iptables企業級防火墻設置
1、首次命令行新建iptables步驟
iptables -F #清除規則
iptables -X #刪除自定義鏈
iptables -Z #清空計數
iptables -A INPUT -p tcp --dport 22 -j ACCEPT #開放22端訪問
iptables -A INPUT -i lo ACCEPT #信任回環端口
iptables -A OUTPUT -o lo -j ACCEPT
iptables -P INPUT DROP #設置INPUT鏈的默認規則為DROP
iptables -P OUTPUT ACCEPT #設置OUTPUT鏈的默認規則為DROP
iptables -P FORWARD DROP #設置FORWARD鏈的默認規則為DROP
####開放信任網段
iptables -A INPUT -s 192.168.1.100,192.168.2.0/24,192.168.3.0/24 -p all -j ACCEPT
iptables -A INPUT -p tcp --dport 5900:5910 -j ACCEPT
####開啟對外服務端口
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m multiport --dport 80,8080,443 -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
2、查看當前運行狀態的iptables的規則
iptables-save
3、查看默認iptables配置配置文件的規則
cat /etc/sysconfig/iptables
4、保存iptables配置
iptables-save > /etc/sysconfig/iptables
/etc/init.d/iptables save
5、重新執行iptables配置文件
iptables-restore /etc/sysconfig/iptables
6、啟停防火墻
/etc/init.d/iptables start
/etc/init.d/iptables stop
7、查看詳細的規則配置
[root@centos6 sysconfig]# iptables -nvL --line
Chain INPUT (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- lo 0.0.0.0/0 0.0.0.0/0
2 0 0 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8
3 247 20668 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22
4 411 49930 ACCEPT all -- 10.8.26.0/24 0.0.0.0/0
5 0 0 ACCEPT all -- 10.8.201.0/24 0.0.0.0/0
6 0 0 ACCEPT all -- 10.9.1.1 0.0.0.0/0
7 0 0 ACCEPT tcp -- 10.8.26.0/24 0.0.0.0/0 multiport dports 6888,11034
8 0 0 ACCEPT tcp -- 10.8.201.0/24 0.0.0.0/0 multiport dports 6888,11034
9 0 0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
10 0 0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpts:5900:5910
11 0 0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 multiport dports 8080,443
12 0 0 ACCEPT all -- * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
Chain FORWARD (policy DROP 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
num pkts bytes target prot opt in out source destination
1 0 0 ACCEPT all -- lo 0.0.0.0/0 0.0.0.0/0
2 172 17712 ACCEPT all -- * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
8、基本配置文件示例
[root@centos6 sysconfig]# cat /etc/sysconfig/iptables
# Generated by iptables-save v1.4.7 on Fri Jan 19 03:14:49 2018
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
####Trust loopback interface and Ping
-A INPUT -i lo -j ACCEPT
-A OUTPUT -o lo -j ACCEPT
-A INPUT -p icmp --icmp-type 8 -j ACCEPT
####Trust Network
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
-A INPUT -s 10.8.26.0/24 -j ACCEPT
-A INPUT -s 10.8.201.0/24 -j ACCEPT
-A INPUT -s 10.9.1.1/32 -j ACCEPT
-A INPUT -s 10.8.26.0/24,10.8.201.0/24 -p tcp -m multiport --dport 6888,11034 -j ACCEPT
####Open Port
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 5900:5910 -j ACCEPT
-A INPUT -p tcp -m multiport --dports 8080,443 -j ACCEPT
####Relate Packets
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
COMMIT
# Completed on Fri Jan 19 03:14:49 2018
iptables企業級防火墻設置