CentOS 7 安装iptables防火墙

CentOS7默认的防火墙不是iptables,而是firewall.

安装iptable iptable-service

service iptables status  # 先检查是否安装了iptablesyum install -y iptables  # 安装iptablesyum update iptables      # 升级iptablesyum install iptables-services  # 安装iptables-services

禁用/停止自带的firewalld服务

systemctl stop firewalld  # 停止firewalld服务systemctl mask firewalld  # 禁用firewalld服务iptables -L -n  # 查看iptables现有规则iptables -P INPUT ACCEPT  # 先允许所有,不然有可能会杯具iptables -F  # 清空所有默认规则iptables -X  # 清空所有自定义规则iptables -Z  # 所有计数器归0

添加防火墙策略：/etc/sysconfig/iptables , 示例：

# Firewall configuration written by system-config-firewall# Manual customization of this file is not recommended.*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT-A INPUT -m state --state NEW -m tcp -p tcp --dport 13306 -j ACCEPT-A INPUT -s 10.10.20.0/24 -p udp -m udp -j ACCEPT-A INPUT -s 10.10.20.0/24 -p tcp -m tcp -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibited

配置开机启动

systemctl enable iptables.service  # 注册服务，相当于以前的chkconfigsystemctl start iptables.service  # 开启服务systemctl status iptables.service  # 查看状态