CentOS6/7-防火墙管理

 #CentOS6
 #开放端口运行外部访问（不指定源IP）
 iptables -I INPUT -p tcp --dport  -j ACCEPT
 iptables -I INPUT -p tcp --dport  -j ACCEPT
 iptables -I INPUT -p tcp --dport  -j ACCEPT

 #定向开放本地端口允许访问
 iptables -I INPUT -s 10.86.87.0/ -p tcp --dport  -j ACCEPT

 #然后保存：
 /etc/rc.d/init.d/iptables save
 /etc/init.d/iptables status

 #防火墙启停
 /etc/init.d/iptables start
 /etc/init.d/iptables stop

 禁止linux向外建立新连接（INPUT 向内）
 、iptables -I OUTPUT -m state --state NEW -j DROP

 #拒绝IP所有请求
 iptables -I INPUT -s 10.86.87.123 -j DROP
 service iptables save
 iptables -L

修改iptables配置文件添加防火墙策略

vi /etc/sysconfig/iptables

# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [:]
:FORWARD ACCEPT [:]
:OUTPUT ACCEPT [:]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport  -j ACCEPT
-A INPUT -p tcp -m state –-state NEW -m tcp –dport  -j ACCEPT
-A INPUT -p tcp -m state –-state NEW -m tcp –dport  -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

注意点：新开放的端口一定要在端口22后面

>>>  CentOS 7.0默认使用的是firewall作为防火墙
#CentOS7常用命令
systemctl start firewalld.service                ##启动服务
systemctl stop firewalld.service                ##关闭服务
systemctl restart firewalld.service             ##重启服务
systemctl status firewalld.service              ##显示服务的状态
systemctl enable firewalld.service             ##在开机时启用服务
systemctl disable firewalld.service            ##在开机时禁用服务
systemctl is-enabled firewalld.service       ##查看服务是否开机启动
systemctl list-unit-files|grep enabled         ##查看已启动的服务列表
systemctl --failed                                       ##查看启动失败的服务列表

#CentOS7使用iptables防火墙配置（推荐!!）
1、关闭防火墙
systemctl stop firewalld.service           #停止firewall
systemctl disable firewalld.service        #禁止firewall开机启动

2、设置 iptables service
yum -y install iptables-services

#如果要修改防火墙配置，如增加防火墙端口3306，tomcat8080，nginx80端口

 vi/etc/sysconfig/iptables       #编辑防火墙配置文件
 # sampleconfiguration for iptables service
 # you can edit thismanually or use system-config-firewall
 # please do not askus to add additional ports/services to this default configuration
 *filter
 :INPUT ACCEPT [:]
 :FORWARD ACCEPT[:]
 :OUTPUT ACCEPT[:]
 -A INPUT -m state--state RELATED,ESTABLISHED -j ACCEPT
 -A INPUT -p icmp -jACCEPT
 -A INPUT -i lo -jACCEPT
 -A INPUT -p tcp -mstate --state NEW -m tcp --dport  -j ACCEPT
 -A INPUT -p tcp -m state --state NEW -m tcp --dport  -jACCEPT
 -A INPUT -p tcp -m state --state NEW -m tcp --dport -j ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp --dport  -j ACCEPT
 -A INPUT -j REJECT--reject-with icmp-host-prohibited
 -A FORWARD -jREJECT --reject-with icmp-host-prohibited
 COMMIT
 :wq!            #保存退出

#保存退出后
systemctl restart iptables.service #重启防火墙使配置生效
systemctl enable iptables.service #设置防火墙开机启动