-request -j ACCEPT

[root@server ~]# iptables -t filter -A OUTPUT -d 10.106.42.175 -p icmp --icmp-type echo-reply -j ACCEPT


 

4.保存iptables规则：

[root@server ~]# service iptables

Usage: /etc/init.d/iptables{start|stop|restart|condrestart|status|panic|save}

[root@server ~]# service iptablessave

 

5.# modprobe ip_nat_ftp –ftp防火墙控制需要加载的模块

#lsmod --查看加载的模块

#vim /etc/modprode.conf

--把加载的模块写入文件实现永久加载