Configure iptables in CentOS6.6

If iptables is not installed, you can directly use yum to install yuminstall-tiptables to check the status of the iptables service. if serviceiptablesstatus appears & ldquo; iptables: Firewallisnotrunning & rdquo;, it indicates that the iptables

If iptables is not installed, you can directly use yum to install it.

yum install -t iptables

Check the status of the iptables service,

service iptables status

If "iptables: Firewall is not running" appears, it indicates that it is not started or has no rules.
Start the iptables service

service iptables start

Remove default rules before the first configuration

# This must be done first, otherwise, iptables-p input accept # clear all default rules iptables-F # clear all custom rules iptables-X # set the counter to 0 iptables-Z

Configure rules

# Without this rule, you cannot access the local service through 127.0.0.1, for example, ping 127.0.0.1 iptables-a input-I lo-j ACCEPT # enable ssh port 22 iptables-A INPUT-p tcp -- dport 22-j ACCEPT # enable FTP port 21 iptables-A INPUT -p tcp -- dport 21-j ACCEPT # enable web service port 80 iptables-a input-p tcp -- dport 80-j ACCEPT # tomcat iptables-a input-p tcp -- dport 8080 -j ACCEPT # mysql iptables-a input-p tcp -- dport xxxx-j ACCEPT # Allow icmp packets to pass, that is to say, ping iptables-a input-p icmp-m icmp -- icmp-type 8-j ACCEPT # Allow all response packets for external requests # The external request of the local machine is equivalent to OUTPUT, the returned data packet must be received. this is equivalent to inputting iptables-a input-m state -- state ESTABLISHED-j ACCEPT # If you want to add intranet ip address Trust (ACCEPT all TCP requests) iptables-a input-p tcp-s 45.96.174.68-j ACCEPT # up to five new connections per second are allowed in iptables-a forward-p tcp -- syn-m limit -- limit 1/s -- limit-burst 5-j ACCEPT # up to five new connections to iptables-a forward-p tcp -- tcp-flags SYN are allowed per second, ACK, FIN, RST-m limit -- limit 1/s-j ACCEPT # Ping flood attack iptables-a forward-p icmp -- icmp-type echo-request-m limit -- limit 1/s- j ACCEPT # the command to block a single IP address is: iptables-I INPUT-s 222.34.135.106-j DROP # the command for sealing IP segments is: iptables-I input-s 211.1.0.0/16-j DROPiptables-I input-s 211.2.0.0/16-j DROPiptables-I INPUT-s 211.3.0.0/16-j DROP # command for the entire segment yes: iptables-I INPUT-s 211.0.0.0/8-j DROP # the command for sealing several segments is: iptables-I input-s 61.37.80.0/24-j DROPiptables-I INPUT-s 61.37.81.0/24-j DROP # filter all requests with non-above rules iptables-P INPUT DROP

Save and restart

service iptables saveservice iptables restart