將CentOS7上的防火牆firewalld改成iptables

• 2019 年 10 月 5 日
• 筆記

我們可以將firewalld改成iptables。操作如下：

1、關閉firewall：

# systemctl stop firewalld.service

# systemctl disable firewalld.service  或者systemctl mask firewalld.service

2、安裝iptables防火牆

# service iptables status  檢測是否已經安裝過iptables

# yum install iptables-services

3、編輯防火牆規則

方法1：直接vi /etc/sysconfig/iptables #編輯防火牆配置文件

# Firewall configuration written by system-config-firewall

# Manual customization of this file is not recommended.

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m state –state NEW -m tcp -p tcp –dport 22 -j ACCEPT

-A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT

-A INPUT -m state –state NEW -m tcp -p tcp –dport 3306 -j ACCEPT

-A INPUT -j REJECT –reject-with icmp-host-prohibited

-A FORWARD -j REJECT –reject-with icmp-host-prohibited

COMMIT:

方法2：重寫規則

iptables -L -n

iptables -P INPUT ACCEPT   # 先允許全部，不然小心悲劇發生

iptables -F  #清空所有默認規則

iptables -X  #清空所有自定義規則

iptables -Z  #所有計數器歸0

iptables -A INPUT -i lo -j ACCEPT   放行本地迴環接口的數據

iptables -A INPUT -p tcp –dport 22 -j ACCEPT

iptables -A INPUT -p tcp –dport 80 -j ACCEPT

iptables -A INPUT -p tcp –dport 443 -j ACCEPT

iptables -A INPUT -p tcp -s 172.16.10/24 –dport 3306 -j ACCEPT   

iptables -A INPUT -p tcp -s 116.228.235.111 –dport 3306 -j ACCEPT   

iptables -A INPUT -p icmp –icmp-type 8 -j ACCEPT   #允許ping

# 下面3行規則是FTP放行通過【此外，還要修改/etc/sysconfig/iptables-config 添加IPTABLES_MODULES="ip_nat_ftp"】

iptables -A INPUT -p tcp –dport 20 -j ACCEPT

iptables -A INPUT -p tcp –dport 21 -j ACCEPT

iptables -A INPUT -m state –state  RELATED,ESTABLISHED -j ACCEPT

                iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -P FORWARD DROP

service iptables save   趕緊保存下規則，不然不是白寫了嘛

4、防火牆的其他參數等

保存防火牆規則

# /usr/libexec/iptables/iptables.init save

或者service iptables save

重啟防火牆

# systemctl restart iptables.service

設置防火牆開機啟動

# systemctl enable iptables.service 

# 查看防火牆狀態：

# systemctl status iptables.service 或者service iptables status