CentOS下防火墙的配置

1.检查系统是否安装防火墙

iptables -V

2.安装

yum -y install iptables-services

3.查看防火墙的状态 service iptable status 4.临时关闭防火墙 service iptables stop 5.重启防火墙 service iptables restart 6.添加规则

iptables -A INPUT -p tcp --dport 22 -j ACCEPT 7.编辑配置

vim /etc/sysconfig/iptables 8.保存

service iptables save 9.重启

service iptables restart 完整的配置

# Generated by iptables-save v1.4.7 on Wed Aug 30 18:46:28 2017 *filter #:INPUT ACCEPT [6:384] :INPUT DROP [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [4:544] #COMMIT # 允许io接口的数据包，如果没有则不能访问本地 -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 21 -j ACCEPT -A INPUT -p tcp -m tcp --dport 20 -j ACCEPT -A INPUT -m state --state NEW -p TCP --dport 60000:60010 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited # 这两条的意思是在INPUT表和FORWARD表中拒绝所有其他不符合上述任何一条规则的数据包。并且发送一条host prohibited的消息给被拒绝的主机。 COMMIT # Completed on Wed Aug 30 18:46:28 2017