正确的设置iptables命令汇总
iptables -P INPUT ACCEPT iptables -F iptables -X iptables -Z iptables -I INPUT -p tcp --dport 22 -j ACCEPT iptables -I INPUT -p tcp --dport 8080 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -j DROP
显示如下，其中lo口的再source列显示成为了0.0.0.0/0 刚开始以为放行了所有IP呢，实际测试是lo口。正常工作
[root@cenos ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:8080 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 icmp type 8 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED [root@cenos ~]#
前面添加允许的规则，最后追加一条规则拒绝其它所有的，无论什么协议的
链规则默认是ACCEPT，不推荐改成DROP，后面最后会演示隐患
关于上面的一些问题汇总
刚开始把lo口放行的改成了如下
iptables -A INPUT -s 127.0.0.1/8 -j ACCEPT
这样的话自己去连自己只能通过127.0.0.1去连接了。经过自己的IPV4连接出现不通的情况。如下测试
[root@linux-node1 ~]# telnet 192.168.56.11 9292 Trying 192.168.56.11... ^C [root@linux-node1 ~]# telnet 127.0.0.1 9292 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'. ^] telnet> quit Connection closed. [root@linux-node1 ~]#
如果再添加一条命令,也能正常工作了。但是每次针对不同的主机都要修改源地址。觉得麻烦了
iptables -I INPUT -s 192.168.56.11/32 -j ACCEPT
测试如下
[root@linux-node1 ~]# iptables -I INPUT -s 192.168.56.11/32 -j ACCEPT [root@linux-node1 ~]# telnet 192.168.56.11 9292 Trying 192.168.56.11... Connected to 192.168.56.11. Escape character is '^]'. ^C^] telnet> quit Connection closed. [root@linux-node1 ~]#
放行自己出去的包回来命令解释
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
测试正常添加，ping百度可以返回
[root@linux-node1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@linux-node1 ~]# iptables -I INPUT -p tcp --dport 22 -j ACCEPT [root@linux-node1 ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@linux-node1 ~]# iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@linux-node1 ~]# iptables -A INPUT -j DROP [root@linux-node1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED DROP all -- 0.0.0.0/0 0.0.0.0/0 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED [root@linux-node1 ~]# ##ping 百度测试下 [root@linux-node1 ~]# ping baidu.com -c 3 PING baidu.com (123.125.115.110) 56(84) bytes of data. 64 bytes from 123.125.115.110 (123.125.115.110): icmp_seq=1 ttl=128 time=37.9 ms 64 bytes from 123.125.115.110 (123.125.115.110): icmp_seq=2 ttl=128 time=35.9 ms 64 bytes from 123.125.115.110 (123.125.115.110): icmp_seq=3 ttl=128 time=35.8 ms --- baidu.com ping statistics --- 3 packets transmitted, 3 received, 0% packet loss, time 2003ms rtt min/avg/max/mdev = 35.852/36.593/37.967/0.972 ms [root@linux-node1 ~]#
测试错误添加方式
注意这个命令要在最终的drop之前
[root@linux-node1 ~]# iptables -F [root@linux-node1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@linux-node1 ~]# iptables -I INPUT -p tcp --dport 22 -j ACCEPT [root@linux-node1 ~]# iptables -A INPUT -j DROP [root@linux-node1 ~]# iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@linux-node1 ~]# iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT [root@linux-node1 ~]# ping baidu.com -c 3 ping: baidu.com: Name or service not known [root@linux-node1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:22 DROP all -- 0.0.0.0/0 0.0.0.0/0 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED [root@linux-node1 ~]# 所以 注意这个命令要在最终的drop之前
禁止别人ping自己，ACCEPT就允许了
禁止ping [root@data-1-1 ~]# iptables -A INPUT -p icmp --icmp-type 8 -j DROP [root@data-1-1 ~]# iptables -L -n Chain INPUT (policy ACCEPT) target prot opt source destination DROP icmp -- 0.0.0.0/0 0.0.0.0/0 icmptype 8 Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination [root@data-1-1 ~]# 测试别的机器无法ping通它 [root@linux-node1 ~]# ping 10.0.2.11 -c 3 PING 10.0.2.11 (10.0.2.11) 56(84) bytes of data. --- 10.0.2.11 ping statistics --- 3 packets transmitted, 0 received, 100% packet loss, time 2000ms [root@linux-node1 ~]#
注意iptables -I 和iptables -A是有区别的
-A和-I参数分别为添加到规则末尾和规则最前面
看到有些人使用-P改了默认的链的规则。我极其不推荐
比如下面方式、最后把链默认的改成了DROP方式
iptables -P INPUT ACCEPT iptables -F iptables -X iptables -Z iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p tcp --dport 22 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP
我来演示下隐患
后期如果调整iptables时不小心执行了iptables -F时机器就无法连接了
xshell连接不上机器了
就是因为防火墙的INPUT 链默认被改成了DROP的规则
我执行iptables -F 清除了所有规则，也就无法连接22端口了
通过控制台登录查看下
修复问题
[root@linux-node1 ~]# iptables -P FORWARD ACCEPT [root@linux-node1 ~]# iptables -P INPUT ACCEPT
补充部分2
centos最小化安装默认没iptables。当执行下面命令如下提示
[root@linux-node1 ~]# service iptables save The service command supports only basic LSB actions (start, stop, restart, try-restart, reload, force-reload, status). For other actions, please try to use systemctl. [root@linux-node1 ~]# systemctl restart iptables.service Failed to restart iptables.service: Unit not found.
需要安装iptables-services
yum install iptables-services iptables-services 和 iptables 是不一样的 安装了 services才有/etc/sysconfig/iptables