1. 清除当前iptables规则
iptables -F iptables -Z iptables -X
2. 定义规则
iptables -P OUTPUT ACCEPT iptables -P FORWARD ACCEPT iptables -A INPUT -p tcp --dport 22-j ACCEPT iptables -A INPUT -p tcp -s10.0.0.0/24 -j ACCEPT iptables -P INPUT DROP
查看当前定义的规则
[[email protected] ~]# iptables -nL Chain INPUT (policy DROP) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT tcp -- 10.0.0.0/24 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
3. 继续定义规则，可以匹配通过的
iptables -A INPUT -i lo -j ACCEPT #<== 允许自己的IO网卡可以通过 iptables -A INPUT -s 201.82.34.0/24 -p all -jACCEPT #<== 201.82.34.0该网段可以通过 iptables -A INPUT -p tcp --dport 80 -j ACCEPT #<== 80端口可以通过 iptables -A INPUT -p tcp --dport 443 -j ACCEPT #<== 443端口可以通过 iptables -A INPUT -p icmp -m icmp --icmp-type any-j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED-j ACCEPT #<== 允许关联的状态包
匹配完后查看
[[email protected] ~]# iptables -L -n Chain INPUT (policy DROP) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT tcp -- 10.0.0.0/24 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 201.82.34.0/24 0.0.0.0/0 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 255 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
4. 将定义好的规则载入配置文件（三种方法，任选一种）
第一种：
[[email protected] ~]# /etc/init.d/iptables save iptables：将防火墙规则保存到/etc/sysconfig/iptables： [确定]
第二种：
[[email protected] ~]# iptables-save >/etc/sysconfig/iptables
第三种： <--- 建议在业务量小的时候可以重启
[[email protected] ~]# /etc/init.d/iptables restart iptables：将链设置为政策 ACCEPT：natfilter [确定] iptables：清除防火墙规则： [确定] iptables：正在卸载模块： [确定] iptables：应用防火墙规则： [确定]
# 以上方法任选一种载入后查看
[[email protected] ~]# cat /etc/sysconfig/iptables # Generated by iptables-save v1.4.7 on Sun Sep 2512:49:48 2016 *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [2:120] :OUTPUT ACCEPT [2:120] COMMIT # Completed on Sun Sep 25 12:49:48 2016 # Generated by iptables-save v1.4.7 on Sun Sep 2512:49:48 2016 *filter :INPUT DROP [8675:381885] :FORWARD ACCEPT [10:440] :OUTPUT ACCEPT [900:59778] -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -s 201.82.34.0/24 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type any -j ACCEPT -A INPUT -m state --state RELATED,ESTABLISHED -jACCEPT COMMIT # Completed on Sun Sep 25 12:49:48 2016
时间： 2024-12-15 01:56:20