{"id":7034,"date":"2017-10-01T21:48:16","date_gmt":"2017-10-01T13:48:16","guid":{"rendered":"http:\/\/rmohan.com\/?p=7034"},"modified":"2017-10-01T21:48:16","modified_gmt":"2017-10-01T13:48:16","slug":"centos7-install-iptables-firewall","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=7034","title":{"rendered":"CentOS7 install iptables firewall"},"content":{"rendered":"

CentOS 7 default firewall is not iptables, but firewall<\/strong><\/p>\n

Install iptable iptable-service<\/strong><\/p>\n

# First check whether the installation of iptables <\/strong>
\nservice iptables status
\n# install iptables
\nyum install-y iptables
\n# upgrade iptables
\nyum update iptables
\n# install iptables-services
\nyum install iptables-services<\/p>\n

Disable \/ stop the built-in firewalld service<\/strong><\/p>\n

# Stop the firewalld service
\nsystemctl stop firewalld
\n# Disable the firewalld service
\nsystemctl mask firewalld<\/p>\n

Set up existing rules<\/p>\n

# View iptables existing rules
\niptables -L-n
\n# first allow all, otherwise there may be a cup
\niptables -P INPUT ACCEPT
\n# clear all default rules
\niptables-F
\n# clear all custom rules
\niptables-X
\n# all counters 0
\niptables -Z
\n# Allows packets from the lo interface (local access)
\niptables -A INPUT -i lo -j ACCEPT
\n# open 22 port
\niptables -A INPUT -p tcp -dport 22 -j ACCEPT
\n# open 21 port (FTP)
\n-A -p TCP –dport the INPUT iptables 21 is -j ACCEPT
\n# open port 80 (the HTTP)
\niptables -A 80 –dport the INPUT -p TCP -j ACCEPT
\n# open port 443 (the HTTPS)
\niptables -A the INPUT -p TCP – -dport 443 -j ACCEPT
\n# Allow ping
\niptables -A INPUT -p icmp –icmp-type 8 -j ACCEPT
\n# Allow the return data after the native request RELATED, which is set for FTP
\niptables -A INPUT -m state –state RELATED, ESTABLISHED -j ACCEPT
\n# other inbound discarded
\niptables -P INPUT DROP
\n# all outbound all green
\niptables -P OUTPUT ACCEPT
\n# all forwarded
\niptables -P FORWARD DROP<\/p>\n

Other rules set<\/p>\n

Iptables -P INPUT
\n-p tcp -s 45.96.174.68 -j ACCEPT
\n# Filter all requests that are not above rules
\niptables -P INPUT DROP
\n# To block an IP, if you want to add an intranet ip trusted (accept all of its TCP requests) Use the following command:
\niptables -I INPUT -s ***. ***. ***. *** -j DROP
\n# To unblock an IP, use the following command:
\niptables -D INPUT -s * **. ***. ***. *** -j DROP<\/p>\n

Save the rule settings<\/p>\n

# Save the above rules
\nservice iptables save<\/p>\n

Open the iptables service<\/p>\n

# Register iptables service
\n# equivalent to the previous chkconfig iptables on
\nsystemctl enable iptables.service
\n# Open service
\nsystemctl start iptables.service
\n# View status
\nsystemctl status iptables.service<\/p>\n

Solve vsftpd iptables open, can not use the passive mode of the problem<\/p>\n

1. First modify or add the following in \/ etc \/ sysconfig \/ iptables-config<\/p>\n

# Add the following, note that the order can not be exchanged
\nIPTABLES_MODULES = “ip_conntrack_ftp”
\nIPTABLES_MODULES = “ip_nat_ftp”<\/p>\n

2. Reset the iptables settings<\/p>\n

iptables -A INPUT -m state –state RELATED, ESTABLISHED -j ACCEPT<\/p>\n

The following is a complete setup script<\/p>\n

#! \/ bin \/ SH
\niptables -P the INPUT ACCEPT
\niptables -F
\niptables the -X-
\niptables the -Z
\niptables -A the INPUT LO -i -j ACCEPT
\niptables -A –dport 22 is the INPUT -p TCP -j ACCEPT
\niptables -A the INPUT -p tcp –dport 21 -j ACCEPT
\niptables -A INPUT -p tcp –dport 80 -j ACCEPT
\niptables -A INPUT -p tcp –dport 443 -j ACCEPT
\niptables -A INPUT -p icmp –icmp-type 8 – j ACCEPT
\niptables -A INPUT -m state –state RELATED, ESTABLISHED -j ACCEPT
\niptables -P INPUT DROP
\niptables -P OUTPUT ACCEPT
\niptables -P FORWARD DROP
\nservice iptables save
\nsystemctl restart iptables.service<\/p>\n","protected":false},"excerpt":{"rendered":"

CentOS 7 default firewall is not iptables, but firewall<\/p>\n

Install iptable iptable-service<\/p>\n

# First check whether the installation of iptables service iptables status # install iptables yum install-y iptables # upgrade iptables yum update iptables # install iptables-services yum install iptables-services<\/p>\n

Disable \/ stop the built-in firewalld service<\/p>\n

# Stop the firewalld service systemctl stop […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[73],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7034"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7034"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7034\/revisions"}],"predecessor-version":[{"id":7035,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/7034\/revisions\/7035"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7034"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7034"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7034"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}