配置Cento6.4 iptables防火牆。
1. 查看防火牆狀態
- # service iptables status
- # /etc/init.d/iptables status
2.關閉 /開啓/重啓防火牆
- # service iptables stop
- # service iptables start
- # service iptables restart
4.永久關閉防火牆
- # chkconfig --level 35 iptables off
然後重啓系統使其生效:
- # shutdown -r now
5.設置開啓80端口訪問
>先查看防火牆狀態:
[root@localhost nginx]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
2 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
3 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
5 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
>設置80端口(或者手動修改/etc/sysconfig/iptables)
[root@localhost ~]# /sbin/iptables -I INPUT -p tcp --dport 80 -j ACCEPT
You have new mail in /var/spool/mail/root
>保存設置
[root@localhost ~]# /etc/rc.d/init.d/iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]
>再查看防火牆狀態
[root@localhost ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target prot opt source destination
1 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80
2 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED
3 ACCEPT icmp -- 0.0.0.0/0 0.0.0.0/0
4 ACCEPT all -- 0.0.0.0/0 0.0.0.0/0
5 ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:22
6 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain FORWARD (policy ACCEPT)
num target prot opt source destination
1 REJECT all -- 0.0.0.0/0 0.0.0.0/0 reject-with icmp-host-prohibited
Chain OUTPUT (policy ACCEPT)
num target prot opt source destination
>設置80端口--修改/etc/sysconfig/iptables配置文件
- [root@localhost ~]# vi /etc/sysconfig/iptables
- # 添加下面內容
- -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT