Centos 防火墙之 iptables

今天我们要来说说centos系统防火墙，我选择使用的iptables，那么接下来我们就开始安装、配置、使用

1. 关闭firewalld防火墙

   [root@jjckj cblog]# systemctl status firewalld.service 
   ● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
     Active: inactive (dead)
       Docs: man:firewalld(1)
   

2. 安装iptables防火墙

   yum install -y iptables-services
   

3. 启动iptables

   [root@jjckj cblog]# systemctl status iptables.service 
   ● iptables.service - IPv4 firewall with iptables
     Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
     Active: active (exited) since 五 2019-09-06 15:40:17 CST; 47min ago
    Process: 105020 ExecStop=/usr/libexec/iptables/iptables.init stop (code=exited, status=0/SUCCESS)
    Process: 105086 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
   Main PID: 105086 (code=exited, status=0/SUCCESS)
      Tasks: 0
     Memory: 0B
     CGroup: /system.slice/iptables.service
   
   9月 06 15:40:16 jjckj.com systemd[1]: Starting IPv4 firewall with iptables...
   9月 06 15:40:17 jjckj.com iptables.init[105086]: iptables: Applying firewall rules: [  确定  ]
   9月 06 15:40:17 jjckj.com systemd[1]: Started IPv4 firewall with iptables.
   

4. 设置开机自启动

   systemctl enable iptables.service
   

5. 配置端口开放

   # sample configuration for iptables service
   # you can edit this manually or use system-config-firewall
   # please do not ask us to add additional ports/services to this default configuration
   *filter
   :INPUT ACCEPT [0:0]
   :FORWARD ACCEPT [0:0]
   :OUTPUT ACCEPT [0:0]
   -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
   -A INPUT -p icmp -j ACCEPT
   -A INPUT -i lo -j ACCEPT
   -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
   -A INPUT -p tcp -m state --state NEW -m tcp --dport 2122 -j ACCEPT
   -A INPUT -p tcp -m state --state NEW -m tcp --dport 8080:9999 -j ACCEPT
   -A INPUT -s 192.168.31.1/24 -p tcp -m state --state NEW -m multiport --dport 7979,80,3389 -j ACCEPT
   -A INPUT -j REJECT --reject-with icmp-host-prohibited
   -A FORWARD -j REJECT --reject-with icmp-host-prohibited
   COMMIT
   

   1. 22和2212是单独配置的外网可以访问，
   2. 8080:9999配置的是外网可以访问8080与9999中间段的所有端口服务，
   3. 7979,80,3389 配置的是局域网才能访问的端口服务（注意配置多个不连续的端口要加multiport）
6. 配置好保存之后重启iptables服务

   systemctl restart iptables.service
   

现在就可以测试你的外网是否可以访问及内网访问情况

如果安装了iptables同时也安装了docker在启动服务时报下面这种错

可以重启一下docker

systemctl restart docker.service

然后docker服务就可以运行了（我也不知道为什么）