Aliyun CentOS Configuration iptables Firewall Tutorial _linux

Although Aliyun launched the Cloud Shield service, but it is always safer to add a layer of firewall, the following is my Aliyun VPS on the process of configuring the firewall, currently only configure input. Both output and ForWord are accept rules.

First, check the Iptables service status

First check the status of the Iptables service

[Root@woxplife ~]# service iptables status
Iptables:firewall is not running.

Indicates that the Iptables service is installed, but the service is not started.
If not installed, you can yum the installation directly

Yum install-y iptables

Start iptables

[Root@woxplife ~]# service iptables start
iptables:applying firewall rules:             [OK]

Take a look at the current iptables configuration

[Root@woxplife ~]# iptables-l-N

Second, clear the default firewall rules

#首先在清除前要将policy input changed to accept, to accept all requests.
#这个一定要先做, or it could be a tragedy.
iptables-p INPUT ACCEPT

#清空默认所有规则
iptables-f

#清空自定义的所有规则
iptables-x

#计数器置0
iptables-z

III. Configuration Rules

#允许来自于lo接口的数据包
#如果没有此规则, you will not be able to access local services via 127.0.0.1, such as ping 127.0.0.1
iptables-a input-i lo-j ACCEPT 
 
#ssh端口22
iptables-a input-p tcp--dport 22-j ACCEPT
 
#FTP端口21
iptables-a input-p tcp--dport 21-j ACCEPT
 
#web Service port
iptables-a input-p TCP--dport 80-j accep
 
#tomcat
iptables-a input-p tcp--dport xxxx-j accep
    #mysql
iptables-a input-p tcp--dport xxxx-j accep
 
#允许icmp包通过, which is to allow ping
iptables-a input-p ICMP--icmp-type 8-j ACCEPT
 
#允许所有对外请求的返回包
#本机对外请求相当于OUTPUT, must be received for the return packet, which is equivalent to input
iptables-a input -M state--state established-j ACCEPT
 
#如果要添加内网ip信任 (Accept all TCP requests)
iptables-a input-p tcp-s 45.96.174.68-j acce PT
 
#过滤所有非以上规则的请求
iptables-p INPUT DROP

IV. Preservation
first Iptables-l-N to see if the configuration is correct.
No problem, do not hurry to save, because not save is currently valid, restart does not take effect, so in case of any problems, you can force the background to restart Server recovery settings.
Open an SSH connection and make sure you can log in.

Make sure you save after no problem

#保存
[root@woxplife ~]# service iptables save
 
#添加到自启动chkconfig
[root@woxplife ~]# chkconfig ' iptables on

The above is the entire content of this article, I hope to help you learn, but also hope that we support the cloud habitat community.