Mipu blog summarizes the common rules of Linux iptables firewall and shares them.
iptables install
yum install iptables
iptables rule cleanup
iptables -F
iptables -X
iptables -Z
open specified port
Allow the local loopback interface (that is, running the machine to access the machine)
iptables -A INPUT -s 127.0.0.1 -d 127.0.0.1 -j ACCEPT
Allow all local outgoing access
iptables -A OUTPUT -j ACCEPT
Allow access to port 22
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
Allow access to port 80
iptables -A INPUT -p tcp --dport 80 -j ACCEPT
Allow specified IP access 22
iptables -I INPUT -s 192.168.0.19 -p tcp --dport 22 -j ACCEPT
Block access by other rules not allowed
iptables -A INPUT -j REJECT
iptables -A FORWARD -j REJECT
Block IP
The command to block a single IP is
iptables -I INPUT -s 123.45.6.7 -j DROP
Seal the entire segment i.e. commands from 123.0.0.1 to 123.255.255.254
iptables -I INPUT -s 123.0.0.0/8 -j DROP
The block IP segment is the command from 123.45.0.1 to 123.45.255.254
iptables -I INPUT -s 124.45.0.0/16 -j DROP
The command to seal the IP segment from 123.45.6.1 to 123.45.6.254 is
iptables -I INPUT -s 123.45.6.0/24 -j DROP
View added iptables rules
iptables -L -n
Delete the added iptables rules. For example, to delete the rule with serial number 8 in INPUT, execute:
iptables -D INPUT 8
save rules
service iptables save
restart the service
service iptables restart
iptables configuration file
vi /etc/sysconfig/iptables
Open active mode port 21
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
All open FTP transfer load modules:
modprobe ip_nat_ftp
modprobe ip_conntrack
modprobe ip_conntrack_ftp
Add a rule:
iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
iptables only allows the specified ip address to access the specified port
iptables -A INPUT -s xxx.xxx.xxx.xxx -p tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -d xxx.xxx.xxx.xxx -p tcp --sport 22 -j ACCEPT
For the above two items, please note that --dport is the target port. When the data enters the server from the outside, it is the target port; on the contrary, when the data leaves the server, it is the data source port. Use --sport for the same reason, -s is to specify the source address, -d specifies the destination address.
close all ports
iptables -P INPUT DROP
iptables -P OUTPUT DROP
iptables -P FORWARD DROP
yum allows downloading randomly generated high ports
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp --sport 53 -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp --sport 10000:65535 -j ACCEPT
Allow Ping
iptables -A INPUT -p icmp --icmp-type echo-request -j ACCEPT
iptables -A OUTPUT -p icmp --icmp-type echo-reply -j ACCEPT
Ban Ping
iptables -A INPUT -p icmp --icmp-type 8 -s 0/0 -j DROP
Reference recommendation :
10 common iptables configuration examples
Install iptables firewall on CentOS 7
Deduplication method of Linux iptables rules