linux防火墙还原,linux-防火墙设置

防火墙状态

查询防火墙状态

service iptables status

停止防火墙

service iptables stop

启动防火墙

service iptables start

重启防火墙

service iptables restart

永久关闭防火墙

chkconfig iptables off

永久关闭后启动

chkconfig iptables on

关闭防火墙注意

*) 如果要关闭iptables ,可以通过命令 /etc/init.d/iptables stop 停止

*) 也可以通过 service iptables stop 来停止

注意：

以上命令虽然关闭了iptables,但是如果设置了自动启动的话,iptables会自动开启(命令chkconfig查看系统自动启动进程)

[root@ssgao1987 bin]# chkconfig |grep iptables

iptables 0:关闭1:关闭2:启用3:启用4:启用5:启用6:关闭

'所以我们还要关闭自动启动,避免重启后又启动了防火墙'

[root@ssgao1987 bin]# chkconfig iptables off(设置自动启动为关闭 chkconfig --del iptables 移除开机自动启动)

[root@ssgao1987 bin]# chkconfig |grep iptables

iptables 0:关闭1:关闭2:关闭3:关闭4:关闭5:关闭6:关闭

然后停止防火墙(service iptables stop)

[root@ssgao1987 bin]# service iptables stop

iptables：将链设置为政策 ACCEPT：filter [确定]

iptables：清除防火墙规则： [确定]

iptables：正在卸载模块： [确定]

[root@ssgao1987 bin]# service iptables status

iptables：未运行防火墙

防火墙打开某个端口

查看防火墙状态

[root@ssgao1987 bin]# service iptables status

表格：filter

Chain INPUT (policy ACCEPT)

num target prot opt source destination

1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0

3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22

(表示目前防火墙开着,只接受外面的(本机外)22端口)

5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

num target prot opt source destination

1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

num target prot opt source

编辑/etc/sysconfig/iptables防火墙配置文件

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 2181 -j ACCEPT(打开2181端口)

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

重启防火墙: service iptables restatus

查看防火墙状态:

[root@ssgao1987 bin]# service iptables status

表格：filter

Chain INPUT (policy ACCEPT)

num target prot opt source destination

1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED

2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0

3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0

4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22

5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:2181

6 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

num target prot opt source destination

1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

num target prot opt source destination