[Summary] Web server iptables simple configuration

[Email protected] ~]# iptables-F[[email protected]~]# Iptables-X [[email protected]~]# iptables-a input-m State--state related,established-J ACCEPT # does not allow the server to actively establish a new connection [[email protected]~]# iptables-a input-p tcp-m multiport--sport A, the-M state--state NEW-J ACCEPT # allows connection and monitoring of 22,80 ports [[email protected]~]# iptables-a output-p TCP--sport A-J ACCEPT # allow SSH service [[email protected]~]# Iptables-P INPUT DROP # default Disable [[email protected]~]# Iptables-P FORWARD DROP # default Disable [[email protected]~]# Iptables-P OUTPUT DROP # default Disable [[email protected]~]# iptables-a input-p UDP--sport --J ACCEPT # Allow DNS service [[email protected]~]# iptables-a output-p UDP--dport --J ACCEPT # Allow DNS service [[email protected]~]# iptables-a input-p ICMP-J ACCEPT # Open ICMP protocol [[email protected]~]# iptables-a output-p ICMP-J ACCEPT # Open ICMP protocol [[email protected]~]# Service iptables Save # Saves configuration iptables:saving firewall rules to/etc/sysconfig/iptables:[OK][[email protected]~]# service iptables restartiptables:setting chains to Policy accept:filter [OK]iptables:flushing firew All rules: [OK]iptables:unloading modules: [OK]iptables:ap Plying firewall rules: [OK]

Corresponding to the general simple Web server is sufficient, of course, the SSH port will certainly be modified, the above command is also adjusted. If you want to prevent others from pinging the server, the following settings are recommended:

Temporary entry into force: Echo 1 >/proc/sys/net/ipv4/icmp_echo_ignore_all

Permanent entry into force:

[Email protected] ~]# echo "Net.ipv4.icmp_echo_ignore_all = 1" >>/etc/sysctl.conf
[Email protected] ~]# sysctl-p

# Generated by Iptables-save v1.4.7On Mon Mar +  -: -: on  .*filter:input DROP [3:134]:forward DROP [0:0]:output DROP [0:0]-A input-m state--state related,established-J ACCEPT-A input-p tcp-m multiport--sports A, the-M state--state NEW-J ACCEPT-A input-p udp-m UDP--sport --J ACCEPT-A input-p ICMP-J ACCEPT-A output-p tcp-m TCP--sport A-J ACCEPT-A output-p udp-m UDP--dport --J ACCEPT-A output-p ICMP-J acceptcommit# completed on Mon Mar +  -: -: on  .

The above iptables configuration can be copied directly to Vim/etc/sysconfig/iptables and then restarted iptables

[Summary] Web server iptables simple configuration