【环境配置】centos 配置防火墙，查看端口和进程

1，基本操作

# centos 6.x
service iptables status # 查看防火墙状态
service iptables stop # 停止防火墙

service iptables start # 启动防火墙
service iptables restart # 重启防火墙

chkconfig iptables off # 永久关闭防火墙
chkconfig iptables on # 永久关闭后重启

# centos 7.x
firewall-cmd --zone=public --add-port=80/tcp --permanent
# –zone #作用域
# –add-port=80/tcp #添加端口，格式为：端口/通讯协议
# –permanent #永久生效，没有此参数重启后失效
systemctl stop firewalld.service  
systemctl start firewalld.service 

2，查看防火墙状态

service iptables status
表格：filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination 

3，配置文件管理

cat /etc/sysconfig/iptables
# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [6:624]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT # 开启80端口
-A INPUT -s 111.111.0.0/16 -p tcp --dport 22 -j ACCEPT # 22端口限制访问

4,查看进程

ps -ef | grep python
root       1438   1348  0 14:47 pts/0    00:00:00 grep python

5,查看TCP端口

netstat -tunlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1208/sshd           
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      1287/master         
tcp        0      0 127.0.0.1:6010              0.0.0.0:*                   LISTEN      1346/sshd           
tcp        0      0 :::22                       :::*                        LISTEN      1208/sshd           
tcp        0      0 ::1:25                      :::*                        LISTEN      1287/master         
tcp        0      0 ::1:6010                    :::*                        LISTEN      1346/sshd

6,查看UDP端口

netstat -nupl
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name       
udp6       0      0 ::1:323                 :::*                                535/chronyd