Linux:iptables 常用命令


主机环境:

[root@test1280 ~]# cat /etc/redhat-release
CentOS release 6.8 (Final)
[root@test1280 ~]# uname -a
Linux test1280 2.6.32-642.el6.x86_64 #1 SMP Tue May 10 17:27:01 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

开放主机指定端口(以8080为例):

方法一:修改配置文件(/etc/sysconfig/iptables)

修改前:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

修改后:

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

即:添加一行:

-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT

然后执行命令使进程重载配置生效:

[root@test1280 ~]# service iptables reload
iptables: Trying to reload firewall rules:                 [  OK  ]

方法二:通过命令直接添加规则

执行命令:

[root@test1280 ~]# iptables -I INPUT -p tcp --dport 8080 -j ACCEPT

执行前状态:

[root@test1280 ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

执行后状态:

[root@test1280 ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080 
2    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
3    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
6    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

可以看到新增一行:

1    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080

注意,以方法二新增的规则是存在于iptables进程内存中未持久化的。

如果需要持久化配置,需要执行:

[root@test1280 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

iptables是一个二进制可执行程序:

/sbin/iptables

[root@test1280 ~]# which iptables
/sbin/iptables
[root@test1280 ~]# file `which iptables`
/sbin/iptables: symbolic link to `/etc/alternatives/iptables.x86_64'
[root@test1280 ~]# file -L `which iptables`
/sbin/iptables: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.18, stripped

同时,有一个同名的shell脚本,也叫做iptables:

/etc/init.d/iptables

[root@test1280 ~]# file /etc/init.d/iptables 
/etc/init.d/iptables: POSIX shell script text executable

1.查看状态:service iptables status

[root@test1280 ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
5    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         
1    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

2.宕停服务:service iptables stop

[root@test1280 ~]# service iptables stop
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]

3.启动服务:service iptables start

[root@test1280 ~]# service iptables start
iptables: Applying firewall rules:                         [  OK  ]

3.重启服务:service iptables restart

[root@test1280 ~]# service iptables restart
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules:                         [  OK  ]

4.重载配置:service iptables reload

[root@test1280 ~]# service iptables reload
iptables: Trying to reload firewall rules:                 [  OK  ]

我们修改iptables配置文件 /etc/sysconfig/iptables 后,iptables 进程不会自动刷新配置。

此时,需要重启(restart) iptables 或者 通知 iptables 动态重载(reload)配置。

5.保存配置:service iptables save

[root@test1280 ~]# service iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

我们通过 iptables 运行时修改的规则都是存在于进程内存空间,当我们重启进程(服务),原先设置的配置将丢失。

如果要持久化 iptables 进程规则到配置文件,可以执行此命令。

通常,配置文件将被持久化到 /etc/sysconfig/iptables。

6.其他命令:

[root@test1280 ~]# service iptables
Usage: iptables {start|stop|reload|restart|condrestart|status|panic|save}

具体的实现可以查看 /etc/init.d/iptables 脚本。


在非root下查看iptables status,将会输出:

[test1280@test1280 ~]$ service iptables status
iptables: Only usable by root.                             [WARNING]

参考:

1.https://www.cnblogs.com/pangguoming/p/5956151.html

Logo

更多推荐