Linuxiptablesrelevantco.docVIP

Author: 抽沙船 Author: 抽沙船 `一。设置主机防火墙策略。 1．[root@michael ~]# rpm -qa | grep iptables iptables-1.2.11-3.1.RHEL4 [root@michael ~]# rpm -ql iptables | grep bin /sbin/iptables /sbin/iptables-restore /sbin/iptables-save 2．[root@michael ~]# chkconfig --list iptables iptables 0:off 1:off 2:on 3:off 4:on 5:on 6:off [root@michael ~]# chkconfig --level 35 iptables on [root@michael ~]# chkconfig --list iptables iptables 0:off 1:off 2:on 3:on 4:on 5:on 6:off 3．[root@michael ~]# service iptables restart [root@michael ~]# vi /etc/sysconfig/iptables ~/etc/sysconfig/iptables [New] 0L, 0C written [root@michael ~]# service iptables restart Applying iptables firewall rules: [ OK ] 4．[root@michael ~]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination 5． 注意：”刚开始start iptables ,default all the 规则 is ACCEPT” “外部DNS 上的记录也是可以解析的，但是，WWW 是不能访问的。“ 6．[root@michael ~]# iptables -F [root@michael ~]# iptables -X [root@michael ~]# iptables -Z [root@michael ~]# iptables -P INPUT DROP 7. [root@michael ~]# iptables -A INPUT –i lo -j ACCEPT [root@michael ~]# iptables -A INPUT -p tcp --dport 22 -j ACCEPT [root@michael ~]# iptables -L Chain INPUT (policy DROP) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT tcp -- anywhere anywhere tcp dpt:ssh Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination 8. [root@michael ~]# iptables -A INPUT -p tcp --dport 80 -j ACCEPT [root@michael ~]# iptables -L Chain INPUT (policy DROP) target prot opt source destination