工具使用：centOS上的防火墙

1,防火墙配置文件目录：
vi/etc/sysconfig/iptables

---

2.防火墙配置文件内容：

# Generated by iptables-save v1.4.7 on Fri Jan  6 16:53:09 2017
#*filter
#:INPUT ACCEPT [174:12442]
#:FORWARD ACCEPT [0:0]
#:OUTPUT ACCEPT [96:10704]
#-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT 
#-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
#-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT


#COMMIT
# Completed on Fri Jan  6 16:53:09 2017


#------------------------------------

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT 
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

#ssh port 
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

#vsftpd
-A INPUT -p TCP --dport 61001:62000 -j ACCEPT
-A OUTPUT -p TCP --sport 61001:62000 -j ACCEPT

-A INPUT -p TCP --dport 20 -j ACCEPT
-A OUTPUT -p TCP --sport 20 -j ACCEPT
-A INPUT -p TCP --dport 21 -j ACCEPT
-A OUTPUT -p TCP --sport 21 -j ACCEPT


#mysql port
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT

#tomcat remote debug port
-A INPUT -p tcp -m tcp --dport 5005 -j ACCEPT

-A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 3690 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8686 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8888 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8081 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8080 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 8443 -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
COMMIT

---

3,重启防火墙
sudo service iptables restart

---

4,下一篇《centOs配置tomcat的远程debug端口，远程调试线上问题》

附录centOS7上的防火墙命令

安装Firewall命令：

yum install firewalld firewalld-config

Firewall开启常见端口命令：

firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
firewall-cmd --zone=public --add-port=22/tcp --permanent
firewall-cmd --zone=public --add-port=21/tcp --permanent
firewall-cmd --zone=public --add-port=53/udp --permanent

Firewall关闭常见端口命令：
firewall-cmd --zone=public --remove-port=80/tcp --permanent
firewall-cmd --zone=public --remove-port=443/tcp --permanent
firewall-cmd --zone=public --remove-port=22/tcp --permanent
firewall-cmd --zone=public --remove-port=21/tcp --permanent
firewall-cmd --zone=public --remove-port=53/udp --permanent

批量添加区间端口
firewall-cmd --zone=public --add-port=4400-4600/udp --permanent
firewall-cmd --zone=public --add-port=4400-4600/tcp --permanent

开启防火墙命令：
systemctl start firewalld.service

重启防火墙命令：
firewall-cmd --reload  或者   service firewalld restart

查看端口列表：
firewall-cmd --permanent --list-port

禁用防火墙
systemctl stop firewalld

设置开机启动
systemctl enable firewalld

停止并禁用开机启动
sytemctl disable firewalld

查看状态
systemctl status firewalld或者 firewall-cmd --state