How to configure iptables in CentOS5 and rhel5 systems

Setting a firewall is very important for your Linux server. However, by default, CentOS settings cannot meet our needs. You can set up the iptables firewall by following the steps below: disable SELinux first. In general, SELinux is of no particular use. Use the root user to open/etc/selinux/config: vi/etc/se

Setting a firewall is very important for your Linux server. However, by default, CentOS settings cannot meet our needs. You can perform the following steps to setIptablesFirewall:

Disable SELinux first. generally, SELinux is of no particular use. Use the root user to open/etc/selinux/config:

Vi/etc/selinux/config

Delete SELINUX = enforcing and replace it with the following line:

SELINUX = disabled

Then we can modify iptables settings to open the iptables configuration file:

Vi/etc/sysconfig/iptables

The following is an example of iptables:

# Http://www.ondev.net/post/show/749
* Filter
: Input accept [0: 0]
: Forward accept [0: 0]
: Output accept [0: 0]
: RH-Firewall-1-INPUT-[0: 0]
-A input-j RH-Firewall-1-INPUT
-A forward-j RH-Firewall-1-INPUT
-A RH-Firewall-1-INPUT-I lo-j ACCEPT
-A RH-Firewall-1-INPUT-p icmp -- icmp-type any-j ACCEPT
-An RH-Firewall-1-INPUT-p 50-j ACCEPT
-An RH-Firewall-1-INPUT-p 51-j ACCEPT
-A RH-Firewall-1-INPUT-m state -- state ESTABLISHED, RELATED-j ACCEPT
-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 53-j ACCEPT
-A RH-Firewall-1-INPUT-m state -- state NEW-m udp-p udp -- dport 53-j ACCEPT
-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 22-j ACCEPT
-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 25-j ACCEPT
-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 80-j ACCEPT
-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 443-j ACCEPT
-A RH-Firewall-1-INPUT-j REJECT -- reject-with icmp-host-prohibited
COMMIT

Note that you must modify the file based on your server (for example, which services are open to modify the file ). For example, if you do not want to open port 80 to provide web services, delete the line accordingly:

-A RH-Firewall-1-INPUT-m state -- state NEW-m tcp-p tcp -- dport 80-j ACCEPT

After all the modifications, restart iptables:

Service iptables restart

You can verify whether all rules have taken effect:

Iptables-L

The system prints out the rules that have already taken effect.