[root@web01 ~]# systemctl stop firewalld
[root@web01 ~]# systemctl disable firewalld
[root@web01 ~]# yum -y install iptables iptables-services
[root@web01 ~]# systemctl start iptables
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -nL
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -F
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
[root@web01 ~]# iptables-save > /etc/sysconfig/iptables
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -t filter -A INPUT -p tcp -j ACCEPT
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT tcp -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -I INPUT -p udp -j ACCEPT
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -I INPUT 2 -p icmp -j ACCEPT
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere
ACCEPT icmp -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -D INPUT 1
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -F
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
[root@web01 ~]# systemctl restart iptables.service
[D:\~]$ ping 59.x.x.x
正在 Ping 59.x.x.x 具有 32 字節(jié)的數(shù)據(jù):
來(lái)自 59. 的回復(fù): 字節(jié)=32 時(shí)間=7ms TTL=55
來(lái)自 59. 的回復(fù): 字節(jié)=32 時(shí)間=16ms TTL=55
來(lái)自 59. 的回復(fù): 字節(jié)=32 時(shí)間=7ms TTL=55
來(lái)自 59. 的回復(fù): 字節(jié)=32 時(shí)間=8ms TTL=55
59.x.x.x 的 Ping 統(tǒng)計(jì)信息:
數(shù)據(jù)包: 已發(fā)送 = 4语稠，已接收 = 4衫哥，丟失 = 0 (0% 丟失)，
往返行程的估計(jì)時(shí)間(以毫秒為單位):
最短 = 7ms疫萤，最長(zhǎng) = 16ms，平均 = 9ms
[root@web01 ~]# iptables -I INPUT -p icmp -j REJECT
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT icmp -- anywhere anywhere reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[D:\~]$ ping 59.x.x.x
正在 Ping 59. 具有 32 字節(jié)的數(shù)據(jù):
來(lái)自 59. 的回復(fù): 無(wú)法連到端口。
來(lái)自 59. 的回復(fù): 無(wú)法連到端口。
來(lái)自 59. 的回復(fù): 無(wú)法連到端口队魏。
來(lái)自 59. 的回復(fù): 無(wú)法連到端口。
59.的 Ping 統(tǒng)計(jì)信息:
數(shù)據(jù)包: 已發(fā)送 = 4弛秋，已接收 = 4器躏，丟失 = 0 (0% 丟失)，
[D:\~]$
[root@web01 ~]# iptables -I INPUT -s 111.193.X.X -p tcp --dport 22 -j REJECT
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- 111.193. anywhere tcp dpt:ssh reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -I INPUT -s 106.121.x.x -p tcp --dport 22:80 -j REJECT
[root@web01 ~]# iptables -F
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -I INPUT -s 106.121.X.X -p tcp --dport 80 -j REJECT
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
REJECT tcp -- 106.121.X.X anywhere tcp dpt:http reject-with icmp-port-unreachable
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -R INPUT 1 -p icmp -s 106.121.X.X -j ACCEPT
[root@web01 ~]# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT icmp -- 106.121.X.X anywhere
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
[root@web01 ~]# iptables -F
[root@web01 ~]# systemctl stop iptables
[root@web01 ~]# systemctl start firewalld.service
[root@web01 ~]# firewall-cmd --get-default-zone
public
[root@web01 ~]# firewall-cmd --set-default-zone=trusted
success
[root@web01 ~]# firewall-cmd --reload
success
[root@web01 ~]# firewall-cmd --set-default-zone=public
success
[root@web01 ~]# firewall-cmd --permanent --add-service=http --zone=public
success
[root@web01 ~]# firewall-cmd --reload
success
[root@web01 ~]# firewall-cmd --permanent --add-source=106.121.x.x/24 --zone=drop
success
[root@web01 ~]# firewall-cmd --reload
success
[root@web01 ~]# firewall-cmd --permanent --remove-source=106.121.x.x/24 --zone=drop
success
[root@web01 ~]# firewall-cmd --reload
success
[root@web01 ~]# firewall-cmd --permanent --add-port=80/tcp --zone=public
success
[root@web01 ~]# firewall-cmd --reload
success
[root@web01 ~]# firewall-cmd --permanent --remove-service=http --zone=public
success
[root@web01 ~]# firewall-cmd --reload
success
[root@web01 ~]# firewall-cmd --permanent --remove-port=80/tcp --zone=public
success
[root@web01 ~]# firewall-cmd --reload
success
[root@web01 ~]#
Firewall.jpg
