How to configure and disable iptables firewall in CentOS Linux

Comment: recently, when installing and configuring ORACLE databases in CentOSLinux, the system displays the failure of EM installation due to network ports. I plan to disable the firewall and see the configuration instructions of the firewall, it feels good. Run the "setup" command to start the text mode configuration utility, and select "firewall configuration" in "select a tool ",

Comments: When I recently installed and configured the ORACLE database in CentOS Linux, the system always showed that the EM installation failed due to the network port, so I planned to disable the firewall first.

I accidentally saw the firewall configuration instructions, and I felt good. Run the "setup" command to start the text mode configuration utility, select "firewall configuration" in "select a tool", and then select the "running tool" button. the firewall configuration interface appears, set "security level" to "disable", and then select "OK.

Or run the following command:
#/Sbin/Iptables-I INPUT-p tcp? Dport 80-j ACCEPT
#/Sbin/iptables-I INPUT-p tcp? Dport 22-j ACCEPT
#/Etc/rc. d/init. d/iptables save

After the computer is restarted, ports 80 and 22 are enabled by default.

You may not restart the computer either here:
#/Etc/init. d/iptables restart

Close the firewall and close its services:

View firewall information:
#/Etc/init. d/iptables status

Disable the firewall service:
#/Etc/init. d/iptables stop

Permanently Close? I don't know how to use the permanent method:
# Chkconfig? Level 35 iptables off

After reading several pages, there are errors. The following is the correct method:
#/Sbin/iptables-I INPUT-p tcp -- dport 80-j ACCEPT
#/Sbin/iptables-I INPUT-p tcp -- dport 22-j ACCEPT

Then save:
#/Etc/rc. d/init. d/iptables save

Check whether there are already:

[Root @ vCentos~] #/Etc/init. d/iptables status
Table: filter
Chain INPUT (policy ACCEPT)
Num target prot opt source destination
1 ACCEPT udp -- 0.0.0.0/0 0.0.0.0/0 udp dpt: 80
2 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt: 80
3 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0
Chain FORWARD (policy ACCEPT)
Num target prot opt source destination
1 RH-Firewall-1-INPUT all -- 0.0.0.0/0 0.0.0.0/0

The server suffered a large number of SYN_RECV attacks, and the 80-terminal number was killed. The website could not be opened.

No hardware protection

Is there any solution?

1
Sysctl-w net. ipv4.tcp _ syncookies = 1 # enable syncookies
Sysctl-w net. ipv4.tcp _ synack_retries = 1 # reduce syn retries
Sysctl-w net. ipv4.tcp _ syn_retries = 1 # reduce syn retries
Sysctl-w net. ipv4.tcp _ max_syn_backlog = 6000 # maximum half connections
Sysctl-w net. ipv4.conf. all. send_redirects = 0
Sysctl-w net. ipv4.conf. all. accept_redirects = 0 # Do not accept redirection icmp packets
Sysctl-w net. ipv4.tcp _ fin_timeout = 30
Sysctl-w net. ipv4.tcp _ keepalive_time = 60
Sysctl-w net. ipv4.tcp _ window_scaling = 1
Sysctl-w net. ipv4.icmp _ echo_ignore_all = 1 # Disable ICMP
Sysctl-w net. ipv4.icmp _ echo_ignore_broadcasts = 1 # ICMP disable broadcast

2. limit the number of connections per unit time
For example
Iptables-N syn-flood
Iptables-a forward-p tcp -- syn-j syn-flood
Iptables-a input-p tcp -- syn-j syn-flood
Iptables-A syn-flood-p tcp -- syn-m limit -- limit 3/s -- limit-burst 1-j ACCEP
Iptables-A syn-flood-j DROP
Iptables-a input-I eth0-p tcp! -- Syn-m state -- state NEW-jDROP
Iptables-a input-p tcp -- syn-m state -- state NEW-j DROP

3. if the problem persists,
Iptables-a input-p tcp -- dport 80-m recent -- nameBAD_HTTP_ACCESS -- update -- seconds 60 -- hitcount 30-j REJECT
Iptables-a input-p tcp -- dport 80-m recent -- nameBAD_HTTP_ACCESS -- set-j ACCEP

If the attack traffic is greater than the traffic on your server, there is no way. if the traffic is not large, the above method can temporarily ensure that your 80 can be accessed.

If your kernel already supports iptables connlimit, you can also use iptables to set iptables.

Iptables-I FORWARD-p tcp -- syn-m connlimit -- connlimit-above5-j DROP
Or
Iptables-a input-p tcp -- syn -- dport 80-m connlimit -- connlimit-abve 5-j REJECT

To deal with syn flood, what really works is:
Sysctl-wnet. ipv4.tcp _ syncookies = 1 # enable syncookies
Sysctl-wnet. ipv4.tcp _ synack_retries = 1 # reduce syn retries
The speed limitation function of other IPTABLES cannot be used to deal with syn flood (dos cannot be blocked, but server CRASH can be prevented ).