1 #CentOS6 2 #开放端口运行外部访问（不指定源IP） 3 iptables -I INPUT -p tcp --dport 80 -j ACCEPT 4 iptables -I INPUT -p tcp --dport 22 -j ACCEPT 5 iptables -I INPUT -p tcp --dport 3306 -j ACCEPT 6 7 #定向开放本地端口允许访问 8 iptables -I INPUT -s 10.86.87.0/24 -p tcp --dport 10050 -j ACCEPT 9 10 #然后保存： 11 /etc/rc.d/init.d/iptables save 12 /etc/init.d/iptables status 13 14 #防火墙启停 15 /etc/init.d/iptables start 16 /etc/init.d/iptables stop 17 18 禁止linux向外建立新连接（INPUT 向内） 19 1、iptables -I OUTPUT -m state --state NEW -j DROP 20 21 #拒绝IP所有请求 22 iptables -I INPUT -s 10.86.87.123 -j DROP 23 service iptables save 24 iptables -L
修改iptables配置文件添加防火墙策略
vi /etc/sysconfig/iptables # sample configuration for iptables service # you can edit this manually or use system-config-firewall # please do not ask us to add additional ports/services to this default configuration *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state –-state NEW -m tcp –dport 80 -j ACCEPT -A INPUT -p tcp -m state –-state NEW -m tcp –dport 8080 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT
注意点：新开放的端口一定要在端口22后面
>>> CentOS 7.0默认使用的是firewall作为防火墙
#CentOS7常用命令
systemctl start firewalld.service ##启动服务
systemctl stop firewalld.service ##关闭服务
systemctl restart firewalld.service ##重启服务
systemctl status firewalld.service ##显示服务的状态
systemctl enable firewalld.service ##在开机时启用服务
systemctl disable firewalld.service ##在开机时禁用服务
systemctl is-enabled firewalld.service ##查看服务是否开机启动
systemctl list-unit-files|grep enabled ##查看已启动的服务列表
systemctl --failed ##查看启动失败的服务列表
#CentOS7使用iptables防火墙配置（推荐!!）
1、关闭防火墙
systemctl stop firewalld.service #停止firewall
systemctl disable firewalld.service #禁止firewall开机启动
2、设置 iptables service
yum -y install iptables-services
#如果要修改防火墙配置，如增加防火墙端口3306，tomcat8080，nginx80端口
1 vi/etc/sysconfig/iptables #编辑防火墙配置文件 2 # sampleconfiguration for iptables service 3 # you can edit thismanually or use system-config-firewall 4 # please do not askus to add additional ports/services to this default configuration 5 *filter 6 :INPUT ACCEPT [0:0] 7 :FORWARD ACCEPT[0:0] 8 :OUTPUT ACCEPT[0:0] 9 -A INPUT -m state--state RELATED,ESTABLISHED -j ACCEPT 10 -A INPUT -p icmp -jACCEPT 11 -A INPUT -i lo -jACCEPT 12 -A INPUT -p tcp -mstate --state NEW -m tcp --dport 22 -j ACCEPT 13 -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -jACCEPT 14 -A INPUT -p tcp -m state --state NEW -m tcp --dport 8080-j ACCEPT 15 -A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT 16 -A INPUT -j REJECT--reject-with icmp-host-prohibited 17 -A FORWARD -jREJECT --reject-with icmp-host-prohibited 18 COMMIT 19 :wq! #保存退出
#保存退出后
systemctl restart iptables.service #重启防火墙使配置生效
systemctl enable iptables.service #设置防火墙开机启动
