阿里云Centos配置iptables防火墙教程
<p>虽说阿里云推出了云盾服务，但是自己再加一层防火墙总归是更安全些，下面是我在阿里云vps上配置防火墙的过程，目前只配置INPUT。OUTPUT和FORWORD都是ACCEPT的规则</p>
<p>
<strong>一、检查iptables服务状态</strong></p>
<p>
首先检查iptables服务的状态</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_29177">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># service iptables status</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">iptables: Firewall is not running.</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
说明iptables服务是有安装的，但是没有启动服务。<br>
如果没有安装的话可以直接yum安装</p>
<p>
<span>yum install -y iptables</span></p>
<p>
启动iptables</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_623159">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash plain"></code><code class="bash comments"># service iptables start</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain">iptables: Applying firewall rules: [ OK ]</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
看一下当前iptables的配置情况</p>
<p>
<span># iptables -L -n</span></p>
<p>
<strong>二、清除默认的防火墙规则</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_299107">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash comments">#首先在清除前要将policy INPUT改成ACCEPT,表示接受一切请求。</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash comments">#这个一定要先做，不然清空后可能会悲剧</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">iptables -P INPUT ACCEPT</code>
</div>
<div class="line number4 index3 alt1">
</div>
<div class="line number5 index4 alt2">
<code class="bash comments">#清空默认所有规则</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash plain">iptables -F</code>
</div>
<div class="line number7 index6 alt2">
</div>
<div class="line number8 index7 alt1">
<code class="bash comments">#清空自定义的所有规则</code>
</div>
<div class="line number9 index8 alt2">
<code class="bash plain">iptables -X</code>
</div>
<div class="line number10 index9 alt1">
</div>
<div class="line number11 index10 alt2">
<code class="bash comments">#计数器置0</code>
</div>
<div class="line number12 index11 alt1">
<code class="bash plain">iptables -Z</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>三、配置规则</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_921158">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
<div class="line number13 index12 alt2">
13</div>
<div class="line number14 index13 alt1">
14</div>
<div class="line number15 index14 alt2">
15</div>
<div class="line number16 index15 alt1">
16</div>
<div class="line number17 index16 alt2">
17</div>
<div class="line number18 index17 alt1">
18</div>
<div class="line number19 index18 alt2">
19</div>
<div class="line number20 index19 alt1">
20</div>
<div class="line number21 index20 alt2">
21</div>
<div class="line number22 index21 alt1">
22</div>
<div class="line number23 index22 alt2">
23</div>
<div class="line number24 index23 alt1">
24</div>
<div class="line number25 index24 alt2">
25</div>
<div class="line number26 index25 alt1">
26</div>
<div class="line number27 index26 alt2">
27</div>
<div class="line number28 index27 alt1">
28</div>
<div class="line number29 index28 alt2">
29</div>
<div class="line number30 index29 alt1">
30</div>
<div class="line number31 index30 alt2">
31</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash comments">#允许来自于lo接口的数据包</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash comments">#如果没有此规则，你将不能通过127.0.0.1访问本地服务，例如ping 127.0.0.1</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash plain">iptables -A INPUT -i lo -j ACCEPT </code>
</div>
<div class="line number4 index3 alt1">
<code class="bash spaces"> </code>
</div>
<div class="line number5 index4 alt2">
<code class="bash comments">#ssh端口22</code>
</div>
<div class="line number6 index5 alt1">
<code class="bash plain">iptables -A INPUT -p tcp --dport 22 -j ACCEPT</code>
</div>
<div class="line number7 index6 alt2">
<code class="bash spaces"> </code>
</div>
<div class="line number8 index7 alt1">
<code class="bash comments">#FTP端口21</code>
</div>
<div class="line number9 index8 alt2">
<code class="bash plain">iptables -A INPUT -p tcp --dport 21 -j ACCEPT</code>
</div>
<div class="line number10 index9 alt1">
<code class="bash spaces"> </code>
</div>
<div class="line number11 index10 alt2">
<code class="bash comments">#web服务端口80</code>
</div>
<div class="line number12 index11 alt1">
<code class="bash plain">iptables -A INPUT -p tcp --dport 80 -j ACCEP</code>
</div>
<div class="line number13 index12 alt2">
<code class="bash spaces"> </code>
</div>
<div class="line number14 index13 alt1">
<code class="bash comments">#tomcat</code>
</div>
<div class="line number15 index14 alt2">
<code class="bash plain">iptables -A INPUT -p tcp --dport xxxx -j ACCEP</code>
</div>
<div class="line number16 index15 alt1">
<code class="bash spaces"> </code>
</div>
<div class="line number17 index16 alt2">
<code class="bash comments">#mysql</code>
</div>
<div class="line number18 index17 alt1">
<code class="bash plain">iptables -A INPUT -p tcp --dport xxxx -j ACCEP</code>
</div>
<div class="line number19 index18 alt2">
<code class="bash spaces"> </code>
</div>
<div class="line number20 index19 alt1">
<code class="bash comments">#允许icmp包通过,也就是允许ping</code>
</div>
<div class="line number21 index20 alt2">
<code class="bash plain">iptables -A INPUT -p icmp -m icmp --icmp-</code><code class="bash functions">type</code> <code class="bash plain">8 -j ACCEPT</code>
</div>
<div class="line number22 index21 alt1">
<code class="bash spaces"> </code>
</div>
<div class="line number23 index22 alt2">
<code class="bash comments">#允许所有对外请求的返回包</code>
</div>
<div class="line number24 index23 alt1">
<code class="bash comments">#本机对外请求相当于OUTPUT,对于返回数据包必须接收啊，这相当于INPUT了</code>
</div>
<div class="line number25 index24 alt2">
<code class="bash plain">iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT</code>
</div>
<div class="line number26 index25 alt1">
<code class="bash spaces"> </code>
</div>
<div class="line number27 index26 alt2">
<code class="bash comments">#如果要添加内网ip信任（接受其所有TCP请求）</code>
</div>
<div class="line number28 index27 alt1">
<code class="bash plain">iptables -A INPUT -p tcp -s 45.96.174.68 -j ACCEPT</code>
</div>
<div class="line number29 index28 alt2">
<code class="bash spaces"> </code>
</div>
<div class="line number30 index29 alt1">
<code class="bash comments">#过滤所有非以上规则的请求</code>
</div>
<div class="line number31 index30 alt2">
<code class="bash plain">iptables -P INPUT DROP</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
<strong>四、保存</strong><br>
首先iptables -L -n看一下配置是否正确。<br>
没问题后，先不要急着保存，因为没保存只是当前有效，重启后就不生效，这样万一有什么问题，可以后台强制重启服务器恢复设置。<br><span><strong>另外开一个ssh连接，确保可以登陆。</strong></span></p>
<p>
确保没问题之后保存</p>
<div class="jb51code">
<div>
<div class="syntaxhighlighterbash" id="highlighter_159967">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="bash comments">#保存</code>
</div>
<div class="line number2 index1 alt1">
<code class="bash plain"></code><code class="bash comments"># service iptables save</code>
</div>
<div class="line number3 index2 alt2">
<code class="bash spaces"> </code>
</div>
<div class="line number4 index3 alt1">
<code class="bash comments">#添加到自启动chkconfig</code>
</div>
<div class="line number5 index4 alt2">
<code class="bash plain"></code><code class="bash comments"># chkconfig iptables on</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
<div class="codetool" id="codetool">
<div class="code_n">
<textarea></textarea>
</div>
</div>
</div>
<p>
以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持服务器之家。</p>
頁:
[1]