iptables安装使用 （为Redis开放特定IP）

停用firewall

由于centos7默认是使用firewall作为防火墙，先关闭firewall。

#停止firewall 
systemctl stop firewalld.service

#禁止firewall开机启动 
systemctl disable firewalld.service

#查看firewall status
# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)

iptables安装

查看iptables-services

#yum list iptables-services
Loaded plugins: fastestmirror
Determining fastest mirrors
Available Packages
iptables-services.x86_64                                                                              1.4.21-24.1.el7_5                                                                              updates

安装iptables

yum install iptables-services -y

iptables配置

编辑配置

vim /etc/sysconfig/iptables

默认配置如下：

# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

修改配置如下：

*filter
#拒绝全部INPUT
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#INPUT增加IP白名单（对该IP所有端口开放）
-A INPUT -s 18.28.238.59 -j ACCEPT
-A INPUT -s 18.88.178.14 -j ACCEPT
#开放80端口
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

#开放特定IP的特定端口端口
-A INPUT -s 18.88.178.14 -p tcp -m tcp --dport 6379 -j ACCEPT
#ping使用的端口
-A INPUT -p icmp -j ACCEPT
#开放localhost
-A INPUT -i lo -j ACCEPT
#开放RELATED,ESTABLISHED状态
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#拒绝其他端口的操作
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

启动iptables

service iptables start

关闭与状态

service iptables  start     #启动服务
service iptables  stop　　   #停止服务
service iptables  restart　　#重启服务

查看iptables

# systemctl status iptables.service
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
   Active: active (exited) since Tue 2018-11-06 11:26:57 CST; 4s ago
  Process: 25961 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
 Main PID: 25961 (code=exited, status=0/SUCCESS)

Nov 06 11:26:57 haocailai-001 systemd[1]: Starting IPv4 firewall with iptables...
Nov 06 11:26:57 haocailai-001 iptables.init[25961]: iptables: Applying firewall rules: [  OK  ]
Nov 06 11:26:57 haocailai-001 systemd[1]: Started IPv4 firewall with iptables.

设置开机启动

# systemctl enable iptables.service
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.