1,基本操作
# centos 6.x
service iptables status # 查看防火墙状态
service iptables stop # 停止防火墙
service iptables start # 启动防火墙
service iptables restart # 重启防火墙
chkconfig iptables off # 永久关闭防火墙
chkconfig iptables on # 永久关闭后重启
# centos 7.x
firewall-cmd --zone=public --add-port=80/tcp --permanent
# –zone #作用域
# –add-port=80/tcp #添加端口,格式为:端口/通讯协议
# –permanent #永久生效,没有此参数重启后失效
systemctl stop firewalld.service
systemctl start firewalld.service
2,查看防火墙状态
service iptables status
表格:filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
3,配置文件管理
cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6:624]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT # 开启80端口
-A INPUT -s 111.111.0.0/16 -p tcp --dport 22 -j ACCEPT # 22端口限制访问
4,查看进程
ps -ef | grep python
root 1438 1348 0 14:47 pts/0 00:00:00 grep python
5,查看TCP端口
netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 1208/sshd
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 1287/master
tcp 0 0 127.0.0.1:6010 0.0.0.0:* LISTEN 1346/sshd
tcp 0 0 :::22 :::* LISTEN 1208/sshd
tcp 0 0 ::1:25 :::* LISTEN 1287/master
tcp 0 0 ::1:6010 :::* LISTEN 1346/sshd
6,查看UDP端口
netstat -nupl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
udp6 0 0 ::1:323 :::* 535/chronyd