For details about deploying the iptables environment in centos7, centos7iptables

For details about deploying the iptables environment in centos7, centos7iptables
Deploy the iptables environment record in centos7 (disable the default firewalle)

The default firewall of CentOS7 is not iptables, but firewall.
Because iptables is used to the firewall, after the centos7 system is installed, the default firewall is disabled and iptables is installed to Set firewall rules.

The following describes how to disable firewall and install iptables in centos7, and how to enable port 80 and port 3306:
[Root @ localhost ~] # Cat/etc/redhat-release
CentOS Linux release 7.2.1511 (Core)

1. Disable firewall:

1 2	[Root @ localhost ~] # Systemctl stop firewalld. service // stop firewall [root @ localhost ~] # Systemctl disable firewalld. service // disable firewall startup

2. Install iptables Firewall

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 19 20 21 22

[Root @ localhost ~] # Yum install iptables-services // install [root @ localhost ~] # Vim/etc/sysconfig/iptables // edit the Firewall configuration file # firewall configuration written by system-config-Firewall # Manual manumization of this file is not recommended. * filter: input accept [0: 0]: forward accept [0: 0]: output accept [0: 0]-a input-m state -- state ESTABLISHED, RELATED-j ACCEPT-a input-p icmp-j ACCEPT-a input-I lo-j ACCEPT-A INPUT-m state -- state NEW-m tcp-p tcp -- dport 22 -j ACCEPT -A input-m state -- state NEW-m tcp-p tcp -- dport 80-j ACCEPT-a input-m state -- state NEW-m tcp-p tcp -- dport 3306- j ACCEPT-a input-j REJECT -- reject-with icmp-host-prohibited-a forward-j REJECT -- reject-with icmp-host-prohibited COMMIT [root @ localhost ~] # Systemctl restart iptables. service // restart the firewall to make the configuration take effect [root @ localhost ~] # Systemctl enable iptables. service // set the firewall to start from startup [root @ localhost ~] # Iptables-L // view firewall rules. The default value is-t filter. For nat tables, iptables-t nat-L

Ii. Disable SELINUX

1 2 3 4 5 6 7

[Root @ localhost ~] # Vim/etc/selinux/config # SELINUX = enforcing // comment out # SELINUXTYPE = targeted // comment out SELINUX = disabled // Add [root @ localhost ~] # Setenforce 0 // make the configuration take effect immediately