配置Cento6.4 iptables防火墙。
1. 查看防火墙状态
serviceiptablesstatus #或/etc/init.d/iptablesstatus
2.关闭 /开启/重启防火墙
#serviceiptablesstop #serviceiptablesstart #serviceiptablesrestart
4.永久关闭防火墙
#chkconfig--level35iptablesoff
然后重启系统使其生效：
# shutdown-rnow
5.设置开启80端口访问
>先查看防火墙状态：
[root@localhost Nginx]# service iptables status Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) num target prot opt source destination 1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) num target prot opt source destination
>设置80端口（或者手动修改/etc/sysconfig/iptables）
[root@localhost ~]# /sbin/iptables -I INPUT -p tcp --dport 80 -j ACCEPT You have new mail in /var/spool/mail/root #保存设置 [root@localhost ~]# /etc/rc.d/init.d/iptables save iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
>再查看防火墙状态
[root@localhost ~]# service iptables status Table: filter Chain INPUT (policy ACCEPT) num target prot opt source destination 1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 3 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0 4 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22 6 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) num target prot opt source destination 1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited Chain OUTPUT (policy ACCEPT) num target prot opt source destination
>设置80端口--修改/etc/sysconfig/iptables配置文件
[root@localhost~]#vi/etc/sysconfig/iptables #添加下面内容 -AINPUT-ptcp-mstate--stateNEW-mtcp--dport80-jACCEPT
最后重启防火墙使配置生效。
service iptables restart
