屏蔽出站

iptables -t filter -A OUTPUT --dst 192.168.0.191/32 -j DROP

iptables -t filter -A OUTPUT --dst 192.168.0.192/32 -j DROP

iptables -t filter -A OUTPUT --dst 192.168.0.193/32 -j DROP

#!/bin/sh

# reset :

iptables -t filter -F

iptables -t filter -X

# Block all :

iptables -t filter -P INPUT DROP

iptables -t filter -P FORWARD DROP

iptables -t filter -P OUTPUT DROP

# Authorize already established connections :

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Authorize backloop :

iptables -t filter -A INPUT -i lo -j ACCEPT

iptables -t filter -A OUTPUT -o lo -j ACCEPT

# Authorize ssh :

iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT

# Authorize HTTP :

iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT

# Authorize HTTPS :

iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT

# Authorize DNS :

iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT

iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT

iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT

# Ping :

iptables -t filter -A INPUT -p icmp -j ACCEPT

iptables -t filter -A OUTPUT -p icmp -j ACCEPT

# Authorize FTP :

iptables -t filter -A INPUT -p tcp --dport 20 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 20 -j ACCEPT

iptables -t filter -A INPUT -p tcp --dport 21 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 21 -j ACCEPT

# # Authorize NTP :

# iptables -t filter -A INPUT -p udp --dport 123 -j ACCEPT

# iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

# Authorize IRC :

iptables -t filter -A INPUT -p tcp --dport 6667 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 6667 -j ACCEPT

# Authorize port 10000 (for Node.JS server) :

iptables -t filter -A INPUT -p tcp --dport 10000 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 10000 -j ACCEPT

# Authorize port 631 (Cups server) :

iptables -t filter -A INPUT -p tcp --dport 631 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 631 -j ACCEPT

# Authorize port 9418 (git) :

iptables -t filter -A INPUT -p tcp --dport 9418 -j ACCEPT

iptables -t filter -A OUTPUT -p tcp --dport 9418 -j ACCEPT

# sample configuration for iptables service

# you can edit this manually or use system-config-firewall

# please do not ask us to add additional ports/services to this default configuration

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

#定义白名单群组

-N whitelist

#设置白名单IP，开放ip可以访问设备,白名单就按类似规则增加就可以

-A whitelist -s  192.168.1.100     -j ACCEPT

-A whitelist -s  100.20.30.40     -j ACCEPT

-A whitelist -s  1.2.3.4      -j ACCEPT

-A whitelist -s  25.36.47.58     -j ACCEPT

#开放所有设备主动访问的服务器，处在RELATED,ESTABLISHED状态可以通信，这样设备需要主动访问的服务器就不用一个一个添加到白名单了

-A INPUT -m state --state RELATED,ESTABLISHED -j whitelist

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

#白名单端口

-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j whitelist

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j whitelist

-A INPUT -m state --state NEW -m tcp -p tcp --dport 9000 -j whitelist

#也可以这样写

#-A INPUT -m state --state NEW -m tcp -p tcp --dport  3306,80,9000 -j whitelist

#拒绝白名单以外IP访问指定端口

-A INPUT  -p tcp  -m  multiport --dports  3306,80,9000  -j  DROP

COMMIT

对指定ip开放1024——65535之间的端口

-A INPUT -s 61.135.125.14 -p tcp --dport 1024:65535 -m comment --comment "仅允许公司ip连"  -j ACCEPT

————

转发 SSH 端口参考

echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf

sysctl -p

iptables -t nat -A PREROUTING -d 1.1.1.1 -p tcp -m tcp --dport 22 -j DNAT --to-destination 10.0.0.2:22

iptables -t nat -A POSTROUTING -d 10.0.0.2 -p tcp -m tcp --dport 22 -j MASQUERADE

service iptables save

MASQUERADE 和 SNAT 效果基本相同。它们的作用：所有从本地网络出去的包的源地址改为 Internet 连接的地址。如果不作 SNAT 或 MASQUERADE ，返回给客户端的数据包不知道怎么发出去

区别：

SNAT 必须指定 source IP 地址

MASQUERADE 不需要指定 source IP 地址动态 IP 的情况必须用 MASQUERADE

iptables -t nat -A PREROUTING -p tcp -m tcp --dport 3389 -j DNAT --to-destination 192.168.0.218

