一、添加规则：设置禁止所有IP访问指定端口8075
[root@zabbix_server ~]# iptables -I INPUT -p tcp --dport -j DROP
二、测试telnet
[root@zabbix_server ~]# telnet 127.0.0.1
Trying 127.0.0.1...
telnet: connect to address 127.0.0.1: Connection timed out
三、删除规则：
1、查询规则编号
[root@zabbix_server ~]# iptables --line -nvL INPUT
Chain INPUT (policy DROP packets, bytes)
num pkts bytes target prot opt in out source destination
DROP tcp -- * * 0.0.0.0/ 0.0.0.0/ tcp dpt:
144M 15G ACCEPT all -- * * 0.0.0.0/ 0.0.0.0/ state RELATED,ESTABLISHED
214K ACCEPT icmp -- * * 0.0.0.0/ 0.0.0.0/
ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
218K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
1169K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
264K 14M ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
443K 23M ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
4093K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
可以看到禁止访问8075的规则编号为1
2、删除指定规则编号的规则
[root@zabbix_server ~]# iptables -D INPUT
再查询
[root@zabbix_server ~]# iptables --line -nvL INPUT
Chain INPUT (policy DROP packets, bytes)
num pkts bytes target prot opt in out source destination
144M 15G ACCEPT all -- * * 0.0.0.0/ 0.0.0.0/ state RELATED,ESTABLISHED
214K ACCEPT icmp -- * * 0.0.0.0/ 0.0.0.0/
ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
218K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
1169K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
264K 14M ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
443K 23M ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
4094K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dp
已经删除了，测试telnet
[root@zabbix_server ~]# telnet 127.0.0.1
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
四、设置指定IP访问指定端口8075
1、添加规则：禁止所有IP访问8075
[root@zabbix_server ~]# iptables -I INPUT -p tcp --dport -j DROP
[root@zabbix_server ~]# iptables --line -nvL INPUT
Chain INPUT (policy DROP packets, bytes)
num pkts bytes target prot opt in out source destination
DROP tcp -- * * 0.0.0.0/ 0.0.0.0/ tcp dpt:
145M 15G ACCEPT all -- * * 0.0.0.0/ 0.0.0.0/ state RELATED,ESTABLISHED
214K ACCEPT icmp -- * * 0.0.0.0/ 0.0.0.0/
ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
219K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
1169K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
264K 14M ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
443K 23M ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
4095K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dp
2、添加规则：允许127.0.0.1访问8075
[root@zabbix_server ~]# iptables -I INPUT -s 127.0.0.1 -p tcp --dport -j ACCEPT
3、查询规则：
[root@zabbix_server ~]# iptables --line -nvL INPUT
Chain INPUT (policy DROP packets, bytes)
num pkts bytes target prot opt in out source destination
ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/ tcp dpt:
DROP tcp -- * * 0.0.0.0/ 0.0.0.0/ tcp dpt:
145M 15G ACCEPT all -- * * 0.0.0.0/ 0.0.0.0/ state RELATED,ESTABLISHED
214K ACCEPT icmp -- * * 0.0.0.0/ 0.0.0.0/
ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
219K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
1170K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
264K 14M ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
443K 23M ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
规则已经添加，测试
[root@zabbix_server ~]# telnet 127.0.0.1
Trying 127.0.0.1...
Connected to 127.0.0.1.
Escape character is '^]'.
本机可以访问8075,其他机器上不能访问8075
[root@localhost etc]# telnet 172.28.18.75 8075
Trying 172.28.18.75...
telnet: connect to address 172.28.18.75: Connection timed out
4、允许172.28.18.71可以访问8075,(172.28.18.71是需要访问8075的服务器)
[root@zabbix_server ~]# iptables -I INPUT -s 172.28.18.71 -p tcp --dport -j ACCEPT
查看规则
[root@zabbix_server ~]# iptables --line -nvL INPUT
Chain INPUT (policy DROP packets, bytes)
num pkts bytes target prot opt in out source destination
ACCEPT tcp -- * * 172.28.18.71 0.0.0.0/ tcp dpt:
ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/ tcp dpt:
DROP tcp -- * * 0.0.0.0/ 0.0.0.0/ tcp dpt:
145M 15G ACCEPT all -- * * 0.0.0.0/ 0.0.0.0/ state RELATED,ESTABLISHED
214K ACCEPT icmp -- * * 0.0.0.0/ 0.0.0.0/
ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
219K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
1171K ACCEPT tcp -- * * 0.0.0.0/ 0.0.0.0/ state NEW tcp dpt:
在172.28.18.71上测试telnet 8075
[root@localhost etc]# telnet 172.28.18.75
Trying 172.28.18.75...
Connected to 172.28.18.75.
Escape character is '^]'.
访问成功，保存规则
[root@zabbix_server ~]# service iptables save
iptables：将防火墙规则保存到 /etc/sysconfig/iptables：[确定]
重启服务
[root@zabbix_server ~]# service iptables save
iptables：将防火墙规则保存到 /etc/sysconfig/iptables：[确定]
[root@zabbix_server ~]# service iptables restart
iptables：将链设置为政策 ACCEPT：filter [确定]
iptables：清除防火墙规则：[确定]
iptables：正在卸载模块：[确定]
iptables：应用防火墙规则：[确定]