工具使用：centOS上的防火牆

1,防火牆配置文件目錄：
vi/etc/sysconfig/iptables

---

2.防火牆配置文件內容：

# Generated by iptables-save v1.4.7 on Fri Jan  6 16:53:09 2017
#*filter
#:INPUT ACCEPT [174:12442]
#:FORWARD ACCEPT [0:0]
#:OUTPUT ACCEPT [96:10704]
#-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT 
#-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
#-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT


#COMMIT
# Completed on Fri Jan  6 16:53:09 2017


#------------------------------------

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

#ssh port 
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

#vsftpd
-A INPUT -p TCP --dport 61001:62000 -j ACCEPT
-A OUTPUT -p TCP --sport 61001:62000 -j ACCEPT

-A INPUT -p TCP --dport 20 -j ACCEPT
-A OUTPUT -p TCP --sport 20 -j ACCEPT
-A INPUT -p TCP --dport 21 -j ACCEPT
-A OUTPUT -p TCP --sport 21 -j ACCEPT


#mysql port
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT

#tomcat remote debug port
-A INPUT -p tcp -m tcp --dport 5005 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3690 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8686 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8888 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8081 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
COMMIT

---

3,重啓防火牆
sudo service iptables restart

---

4,下一篇《centOs配置tomcat的遠程debug端口，遠程調試線上問題》

附錄centOS7上的防火牆命令

安裝Firewall命令：

yum install firewalld firewalld-config

Firewall開啓常見端口命令：

firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --zone=public --add-port=22/tcp --permanent
firewall-cmd --zone=public --add-port=21/tcp --permanent
firewall-cmd --zone=public --add-port=53/udp --permanent

Firewall關閉常見端口命令：
firewall-cmd --zone=public --remove-port=80/tcp --permanent
firewall-cmd --zone=public --remove-port=443/tcp --permanent
firewall-cmd --zone=public --remove-port=22/tcp --permanent
firewall-cmd --zone=public --remove-port=21/tcp --permanent
firewall-cmd --zone=public --remove-port=53/udp --permanent

批量添加區間端口
firewall-cmd --zone=public --add-port=4400-4600/udp --permanent
firewall-cmd --zone=public --add-port=4400-4600/tcp --permanent

開啓防火牆命令：
systemctl start firewalld.service

重啓防火牆命令：
firewall-cmd --reload  或者   service firewalld restart

查看端口列表：
firewall-cmd --permanent --list-port

禁用防火牆
systemctl stop firewalld

設置開機啓動
systemctl enable firewalld

停止並禁用開機啓動
sytemctl disable firewalld

查看狀態
systemctl status firewalld或者 firewall-cmd --state