centos 6.9 防火墙策略增加

来源：互联网发布：淘宝防身电击器编辑：程序博客网时间：2024/06/05 17:28

vi /etc/sysconfig/iptables

# Generated by iptables-save v1.4.7 on Fri Aug 25 10:54:48 2017
*filter
:INPUT ACCEPT [6128:1521617]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [5824:2626314]
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -s xx.xxx.xx.xx/32 -p tcp -m conntrack --ctstate NEW -m tcp --dport 1521 -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 1521 -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

另外一种，好像和上面一样，只是先后顺序不一样 --source 对应 -s 估计是简写吧

# Generated by iptables-save v1.4.7 on Wed Aug 23 18:00:46 2017
*filter
:INPUT ACCEPT [90:26030]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [61:9044]
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 1521 --source xx.xxx.xx.xx/32 -j ACCEPT

-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 1521 -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m conntrack --ctstate NEW -m tcp --dport 27017 -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed on Wed Aug 23 18:00:46 2017
~

修改配置后。直接service iptables restart 就可以了

阅读全文

0 0