来源： https://www.v2ex.com/t/319145#reply6

——

转发端口——————————————————————————————

来源： https://blog.csdn.net/e_wsq/article/details/79933232

iptables -t nat -A PREROUTING -p tcp --dport [端口号] -j DNAT --to-destination [目标IP]

iptables -t nat -A PREROUTING -p udp --dport [端口号] -j DNAT --to-destination [目标IP]

iptables -t nat -A POSTROUTING -p tcp -d [目标IP] --dport [端口号] -j SNAT --to-source [本地服务器IP]

iptables -t nat -A POSTROUTING -p udp -d [目标IP] --dport [端口号] -j SNAT --to-source [本地服务器IP]

iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.0.218

iptables -t nat -A POSTROUTING -p tcp -d 192.168.0.218 --dport 80 -j SNAT --to-source 192.168.0.219

iptables -A INPUT -p tcp -m tcp --dport 80 -m comment --comment "转发80到wordpress" -j ACCEPT

为新的iptables规则添加注释的语法为： comment --comment “要添加的注释文字”

具体的例子：下面添加一条允许ssh流量通过的规则，并且给这条规则添加注释:

$ sud iptables -A INPUT -p tcp -m tcp --dport 22 -m comment --comment "allow SSH to this host from anywhere" -j ACCEPT

————————————————————————————————————

CentOS 7关闭防火墙 SElinux 配ip (2016/6/2 9:34:10)

systemctl stop firewalld.service && systemctl disable firewalld.service && sed -i '/SELINUX/s/enforcing/disabled/g' /etc/selinux/config && source /etc/selinux/config && setenforce 0

                                               sed -i '/匹配字符串/s/源字符串/目标字符串/g' ab.txt

IP='192.168.5.21'

sed '3a IPADDR="192.168.1.23"' -i /etc/sysconfig/network-scripts/ifcfg-em2

sed '4a NETMASK="255.255.225.0"' -i /etc/sysconfig/network-scripts/ifcfg-em2

sed -i '/BOOTPROTO/s/dhcp/static/' /etc/sysconfig/network-scripts/ifcfg-em2

sed -i '/ONBOOT/s/no/yes/' /etc/sysconfig/network-scripts/ifcfg-em2

sed '5a GATEWAY="192.168.5.1"' -i /etc/sysconfig/network-scripts/ifcfg-em2

sed '6a DNS1="114.114.114.114"' -i /etc/sysconfig/network-scripts/ifcfg-em2

sed '2 ittt' -i a.txt # 在第2行前插入ttt，并且将结果更新到a.txt（

CentOS 7.0默认使用的是firewall作为防火墙，这里改为iptables防火墙。

firewall：

systemctl start firewalld.service#启动firewall

systemctl stop firewalld.service#停止firewall

systemctl disable firewalld.service#禁止firewall开机启动

追答：

改成iptables

firewall：

systemctl start iptables.service

屏蔽端口 屏蔽3306端口

iptables -A OUTPUT -p tcp --dport 3306 -j DROP

iptables -A INPUT -p tcp --dport 3306 -j DROP

关闭centos7自带防火墙启用iptables

systemctl mask firewalld

systemctl stop firewalld

yum install iptables-services

systemctl enable iptables

systemctl start iptables

centos7防火墙添加开放端口

实际命令如下：

firewall-cmd --permanent --add-port=3389/tcp

执行可以成功

 用该命令查询firewall-cmd --permanent --query-port=1000/tcp

 
#firewall-cmd --reload

查看当前默认区域

 firewall-cmd --get-default-zone

改变网卡接口区域  em2是网卡名

firewall-cmd --zone=trusted --change-interface=em2

查看网卡所在区域

 firewall-cmd --get-zone-of-interface=em2

 

 

 

 

 

 

 

 service iptables start

iptables -A INPUT -p tcp --dport 你的vps端口号 -j ACCEPT

iptables -A OUTPUT -p tcp --sport 你的vps端口号 -j ACCEPT

service iptables save

————————————————————

启动失败时 Assertion failed for IPv4 firewall with iptables

service iptables save

systemctl stop firewalld

systemctl disable  firewalld

systemctl start iptables

systemctl status iptables

systemctl enable iptables