防火墻策略——端口訪問
設置步驟
檢測端口
如果遠程連接不上Mysql温艇，檢查下默認的3306端口是否允許訪問：
[root@localhost /]# iptables -L -n|grep 3306
ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3306
允許訪問
如果沒有，則需要允許此端口訪問：
[root@localhost /]# iptables -I INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
保存策略
這是臨時的允許訪問，需要保存防火墻的策略:
[root@localhost /]# iptables-save > iptables.rules
禁用firewall
因為Centos7的改動摔敛，把firewall禁用：
[root@localhost /]# systemctl stop firewalld.service
[root@localhost /]# systemctl mask firewalld.service
Created symlink from /etc/systemd/system/firewalld.service to /dev/null.
安裝iptables
安裝iptables-services：
[root@localhost /]# yum install iptables-services.x86_64 -y
Loaded plugins: fastestmirror, langpacks
base | 3.6 kB 00:00:00
extras | 3.4 kB 00:00:00
mysql-connectors-community | 2.5 kB 00:00:00
mysql-tools-community | 2.5 kB 00:00:00
mysql56-community | 2.5 kB 00:00:00
updates | 3.4 kB 00:00:00
Loading mirror speeds from cached hostfile
* base: mirrors.yun-idc.com
* extras: mirrors.cn99.com
* updates: mirrors.zju.edu.cn
Resolving Dependencies
--> Running transaction check
---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed
--> Processing Dependency: iptables = 1.4.21-17.el7 for package: iptables-services-1.4.21-17.el7.x86_64
--> Running transaction check
---> Package iptables.x86_64 0:1.4.21-16.el7 will be updated
---> Package iptables.x86_64 0:1.4.21-17.el7 will be an update
--> Finished Dependency Resolution
Dependencies Resolved
===========================================================================================
Package Arch Version Repository Size
===========================================================================================
Installing:
iptables-services x86_64 1.4.21-17.el7 base 50 k
Updating for dependencies:
iptables x86_64 1.4.21-17.el7 base 426 k
Transaction Summary
===========================================================================================
Install 1 Package
Upgrade ( 1 Dependent package)
Total download size: 476 k
Downloading packages:
No Presto metadata available for base
(1/2): iptables-services-1.4.21-17.el7.x86_64.rpm | 50 kB 00:00:00
(2/2): iptables-1.4.21-17.el7.x86_64.rpm | 426 kB 00:00:01
-------------------------------------------------------------------------------------------
Total 251 kB/s | 476 kB 00:00:01
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
Updating : iptables-1.4.21-17.el7.x86_64 1/3
Installing : iptables-services-1.4.21-17.el7.x86_64 2/3
Cleanup : iptables-1.4.21-16.el7.x86_64 3/3
Verifying : iptables-services-1.4.21-17.el7.x86_64 1/3
Verifying : iptables-1.4.21-17.el7.x86_64 2/3
Verifying : iptables-1.4.21-16.el7.x86_64 3/3
Installed:
iptables-services.x86_64 0:1.4.21-17.el7
Dependency Updated:
iptables.x86_64 0:1.4.21-17.el7
Complete!
開機啟動
安裝成功后，設置開機啟動：
[root@localhost /]# systemctl enable iptables.service
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
加載策略
- 重新加載策略：
[root@localhost /]# iptables-restore iptables.rules
初始化
- 策略初始化保存：
[root@localhost /]# /usr/libexec/iptables/iptables.init save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
總結(jié)
分成兩部分，一是安裝iptables-service悄蕾，二是修改策略。
安裝iptables-service
- 禁用firewall： systemctl stop firewalld.service / systemctl mask firewalld.service；
- 安裝iptables-services:yum install iptables-services帆调；
- 開機啟動：systemctl enable iptables.service奠骄。
修改策略
- 檢測端口訪問：iptables -L -n|grep 3306；
- 允許訪問：iptables -I INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT番刊；
- 保存策略：iptables-save > iptables.rules含鳞；
- 加載策略：iptables-restore iptables.rules；
- 初始化策略：/usr/libexec/iptables/iptables.init save
