1. View Existing configurations
Iptables-l-N
2. Clear the original rules.
Iptables-f to clear all rule chains in the preset table filter
Iptables-x Clear Preset table rules in user-defined chains in filter
3. Set preset rulesiptables-p INPUT DROPiptables-p OUTPUT ACCEPTiptables-p FORWARD DROP
the above means that when the two chain rules (Input,forward) in the Iptables filter table are exceeded, the packets that are not in the two rules are handled, and that is the drop (abort). It should be said that this configuration is very safe. We want to control the incoming packets. and for the output chain, that is, out of the package we do not have to do too much restriction, but to take the accept, that is, not in the rules of the package how to do it, that is through.It can be seen that the Input,forward two chain uses what packets are allowed to pass through, and the output chain is not allowed by what packets pass.This setting is quite reasonable, of course, you can also drop three chains, but I think it is not necessary, and to write the rules will increase. But if you only want a few rules that are limited, such as just Web servers. It is recommended that all three chains are drop.Note: If you are a remote SSH login, you should drop it when you enter the first command. Because you didn't set any rules.4. Add a rule.first add the input chain, the default rule of the input chain is drop, so we write the need to ACCETP (through) the chainin order to be able to use remote SSH login, we have to turn on port 22.iptables-a input-p tcp--dport 22-j ACCEPT iptables-a output-p tcp--sport 22-j ACCEPT (Note: This rule, if you set the OUTPUT to drop will be written on this part, many people are looking to write this rule caused, always can not ssh.) Remote, is not good.the other port is the same, if the Web server is turned on, output is set to drop, you also add a chain:iptables-a output-p TCP--sport 80-j ACCEPT, other similarly.)If you made a Web server, turn on port 80.iptables-a input-p tcp--dport 80-j ACCEPT Save Configuration/etc/rc.d/init.d/iptables SaveRestart service iptables restart You can also modify the configuration in the/etc/sysconfig/iptables directly
-A input-p tcp-m TCP--dport 3306-j accept #入网规则-A input-p tcp-m TCP--sport 3306-j Accept
Direct Service Iptables Restart if you modify the/etc/sysconfig/iptables directly .
Linux iptables Configuration
