CentOS iptable防火墙添加/修改/删除端口

发布时间:2025-01-26 00:58

iptable是Linux自带的防火墙。野草云的CentOS系统镜像安装后默认没有开放80端口，我们可以编辑 iptable 规则来实现添加/删除。

 

查看当前iptable防火墙规则

# iptables -L -n

 

编辑规则

# vi /etc/sysconfig/iptables

出现如下（例子，部分会略有不同，只是讲述大概方法）：

 

# Firewall configuration written by system-config-firewall

# Manual customization of this file is not recommended.

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

 

我们可以在22端口下添加80端口，如（按键盘 I 进入编辑模式）：

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

 

以上例完成后完整的应该是：

# Firewall configuration written by system-config-firewall

# Manual customization of this file is not recommended.

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

 

按键盘Esc退出编辑模式，按Shift+:输入x回车，退出并保存。然后重启iptable使规则生效：

#service iptables restart