Simple firewall settings for Linux

Common commands

Iptables-l-N view firewall rules;

Iptables-f to clear all rule chains in the preset table filter

Iptables-x Clear Preset table rules in user-defined chains in filter

/etc/rc.d/init.d/iptables save to write the changes to the/etc/sysconfig/iptables file.

Set rules

[Email protected] ~]# iptables-p INPUT DROP

[[email protected] ~]# iptables-p OUTPUT ACCEPT

[Email protected] ~]# iptables-p FORWARD DROP

( This means that when you go beyond the two chain rules (Input,forward) in the filter table in the Iptables, the packets that are not in the two rules are handled, and that is the drop (abort). It should be said that this configuration is very safe. We want to control the incoming packets.

and for Output chain, that is, out of the package we do not have to do too much restriction, but to take the accept, that is, not in the rules of the package how to do it, that is through.

can see The Input,forward two chain uses what packets are allowed to pass through, while the output chain is not allowed by what packets pass.

This setting is quite reasonable , of course, you can also drop three chains, but I think it is not necessary, and to write the rules will increase. But if you only want a few rules that are limited, such as just Web servers. It is recommended that all three chains are drop.

Open common ports:

Iptables-a input-p TCP--dport 22-j ACCEPT (SSH)

Iptables-a input-p TCP--dport 80-j ACCEPT (web)

Iptables-a input-p TCP--dport 110-j ACCEPT (mail)

Iptables-a input-p TCP--dport 25-j ACCEPT (mail)

Iptables-a input-p TCP--dport 21-j ACCEPT (FTP)

Iptables-a input-p TCP--dport 20-j ACCEPT (FTP)

Iptables-a input-p TCP--dport 53-j ACCEPT (DNS)

Iptables-a output-p icmp-j ACCEPT (OUTPUT set to drop)

Iptables-a input-p icmp-j ACCEPT (INPUT set to drop)

Iptables-a input-i lo-p all-j ACCEPT (if INPUT DROP)

Iptables-a output-o lo-p all-j ACCEPT (if OUTPUT DROP)

Simple firewall settings for Linux