CentOS 7 默认是使用Firewall作为防火墙,这里我们把它改为我们熟悉的iptables!
- [root@Centos7~]#iptables-vnL#看着很不舒服,改为我们习惯的iptables
- ChainINPUT(policyACCEPT0packets,0bytes)
- pktsbytestargetprotoptinoutsourcedestination
- 39434135ACCEPTall--**0.0.0.0/00.0.0.0/0ctstateRELATED,ESTABLISHED
- 00ACCEPTall--lo*0.0.0.0/00.0.0.0/0
- 828322INPUT_directall--**0.0.0.0/00.0.0.0/0
- 828322INPUT_ZONES_SOURCEall--**0.0.0.0/00.0.0.0/0
- 828322INPUT_ZONESall--**0.0.0.0/00.0.0.0/0
- 00ACCEPTicmp--**0.0.0.0/00.0.0.0/0
- 808218REJECTall--**0.0.0.0/00.0.0.0/0reject-withicmp-host-prohibited
- ChainFORWARD(policyACCEPT0packets,0bytes)
- pktsbytestargetprotoptinoutsourcedestination
- 00ACCEPTall--**0.0.0.0/00.0.0.0/0ctstateRELATED,ESTABLISHED
- 00ACCEPTall--lo*0.0.0.0/00.0.0.0/0
- 00FORWARD_directall--**0.0.0.0/00.0.0.0/0
- 00FORWARD_IN_ZONES_SOURCEall--**0.0.0.0/00.0.0.0/0
- 00FORWARD_IN_ZONESall--**0.0.0.0/00.0.0.0/0
- 00FORWARD_OUT_ZONES_SOURCEall--**0.0.0.0/00.0.0.0/0
- 00FORWARD_OUT_ZONESall--**0.0.0.0/00.0.0.0/0
- 00ACCEPTicmp--**0.0.0.0/00.0.0.0/0
- 00REJECTall--**0.0.0.0/00.0.0.0/0reject-withicmp-host-prohibited
- ChainOUTPUT(policyACCEPT41packets,5963bytes)
- pktsbytestargetprotoptinoutsourcedestination
- 33135720OUTPUT_directall--**0.0.0.0/00.0.0.0/0
- ChainFORWARD_IN_ZONES(1references)
- pktsbytestargetprotoptinoutsourcedestination
- 00FWDI_publicall--eno16777728*0.0.0.0/00.0.0.0/0[goto]
- 00FWDI_publicall--+*0.0.0.0/00.0.0.0/0[goto]
- ChainFORWARD_IN_ZONES_SOURCE(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainFORWARD_OUT_ZONES(1references)
- pktsbytestargetprotoptinoutsourcedestination
- 00FWDO_publicall--*eno167777280.0.0.0/00.0.0.0/0[goto]
- 00FWDO_publicall--*+0.0.0.0/00.0.0.0/0[goto]
- ChainFORWARD_OUT_ZONES_SOURCE(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainFORWARD_direct(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainFWDI_public(2references)
- pktsbytestargetprotoptinoutsourcedestination
- 00FWDI_public_logall--**0.0.0.0/00.0.0.0/0
- 00FWDI_public_denyall--**0.0.0.0/00.0.0.0/0
- 00FWDI_public_allowall--**0.0.0.0/00.0.0.0/0
- ChainFWDI_public_allow(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainFWDI_public_deny(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainFWDI_public_log(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainFWDO_public(2references)
- pktsbytestargetprotoptinoutsourcedestination
- 00FWDO_public_logall--**0.0.0.0/00.0.0.0/0
- 00FWDO_public_denyall--**0.0.0.0/00.0.0.0/0
- 00FWDO_public_allowall--**0.0.0.0/00.0.0.0/0
- ChainFWDO_public_allow(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainFWDO_public_deny(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainFWDO_public_log(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainINPUT_ZONES(1references)
- pktsbytestargetprotoptinoutsourcedestination
- 152IN_publicall--eno16777728*0.0.0.0/00.0.0.0/0[goto]
- 00IN_publicall--+*0.0.0.0/00.0.0.0/0[goto]
- ChainINPUT_ZONES_SOURCE(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainINPUT_direct(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainIN_public(2references)
- pktsbytestargetprotoptinoutsourcedestination
- 828322IN_public_logall--**0.0.0.0/00.0.0.0/0
- 828322IN_public_denyall--**0.0.0.0/00.0.0.0/0
- 828322IN_public_allowall--**0.0.0.0/00.0.0.0/0
- ChainIN_public_allow(1references)
- pktsbytestargetprotoptinoutsourcedestination
- 2104ACCEPTtcp--**0.0.0.0/00.0.0.0/0tcpdpt:22ctstateNEW
- ChainIN_public_deny(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainIN_public_log(1references)
- pktsbytestargetprotoptinoutsourcedestination
- ChainOUTPUT_direct(1references)
- pktsbytestargetprotoptinoutsourcedestination
- [root@Centos7~]#yum-yinstalliptables#安装iptables,基本上都是存在的
- [root@Centos7~]#yum-yinstalliptables-services#安装iptables-services服务
- [root@Centos7~]#systemctlstopfirewalld.service#停止firealld服务
- [root@Centos7~]#systemctldisablefirewalld.service#禁止firealld服务自动启动
- Removedsymlink/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
- Removedsymlink/etc/systemd/system/basic.target.wants/firewalld.service.
