前言
iptables在Linux發(fā)行版本如Centos花嘶、Debian泣特、Ubuntu勋桶、Redhat等的配置內(nèi)容基本一致，但是配置方式有所不同蘸吓。由于工作日常用的是Centos 6.x善炫，它的配置較簡(jiǎn)單。下面對(duì)Debian上配置iptables做一個(gè)說(shuō)明美澳。
配置過(guò)程
環(huán)境要求
一臺(tái)Debian 6.x/7.x及以上版本的機(jī)器
登錄用戶名/密碼
配置步驟
- 使用用戶名/密碼登錄系統(tǒng)
root@localhost:~#
- 安裝iptables
root@localhost:~# apt-get install iptables
- 安裝成功后查看iptables端口開放情況
root@localhost:~# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@localhost:~#
INPUT销部、FORWARD和OUTPUT鏈中均沒(méi)有內(nèi)容，說(shuō)明此時(shí)iptables是空的制跟，沒(méi)有進(jìn)行任何配置。
- 配置iptables
（1）編輯iptables.test.rules酱虎，保存其配置
root@localhost:~# vi /etc/iptables.test.rules
// 內(nèi)容如下
# Generated by iptables-save
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-I INPUT -p tcp --dport 8888 -j ACCEPT
-I INPUT -p udp --dport 8888 -j ACCEPT
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
# Completed
上述是一個(gè)模板雨膨，可以根據(jù)需求進(jìn)行修改。如上開放了tcp22端口读串，以及8888的tcp和udp端口聊记。
（2）加載iptables.test.rules規(guī)則，并查看
root@localhost:/home# iptables-resotre < /etc/iptables.test.rules
root@localhost:/home# iptables -L
Chain INPUT (policy ACCEPT)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:8888
ACCEPT tcp -- anywhere anywhere tcp dpt:8888
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
ACCEPT icmp -- anywhere anywhere
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
target prot opt source destination
REJECT all -- anywhere anywhere reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
root@localhost:/home#
（3）設(shè)置開機(jī)啟動(dòng)
root@localhost:/home# vi /etc/network/if-pre-up.d/iptables
// 內(nèi)容如下
#!/bin/bash
/sbin/iptables-restore < /etc/iptables.test.rules
root@localhost:/home# chmod +x /etc/network/if-pre-up.d/iptables
（4）重啟查看是否開機(jī)加載
root@localhost:/home# reboot
root@localhost:~# iptables -L
結(jié)束語(yǔ)
按照上述步驟進(jìn)行配置恢暖，可以實(shí)現(xiàn)開機(jī)加載iptables規(guī)則排监。如果發(fā)生問(wèn)題，多配置幾遍就可以杰捂。Centos的配置主要在/etc/sysconfig/iptables進(jìn)行配置舆床，然后使用chkconfig開啟開機(jī)啟動(dòng)即可。在實(shí)際的運(yùn)維需求中嫁佳，可以根據(jù)應(yīng)用系統(tǒng)情況挨队，合理的開放端口。
