Centos7 Firewall

1.1 firewall启停设置

[root@tomcat ~]# systemctl stop firewalld.service                    #关闭firewall
[root@tomcat ~]# systemctl status firewalld.service                  #查看状态
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)

Mar  :: tomcat systemd[]: Starting firewalld - dynamic firewall daemon...
Mar  :: tomcat systemd[]: Started firewalld - dynamic firewall daemon.
Mar  :: tomcat systemd[]: Stopping firewalld - dynamic firewall daemon...
Mar  :: tomcat systemd[]: Stopped firewalld - dynamic firewall daemon.
[root@tomcat ~]# firewall-cmd --state
not running
[root@tomcat ~]# systemctl start firewalld.service     #启动firewall
[root@tomcat ~]# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: active (running) since Tue -- :: CST; 4s ago
 Main PID:  (firewalld)
   CGroup: /system.slice/firewalld.service
           └─ /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Mar  :: tomcat systemd[]: Starting firewalld - dynamic firewall daemon...
Mar  :: tomcat systemd[]: Started firewalld - dynamic firewall daemon.
[root@tomcat ~]# firewall-cmd --state
running
[root@tomcat ~]# 

[root@tomcat ~]# systemctl disable firewalld.service                 #禁止开机启动
[root@tomcat ~]# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
Active: active (running) since Tue 2018-03-13 09:32:44 CST; 3min 22s ago
Main PID: 3737 (firewalld)
CGroup: /system.slice/firewalld.service
└─3737 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Mar 13 09:32:43 tomcat systemd[1]: Starting firewalld - dynamic firewall daemon...
Mar 13 09:32:44 tomcat systemd[1]: Started firewalld - dynamic firewall daemon.

[root@tomcat ~]# systemctl enable firewalld.service    #设置开机启动
Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/basic.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.
[root@tomcat ~]# systemctl status firewalld.service
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Tue 2018-03-13 09:32:44 CST; 3min 48s ago
Main PID: 3737 (firewalld)
CGroup: /system.slice/firewalld.service
└─3737 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Mar 13 09:32:43 tomcat systemd[1]: Starting firewalld - dynamic firewall daemon...
Mar 13 09:32:44 tomcat systemd[1]: Started firewalld - dynamic firewall daemon.
[root@tomcat ~]#

2.1 安装iptables

[root@tomcat ~]# yum install iptables-service -y

[root@tomcat ~]# systemctl start iptables.service
[root@tomcat ~]# systemctl enable iptables.service
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
[root@tomcat ~]# systemctl status iptables.service
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
   Active: active (exited) since Tue -- :: CST; 22s ago
 Main PID:  (code=exited, status=/SUCCESS)

Mar  :: tomcat systemd[]: Starting IPv4 firewall with iptables...
Mar  :: tomcat iptables.init[]: iptables: Applying firewall rules: [  OK  ]
Mar  :: tomcat systemd[]: Started IPv4 firewall with iptables.
[root@tomcat ~]# 

[root@tomcat ~]# iptables -I  INPUT 1 -p tcp --dport 22 -j ACCEPT         
#-I  指定序号                      #iptable匹配规则从上至下依次匹配
#INPUT   input链
#-p   指定协议 
#tcp 协议
--dport   目的端口 
-j    动作

[root@tomcat ~]# iptables -P INPUT DROP           #添加默认策略拒绝所有，我们将需要放行的策略放到前面，有流量是从前向后匹配，允许的则放行，没有匹配到的则执行默认策略丢弃

-A 添加到最后一条

-P  添加默认策略

DROP   丢弃

#添加一个别名

echo 'alias iptablist="iptables -nL --line-number"' >>/etc/profile

. /etc/profile

#放行8080端口的流量

iptables -I INPUT -p tcp --dport 8080 -j ACCEPT

#禁止外网ping

iptables -I INPUT -p icmp ! -s 172.16.10.0/24 -j DROP

#允许回环口通过

iptables -A INPUT -i lo -j ACCEPT

#允许关联的数据包通过

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

#保存配置

iptables-save