Alibaba Cloud Centos configures iptables firewall

admin · Posted on 11/3/2014 3:41:54 PM

Although Alibaba Cloud has launched the Cloud Shield service, it is always safer to add another layer of firewall, the following is the process of configuring the firewall on Alibaba Cloud VPS, currently only INPUT is configured. OUTPUT and FORWORD are both rules for ACCEPT

1. Check the status of the iptables service

Start by checking the status of the iptables service

[root@woxplife ~]# service iptables status
iptables: Firewall is not running.

Copy code

The iptables service is installed, but the service is not started.
If you don't have it, you can install it directly

yum install -y iptables

Copy code

Start iptables

[root@woxplife ~]# service iptables start
iptables: Applying firewall rules: [ OK ]

Copy code

Take a look at the current configuration of iptables

[root@woxplife ~]# iptables -L -n

Copy code

2. Clear the default firewall rules

#首先在清除前要将policy INPUT改成ACCEPT,表示接受一切请求。
#这个一定要先做，不然清空后可能会悲剧
iptables -P INPUT ACCEPT
#清空默认所有规则
iptables -F
#清空自定义的所有规则
iptables -X
#计数器置0
iptables -Z

Copy code

3. Configuration rules

#允许来自于lo接口的数据包
#如果没有此规则，你将不能通过127.0.0.1访问本地服务，例如ping 127.0.0.1
iptables -A INPUT -i lo -j ACCEPT
#ssh端口22
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#FTP端口21
iptables -A INPUT -p tcp --dport 21 -j ACCEPT
#web服务端口80
iptables -A INPUT -p tcp --dport 80 -j ACCEP
#tomcat
iptables -A INPUT -p tcp --dport xxxx -j ACCEP
#mysql
iptables -A INPUT -p tcp --dport xxxx -j ACCEP
#允许icmp包通过,也就是允许ping
iptables -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT
#允许所有对外请求的返回包
#本机对外请求相当于OUTPUT,对于返回数据包必须接收啊，这相当于INPUT了
iptables -A INPUT -m state --state ESTABLISHED -j ACCEPT
#如果要添加内网ip信任（接受其所有TCP请求）
iptables -A INPUT -p tcp -s 45.96.174.68 -j ACCEPT
#过滤所有非以上规则的请求
iptables -P INPUT DROP

Copy code

4. Preservation

First, iptables -L -n to see if the configuration is correct.
After no problem, don't rush to save, because if you don't save, it is only valid for now, and it will not take effect after restarting, so that in case there is any problem, you can force the server to restart the settings in the background.
Open another SSH connection to ensure you can log in.

Make sure to save it later

#保存
[root@woxplife ~]# service iptables save
#添加到自启动chkconfig
[root@woxplife ~]# chkconfig iptables on

Copy code

[linux] Alibaba Cloud Centos configures iptables firewall

Related Posts