iptables安装使用（为Redis开放特定IP）

落日映苍穹つ 2022-04-18 00:56 243阅读 0赞

### iptables安装使用 （为Redis开放特定IP） ###

*  停用firewall
 *  iptables安装
 *  iptables配置
 *  启动iptables

# 停用firewall #

由于centos7默认是使用firewall作为防火墙，先关闭firewall。

#停止firewall 
    systemctl stop firewalld.service

#禁止firewall开机启动 
    systemctl disable firewalld.service

#查看firewall status
    # systemctl status firewalld.service
    ● firewalld.service - firewalld - dynamic firewall daemon
       Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
       Active: inactive (dead)
         Docs: man:firewalld(1)

# iptables安装 #

查看iptables-services

#yum list iptables-services
    Loaded plugins: fastestmirror
    Determining fastest mirrors
    Available Packages
    iptables-services.x86_64                                                                              1.4.21-24.1.el7_5                                                                              updates

安装iptables

yum install iptables-services -y

# iptables配置 #

编辑配置

vim /etc/sysconfig/iptables

默认配置如下：

# sample configuration for iptables service
    # you can edit this manually or use system-config-firewall
    # please do not ask us to add additional ports/services to this default configuration
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    -A INPUT -p icmp -j ACCEPT
    -A INPUT -i lo -j ACCEPT
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited
    COMMIT

修改配置如下：

*filter
    #拒绝全部INPUT
    :INPUT DROP [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [0:0]
    #INPUT增加IP白名单（对该IP所有端口开放）
    -A INPUT -s 18.28.238.59 -j ACCEPT
    -A INPUT -s 18.88.178.14 -j ACCEPT
    #开放80端口
    -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
    
    #开放特定IP的特定端口端口
    -A INPUT -s 18.88.178.14 -p tcp -m tcp --dport 6379 -j ACCEPT
    #ping使用的端口
    -A INPUT -p icmp -j ACCEPT
    #开放localhost
    -A INPUT -i lo -j ACCEPT
    #开放RELATED,ESTABLISHED状态
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
    #拒绝其他端口的操作
    -A INPUT -j REJECT --reject-with icmp-host-prohibited
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited
    COMMIT

# 启动iptables #

service iptables start

关闭与状态

service iptables  start     #启动服务
    service iptables  stop　　   #停止服务
    service iptables  restart　　#重启服务

查看iptables

# systemctl status iptables.service
    ● iptables.service - IPv4 firewall with iptables
       Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
       Active: active (exited) since Tue 2018-11-06 11:26:57 CST; 4s ago
      Process: 25961 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
     Main PID: 25961 (code=exited, status=0/SUCCESS)
    
    Nov 06 11:26:57 haocailai-001 systemd[1]: Starting IPv4 firewall with iptables...
    Nov 06 11:26:57 haocailai-001 iptables.init[25961]: iptables: Applying firewall rules: [  OK  ]
    Nov 06 11:26:57 haocailai-001 systemd[1]: Started IPv4 firewall with iptables.

设置开机启动

# systemctl enable iptables.service
    Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.