Iptables basic applications on Linux

The basic application of Iptables firewall on Linux iptables is commonly used on Linux firewall software, the following VPS detective to everyone said Iptables installation, clear iptables rules, iptables only open the designated port, iptables mask Specifies IP, IP segment and unblock, delete added iptables rules, etc. iptables basic applications. More information on how to use iptables can be performed: Iptables--help or search the web for a description of the iptables parameter. 1. Install iptables Firewall
If not installed iptables need to be installed first, CentOS execution: Yum install iptables
Debian/ubuntu execution: Apt-get install iptables
2. Clear existing iptables rules
Iptables-f
Iptables-x
Iptables-z
3, open the specified port
#允许本地回环接口 (that is, running native access to this machine)
Iptables-a input-s 127.0.0.1-d 127.0.0.1-j ACCEPT

Allow established or connected traffic

Iptables-a input-m State--state established,related-j ACCEPT
#允许所有本机向外的访问
Iptables-a output-j ACCEPT

Allow access to port 22

Iptables-a input-p TCP--dport 22-j ACCEPT
#允许访问80端口
Iptables-a input-p TCP--dport 80-j ACCEPT
#允许FTP服务的21和20端口
Iptables-a input-p TCP--dport 21-j ACCEPT
Iptables-a input-p TCP--dport 20-j ACCEPT
#如果有其他端口的话, the rules are similar, and you can modify the above statements slightly.
#禁止其他未允许的规则访问
Iptables-a input-j REJECT
Iptables-a forward-j REJECT
4. Shielded IP
#如果只是想屏蔽IP的话 "3, open specified port" can be skipped directly.
#屏蔽单个IP的命令是
Iptables-i input-s 123.45.6.7-j DROP
#封整个段即从123.0.0.1 to 123.255.255.254 command
Iptables-i input-s 123.0.0.0/8-j DROP
#封IP段即从123.45.0.1 to 123.45.255.254 command
Iptables-i input-s 124.45.0.0/16-j DROP
#封IP段即从123.45.6.1 to 123.45.6.254 command is
Iptables-i input-s 123.45.6.0/24-j DROP
4. View the iptables rules that have been added
Iptables-l-N
V: Show details, including the number of matched packets per rule and the number of matching bytes
x: On the basis of V, Prohibit automatic unit conversion (K, M) VPS Detective
N: Show only IP address and port number, do not resolve IP to domain 5, delete added iptables rule
Show all iptables as an ordinal tag, execute: iptables-l-n--line-numbers
For example, to delete the rule of input ordinal 8, execute: iptables-d input 8
6, iptables boot and rule save
CentOS may exist after installing the iptables, Iptables does not boot from the boot, you can execute: Chkconfig--level 345 iptables on
Add it to boot. CentOS can be performed: Service iptables save the rule. It is also important to note that debian/ubuntu on iptables will not save the rules. Need to follow the steps below, so that the network card is saved iptables rule, load iptables rule at startup: Create/etc/network/if-post-down.d/iptables file, add the following: #!/bin/bash
Iptables-save >/etc/iptables.rules
Execute: chmod +x/etc/network/if-post-down.d/iptables Add execute permissions. Create the/etc/network/if-pre-up.d/iptables file and add the following: #!/bin/bash
Iptables-restore </etc/iptables.rules
Execution: chmod +x/etc/network/if-pre-up.d/iptables Add Execute Permissions

Iptables basic applications on Linux