iptables安装使用 (为Redis开放特定IP)
停用firewall
由于centos7默认是使用firewall作为防火墙,先关闭firewall。
#停止firewall
systemctl stop firewalld.service
#禁止firewall开机启动
systemctl disable firewalld.service
#查看firewall status
# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: inactive (dead)
Docs: man:firewalld(1)
iptables安装
查看iptables-services
#yum list iptables-services
Loaded plugins: fastestmirror
Determining fastest mirrors
Available Packages
iptables-services.x86_64 1.4.21-24.1.el7_5 updates
安装iptables
yum install iptables-services -y
iptables配置
编辑配置
vim /etc/sysconfig/iptables
默认配置如下:
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
修改配置如下:
*filter
#拒绝全部INPUT
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#INPUT增加IP白名单(对该IP所有端口开放)
-A INPUT -s 18.28.238.59 -j ACCEPT
-A INPUT -s 18.88.178.14 -j ACCEPT
#开放80端口
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
#开放特定IP的特定端口端口
-A INPUT -s 18.88.178.14 -p tcp -m tcp --dport 6379 -j ACCEPT
#ping使用的端口
-A INPUT -p icmp -j ACCEPT
#开放localhost
-A INPUT -i lo -j ACCEPT
#开放RELATED,ESTABLISHED状态
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#拒绝其他端口的操作
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
启动iptables
service iptables start
关闭与状态
service iptables start #启动服务
service iptables stop #停止服务
service iptables restart #重启服务
查看iptables
# systemctl status iptables.service
● iptables.service - IPv4 firewall with iptables
Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
Active: active (exited) since Tue 2018-11-06 11:26:57 CST; 4s ago
Process: 25961 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
Main PID: 25961 (code=exited, status=0/SUCCESS)
Nov 06 11:26:57 haocailai-001 systemd[1]: Starting IPv4 firewall with iptables...
Nov 06 11:26:57 haocailai-001 iptables.init[25961]: iptables: Applying firewall rules: [ OK ]
Nov 06 11:26:57 haocailai-001 systemd[1]: Started IPv4 firewall with iptables.
设置开机启动
# systemctl enable iptables.service
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.