CentOS6/7-防火墙管理

#CentOS6
#开放端口运行外部访问（不指定源IP）
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
iptables -I INPUT -p tcp --dport 22 -j ACCEPT
iptables -I INPUT -p tcp --dport 3306 -j ACCEPT

#定向开放本地端口允许访问
iptables -I INPUT -s 10.86.87.0/24 -p tcp --dport 10050 -j ACCEPT

#然后保存：
/etc/rc.d/init.d/iptables save
/etc/init.d/iptables status

#防火墙启停
/etc/init.d/iptables start
/etc/init.d/iptables stop

禁止linux向外建立新连接（INPUT 向内）
1、iptables -I OUTPUT -m state --state NEW -j DROP

#拒绝IP所有请求
iptables -I INPUT -s 10.86.87.123 -j DROP
service iptables save
iptables -L

修改iptables配置文件添加防火墙策略

vi /etc/sysconfig/iptables

# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state –-state NEW -m tcp –dport 80 -j ACCEPT
-A INPUT -p tcp -m state –-state NEW -m tcp –dport 8080 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

注意点：新开放的端口一定要在端口22后面


>>>  CentOS 7.0默认使用的是firewall作为防火墙
#CentOS7常用命令
systemctl start firewalld.service                ##启动服务
systemctl stop firewalld.service                ##关闭服务
systemctl restart firewalld.service             ##重启服务
systemctl status firewalld.service              ##显示服务的状态
systemctl enable firewalld.service             ##在开机时启用服务
systemctl disable firewalld.service            ##在开机时禁用服务
systemctl is-enabled firewalld.service       ##查看服务是否开机启动
systemctl list-unit-files|grep enabled         ##查看已启动的服务列表
systemctl --failed                                       ##查看启动失败的服务列表

#CentOS7使用iptables防火墙配置（推荐!!）
1、关闭防火墙
systemctl stop firewalld.service           #停止firewall
systemctl disable firewalld.service        #禁止firewall开机启动

2、设置 iptables service
yum -y install iptables-services

#如果要修改防火墙配置，如增加防火墙端口3306，tomcat8080，nginx80端口

vi/etc/sysconfig/iptables       #编辑防火墙配置文件
# sampleconfiguration for iptables service
# you can edit thismanually or use system-config-firewall
# please do not askus to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT[0:0]
:OUTPUT ACCEPT[0:0]
-A INPUT -m state--state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -jACCEPT
-A INPUT -i lo -jACCEPT
-A INPUT -p tcp -mstate --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -jACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080-j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A INPUT -j REJECT--reject-with icmp-host-prohibited
-A FORWARD -jREJECT --reject-with icmp-host-prohibited
COMMIT
:wq!            #保存退出

#保存退出后
systemctl restart iptables.service #重启防火墙使配置生效
systemctl enable iptables.service #设置防火墙开机启动