- [root@Centos7~]#systemctlenableiptables.service#开启iptables自动启动
- Createdsymlinkfrom/etc/systemd/system/basic.target.wants/iptables.serviceto/usr/lib/systemd/system/iptables.service.
- [root@Centos7~]#systemctlstartiptables.service#开启iptables服务
- [root@Centos7~]#iptables-vnL#使用iptables查看,胡三汉回来了!~
- ChainINPUT(policyACCEPT0packets,0bytes)
- pktsbytestargetprotoptinoutsourcedestination
- ChainFORWARD(policyACCEPT0packets,0bytes)
- pktsbytestargetprotoptinoutsourcedestination
- ChainOUTPUT(policyACCEPT0packets,0bytes)
- pktsbytestargetprotoptinoutsourcedestination
- [root@Centos7~]#iptables-save#加载配置文件的规则
- #Generatedbyiptables-savev1.4.21onSunOct2302:34:482016
- *filter
- :INPUTACCEPT[0:0]
- :FORWARDACCEPT[0:0]
- :OUTPUTACCEPT[121:22068]
- -AINPUT-mstate--stateRELATED,ESTABLISHED-jACCEPT
- -AINPUT-picmp-jACCEPT
- -AINPUT-ilo-jACCEPT
- -AINPUT-ptcp-mstate--stateNEW-mtcp--dport22-jACCEPT
- -AINPUT-jREJECT--reject-withicmp-host-prohibited
- -AFORWARD-jREJECT--reject-withicmp-host-prohibited
- COMMIT
- #CompletedonSunOct2302:34:482016
- [root@Centos7~]#iptables-vnL#查看状态
- ChainINPUT(policyACCEPT0packets,0bytes)
- pktsbytestargetprotoptinoutsourcedestination
- 17913428ACCEPTall--**0.0.0.0/00.0.0.0/0stateRELATED,ESTABLISHED
- 00ACCEPTicmp--**0.0.0.0/00.0.0.0/0
- 00ACCEPTall--lo*0.0.0.0/00.0.0.0/0
- 00ACCEPTtcp--**0.0.0.0/00.0.0.0/0stateNEWtcpdpt:22
- 00REJECTall--**0.0.0.0/00.0.0.0/0reject-withicmp-host-prohibited
- ChainFORWARD(policyACCEPT0packets,0bytes)
- pktsbytestargetprotoptinoutsourcedestination
- 00REJECTall--**0.0.0.0/00.0.0.0/0reject-withicmp-host-prohibited
- ChainOUTPUT(policyACCEPT135packets,23948bytes)
- pktsbytestargetprotoptinoutsourcedestination
- [root@Centos7~]#iptables-F#清空规则
- [root@Centos7~]#iptables-save#保持规则
- #Generatedbyiptables-savev1.4.21onSunOct2302:35:052016
- *filter
- :INPUTACCEPT[14:1096]
- :FORWARDACCEPT[0:0]
- :OUTPUTACCEPT[11:1156]
- COMMIT
- #CompletedonSunOct2302:35:052016
- [root@Centos7~]#serviceiptablessave#也可以使用这个保持规则
- iptables:Savingfirewallrulesto/etc/sysconfig/iptables:[OK]
- [root@Centos7~]#