Common firewall and IPtabls operations in centos 7

Common firewall and IPtabls operations in centos 7

1. configure the firewall and enable port 80 and port 3306

CentOS 7.0 uses firewall as the firewall by default. Here, it is changed to iptables firewall.

1. Disable firewall:

Systemctl stop firewalld. service # stop firewall

Systemctl disable firewalld. service # disable firewall startup

It, http://www.it.net.cn

2. Install iptables Firewall

Yum install iptables-services # Installation

Vi/etc/sysconfig/iptables # edit the firewall configuration file

# Firewall configuration written by system-config-firewallLinux, http: // linux.it.net.cn

# Manual customization of this file is not recommended.

* Filter

: Input accept [0: 0]

: Forward accept [0: 0]

: Output accept [0: 0] Linux learning, http: // linux.it.net.cn

-A input-m state -- state ESTABLISHED, RELATED-j ACCEPT

-A input-p icmp-j ACCEPT

-A input-I lo-j ACCEPT

-A input-m state -- state NEW-m tcp-p tcp -- dport 22-j ACCEPT

-A input-m state -- state NEW-m tcp-p tcp -- dport 80-j ACCEPT

-A input-m state -- state NEW-m tcp-p tcp -- dport 3306-j ACCEPT

-A input-j REJECT -- reject-with icmp-host-prohibited

-A forward-j REJECT -- reject-with icmp-host-prohibitedIT network, http://www.it.net.cn

COMMITIT, http://www.it.net.cn

: Wq! # Save and exit

Systemctl restart iptables. service # restart the firewall to make the configuration take effect.

Systemctl enable iptables. service # Set firewall startup

Ii. Disable SELINUX

Vi/etc/selinux/config

# SELINUX = enforcing # comment out

# SELINUXTYPE = targeted # comment out it, http://www.it.net.cn

SELINUX = disabled # Add Linux learning, http: // linux.it.net.cn

: Wq! # Save and exit

Setenforce 0 # Make the configuration take effect immediately

In CentOS 7
Start ftp server at specified time
# Firewall-cmd -- add-service = ftp

Permanently open the ftp server
# Firewall-cmd -- add-service = ftp -- permanent
Permanent Access
# Firewall-cmd -- remove-service = ftp -- permanent
Success

Make settings take effect
# Systemctl restartfirewalld

Whether the specified parameter settings take effect
# Iptables-L-n | grep21.
ACCEPTtcp -- 0.0.0.0/00.0.0.0/0tcp dpt: 21 ctstate NEW

Investigation of fire prevention measures
# Firewall-cmd -- state
Running

# Systemctl stopfirewalld
# Firewall-cmd -- state
Not running


# Firewall-cmd -- list-all
Public (default)
Interfaces:
Sources:
Services: dhcpv6-client ftp ssh
Ports:
Masquerade: no
Forward-ports:
Icmp-blocks:
Richrules:

The service name in FirewallD is invalid.
# Firewall-cmd -- get-service
Amanda-client bacula-clientdhcp dhcpv6 dhcpv6-client dns ftp high-availability http httpsimaps ipp-client ipsec kerberos kpasswd ldap ldaps lib1_libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd extends pmwebapis pop3s postgresql proxy-dhcp radius rpc-bindsamba samba-client smtp ssh telnet tftp-clienttransmission-client vnc-server wbem-https

Query the quota of the Alibaba Cloud Service
# Firewall-cmd -- query-serviceftp
Yes
# Firewall-cmd -- query-servicessh
Yes
# Firewall-cmd -- query-servicesamba
No
# Firewall-cmd -- query-servicehttp
No

Add the Port to be opened by yourself
# Firewall-cmd -- add-port = 3128/tcp
# Firewall-cmd -- list-all
Public (default)
Interfaces:
Sources:
Services: dhcpv6-client ftp ssh
Ports: 3128/tcp
Masquerade: no
Forward-ports:
Icmp-blocks:
Rich rules: