iptables安裝使用 （為Redis開放特定IP）

• 停用firewall
• iptables安裝
• iptables配置
• 啟動iptables

停用firewall

由於centos7預設是使用firewall作為防火牆，先關閉firewall。

#停止firewall 
systemctl stop firewalld.service

#禁止firewall開機啟動 
systemctl disable firewalld.service

#檢視firewall status
# systemctl status firewalld.service
 

● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)

iptables安裝

檢視iptables-services

#yum list iptables-services
Loaded plugins: fastestmirror
Determining fastest mirrors
Available Packages
iptables-
 
services.x86_64                                                                              1.4.21-24.1.el7_5                                                                              updates

安裝iptables

yum install iptables-services -y

iptables配置

編輯配置

vim /etc/sysconfig/iptables

預設配置如下：

# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

修改配置如下：

*filter
#拒絕全部INPUT
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
#INPUT增加IP白名單（對該IP所有埠開放）
-A INPUT -s 18.28.238.59 -j ACCEPT
-A INPUT -s 18.88.178.14 -j ACCEPT
#開放80埠
-A INPUT -p tcp -m tcp --dport 80 -j ACCEPT

#開放特定IP的特定埠埠
-A INPUT -s 18.88.178.14 -p tcp -m tcp --dport 6379 -j ACCEPT
#ping使用的埠
-A INPUT -p icmp -j ACCEPT
#開放localhost
-A INPUT -i lo -j ACCEPT
#開放RELATED,ESTABLISHED狀態
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
#拒絕其他埠的操作
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

啟動iptables

service iptables start

關閉與狀態

service iptables  start     #啟動服務
service iptables  stop　　   #停止服務
service iptables  restart　　#重啟服務

檢視iptables

# systemctl status iptables.service
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
   Active: active (exited) since Tue 2018-11-06 11:26:57 CST; 4s ago
  Process: 25961 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
 Main PID: 25961 (code=exited, status=0/SUCCESS)

Nov 06 11:26:57 haocailai-001 systemd[1]: Starting IPv4 firewall with iptables...
Nov 06 11:26:57 haocailai-001 iptables.init[25961]: iptables: Applying firewall rules: [  OK  ]
Nov 06 11:26:57 haocailai-001 systemd[1]: Started IPv4 firewall with iptables.

設定開機啟動

# systemctl enable iptables.service
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.