iptables安装使用（为Redis开放特定IP）

最新推荐文章于 2024-07-25 09:27:28 发布

灵动的艺术

最新推荐文章于 2024-07-25 09:27:28 发布

阅读量2.7k

点赞数 1

分类专栏：运维 Redis 文章标签： iptables

本文链接：https://blog.csdn.net/weixin_43430036/article/details/83784324

版权

Redis 同时被 2 个专栏收录

5 篇文章

订阅专栏

运维

3 篇文章

订阅专栏

本文详细介绍如何在CentOS 7系统中，通过停用firewall并安装及配置iptables，实现为Redis服务开放特定IP和端口的过程。步骤包括关闭firewall、安装iptables、编辑iptables配置文件以添加IP白名单和开放特定端口，最后启动并设置iptables开机启动。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

停用firewall

由于centos7默认是使用firewall作为防火墙，先关闭firewall。

#停止firewall 
systemctl stop firewalld.service

#禁止firewall开机启动 
systemctl disable firewalld.service

#查看firewall status
# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)

iptables安装

查看iptables-services

#yum list iptables-services
Loaded plugins: fastestmirror
Determining fastest mirrors
Available Packages
iptables-services.x86_64                                                                              1.4.21-24.1.el7_5                                                                              updates

安装iptables

yum install iptables-services -y

iptables配置

编辑配置

vim /etc/sysconfig/iptables

默认配置如下：

# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

修改配置如下：

*filter
#拒绝全部INPUT
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#INPUT增加IP白名单（对该IP所有端口开放）
-A INPUT -s 18.28.238.59 -j ACCEPT
-A INPUT -s 18.88.178.14 -j ACCEPT
#开放80端口
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

#开放特定IP的特定端口端口
-A INPUT -s 18.88.178.14 -p tcp -m tcp --dport 6379 -j ACCEPT
#ping使用的端口
-A INPUT -p icmp -j ACCEPT
#开放localhost
-A INPUT -i lo -j ACCEPT
#开放RELATED,ESTABLISHED状态
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#拒绝其他端口的操作
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

启动iptables

service iptables start

关闭与状态

service iptables  start     #启动服务
service iptables  stop　　   #停止服务
service iptables  restart　　#重启服务

查看iptables

# systemctl status iptables.service
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
   Active: active (exited) since Tue 2018-11-06 11:26:57 CST; 4s ago
  Process: 25961 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
 Main PID: 25961 (code=exited, status=0/SUCCESS)

Nov 06 11:26:57 haocailai-001 systemd[1]: Starting IPv4 firewall with iptables...
Nov 06 11:26:57 haocailai-001 iptables.init[25961]: iptables: Applying firewall rules: [  OK  ]
Nov 06 11:26:57 haocailai-001 systemd[1]: Started IPv4 firewall with iptables.

设置开机启动

# systemctl enable iptables.service
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.