Centos7 Firewall

 

1.1 firewall启停设置

[root@tomcat ~]# systemctl stop firewalld.service                    #关闭firewall
[root@tomcat ~]# systemctl status firewalld.service                  #查看状态
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)

Mar 13 09:28:55 tomcat systemd[1]: Starting firewalld - dynamic firewall daemon...
Mar 13 09:28:56 tomcat systemd[1]: Started firewalld - dynamic firewall daemon.
Mar 13 09:32:07 tomcat systemd[1]: Stopping firewalld - dynamic firewall daemon...
Mar 13 09:32:08 tomcat systemd[1]: Stopped firewalld - dynamic firewall daemon.
[root@tomcat ~]# firewall-cmd --state
not running
[root@tomcat ~]# systemctl start firewalld.service     #启动firewall
[root@tomcat ~]# systemctl status firewalld.service 
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: active (running) since Tue 2018-03-13 09:32:44 CST; 4s ago
 Main PID: 3737 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─3737 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Mar 13 09:32:43 tomcat systemd[1]: Starting firewalld - dynamic firewall daemon...
Mar 13 09:32:44 tomcat systemd[1]: Started firewalld - dynamic firewall daemon.
[root@tomcat ~]# firewall-cmd --state
running
[root@tomcat ~]# 

[root@tomcat ~]# systemctl disable firewalld.service                 #禁止开机启动
[root@tomcat ~]# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: active (running) since Tue 2018-03-13 09:32:44 CST; 3min 22s ago
Main PID: 3737 (firewalld)
CGroup: /system.slice/firewalld.service
└─3737 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Mar 13 09:32:43 tomcat systemd[1]: Starting firewalld - dynamic firewall daemon...
Mar 13 09:32:44 tomcat systemd[1]: Started firewalld - dynamic firewall daemon.

[root@tomcat ~]# systemctl enable firewalld.service    #设置开机启动
Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/basic.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.
[root@tomcat ~]# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2018-03-13 09:32:44 CST; 3min 48s ago
Main PID: 3737 (firewalld)
CGroup: /system.slice/firewalld.service
└─3737 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Mar 13 09:32:43 tomcat systemd[1]: Starting firewalld - dynamic firewall daemon...
Mar 13 09:32:44 tomcat systemd[1]: Started firewalld - dynamic firewall daemon.
[root@tomcat ~]#

 

2.1 安装iptables

[root@tomcat ~]# yum install iptables-service -y

[root@tomcat ~]# systemctl start iptables.service 
[root@tomcat ~]# systemctl enable iptables.service 
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
[root@tomcat ~]# systemctl status iptables.service 
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
   Active: active (exited) since Tue 2018-03-13 09:44:12 CST; 22s ago
 Main PID: 4441 (code=exited, status=0/SUCCESS)

Mar 13 09:44:12 tomcat systemd[1]: Starting IPv4 firewall with iptables...
Mar 13 09:44:12 tomcat iptables.init[4441]: iptables: Applying firewall rules: [  OK  ]
Mar 13 09:44:12 tomcat systemd[1]: Started IPv4 firewall with iptables.
[root@tomcat ~]# [root@tomcat ~]# iptables -I  INPUT 1 -p tcp --dport 22 -j ACCEPT         #-I  指定序号                      #iptable匹配规则从上至下依次匹配#INPUT   input链#-p   指定协议 #tcp 协议--dport   目的端口 -j    动作

[root@tomcat ~]# iptables -P INPUT DROP           #添加默认策略拒绝所有，我们将需要放行的策略放到前面，有流量是从前向后匹配，允许的则放行，没有匹配到的则执行默认策略丢弃    

-A 添加到最后一条

-P  添加默认策略

DROP   丢弃

 

 #添加一个别名

echo 'alias iptablist="iptables -nL --line-number"' >>/etc/profile

. /etc/profile

 

#放行8080端口的流量

iptables -I INPUT -p tcp --dport 8080 -j ACCEPT

 

#禁止外网ping

iptables -I INPUT -p icmp ! -s 172.16.10.0/24 -j DROP

 

 

#允许回环口通过

iptables -A INPUT -i lo -j ACCEPT

 

#允许关联的数据包通过

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

 

 #保存配置

iptables-save

 

　　

 

来源：https://www.cnblogs.com/ali6102/p/8553657.html