CentOS 7 安装iptables防火墙

版权声明：本文为原创文章，允许转载，转载时请务必以超链接形式标明文章 原始出处 、作者信息和本声明。 https://blog.csdn.net/fgf00/article/details/78201457

CentOS7默认的防火墙不是iptables,而是firewall.

安装iptable iptable-service

service iptables status  # 先检查是否安装了iptables
yum install -y iptables  # 安装iptables
yum update iptables      # 升级iptables
yum install iptables-services  # 安装iptables-services

禁用/停止自带的firewalld服务

systemctl stop firewalld  # 停止firewalld服务
systemctl mask firewalld  # 禁用firewalld服务
iptables -L -n  # 查看iptables现有规则
iptables -P INPUT ACCEPT  # 先允许所有,不然有可能会杯具
iptables -F  # 清空所有默认规则
iptables -X  # 清空所有自定义规则
iptables -Z  # 所有计数器归0

添加防火墙策略：/etc/sysconfig/iptables , 示例：

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 13306 -j ACCEPT
-A INPUT -s 10.10.20.0/24 -p udp -m udp -j ACCEPT
-A INPUT -s 10.10.20.0/24 -p tcp -m tcp -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited

配置开机启动

systemctl enable iptables.service  # 注册服务，相当于以前的chkconfig
systemctl start iptables.service  # 开启服务
systemctl status iptables.service  # 查看状态