Iptables Configuration tutorial

Based on your needs, you can access the following ports on the Internet: 80, 14490, 14500, 14460, and 14470. the server can access external ports: 80 and 25. Considering the remote management interface, add port 22, allow port 53 for Internet access. Allow the loopback API, icmpping. The specific configuration information is as follows [root @ localhostsysconfig] # iptabl can access the server ports 80, 14490, 14500, 14460, 14470, 24461, and on the Internet as needed
External ports accessible to the server: 80 and 25
Considering the remote management interface, add port 22 and allow port 53 for Internet access. Allow loop back interface, icmp ping.

The specific configuration information is as follows:
[Root @ localhost sysconfig] # Iptables-V
Iptables v1.4.7
[Root @ localhost sysconfig] # iptables-S
-P INPUT DROP
-P FORWARD ACCEPT
-P OUTPUT DROP
-A input-I lo-j ACCEPT
-A input-m state -- state RELATED, ESTABLISHED-j ACCEPT
-A input-p tcp-m state -- state NEW-m tcp -- dport 22-jACCEPT
-A input-p tcp-m state -- state NEW-m multiport -- dports80, 14490,14500, 14460,14470, 24461-j ACCEP
-A input-p udp-m state -- state NEW-m multiport -- dports14490, 14500,14460, 14470,24461-j ACCEPT
-A input-p icmp-m icmp -- icmp-type 8-j ACCEPT
-A input-p icmp-m icmp -- icmp-type 0-j ACCEPT
-A output-p icmp-j ACCEPT
-A output-o lo-j ACCEPT
-A output-m state -- state RELATED, ESTABLISHED-j ACCEPT
-A output-p tcp-m state -- state NEW-m tcp -- sport 22-jACCEPT
-A output-p tcp-m state -- state NEW-m multiport -- dports80, 25-j ACCEPT
-A output-p tcp-m state -- state NEW-m tcp -- dport 53-jACCEPT
-A output-p udp-m state -- state NEW-m udp -- dport 53-jACCEPT
-A output-p icmp-m icmp -- icmp-type 8-j ACCEPT
-A output-p icmp-m icmp -- icmp-type 0-j ACCEPT

Situations encountered in the process:
1. the domain name cannot be pinged. The problem was also found before, but there was no time for verification.
When output drop is found, you cannot telnet the dns Port 53. Add entry:
-A output-p tcp-m state -- state NEW-mtcp -- dport 53-j ACCEPT
-A output-p udp-m state -- state NEW-mudp -- dport 53-j ACCEPT
Tcp and udp ports are included.
An error occurred while writing.
-A output-p udp-m state -- stateNEW-m tcp -- dport 53-j ACCEPT
The entry is written incorrectly. the protocol does not match the preceding and following parameters. However, when iptables is restarted, the last line of "COMMIT" error is reported. Sadly, you have to take it seriously!
2.-a input-m state -- state RELATED, ESTABLISHED-j ACCEPT
The entries here allow subsequent links that have established connections. you need to add them.
3.-a input-p tcp-m state -- state NEW-m tcp -- dport 22-jACCEPT
Allow new connection
4. INPUT and OUTPUT can be separated in writing. Easy to view and troubleshoot.
5. restart: service iptables restart
Save: iptable-save>/etc/sysconfig/iptables
6. Some interfaces are allowed to be switched back.
-A input-I lo-j ACCEPT
-A output-o lo-j ACCEPT
7. allow icmp
-A input-p icmp-m icmp -- icmp-type 8-jACCEPT
-A input-p icmp-m icmp -- icmp-type0-j ACCEPT
-A output-p icmp-m icmp -- icmp-type 8-j ACCEPT
-A output-p icmp-m icmp -- icmp-type 0-j ACCEPT