iptables部署使用

1、Iptables-server安装确认

[root@localhost ~]$ rpm -qa|grep iptables #查看安装iptables

iptables-1.4.21-18.0.1.el7.centos.x86_64

[root@localhost ~]$ rpm -ql iptables #查看iptables相关文件

2、安装iptables-services

[root@localhost ~]$ yum list all|grep iptables-services #查看可安装iptables-services

iptables-services.x86_64   1.4.21-35.el7        base     

[root@localhost ~]$ yum install -y iptables-services

[root@localhost ~]$  rpm -ql iptables-services

[root@localhost ~]$ lsmod|egrep 'filter|nat|iptable'  #确认这些内核模块是否开启

#默认没有加载这些模，加载这些模块，应该写进配置，让其永久性修改生效。

[root@localhost ~]$ modprobe ip_tables

[root@localhost ~]$ modprobe iptable_filter

[root@localhost ~]$ modprobe iptable_nat

[root@localhost ~]$ modprobe ip_conntrack

[root@localhost ~]$ modprobe ip_conntrack_ftp

[root@localhost ~]$ modprobe ip_nat_ftp

[root@localhost ~]$ modprobe ipt_state

加载内核模块的配置在/etc/modprobe.d/tuned.conf，也可以直接加到开机自启动文件里

[root@localhost ~]$ tail -7 /etc/rc.local

modprobe ip_tables

modprobe iptable_filter

modprobe iptable_nat

modprobe ip_conntrack

modprobe ip_conntrack_ftp

modprobe ip_nat_ftp

modprobe ipt_state

然后再检查下，现在有这些内核模块了

[root@localhost ~]$ lsmod|egrep 'filter|nat|iptable'

3、开启iptables防火墙

[root@localhost ~]$ systemctl stop firewalld

[root@localhost ~]$ systemctl disable firewalld

Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.

Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.

[root@localhost ~]$ systemctl is-active firewalld.service

[root@localhost ~]$ systemctl is-enabled firewalld.service

[root@localhost ~]$ systemctl start iptables.service

[root@localhost ~]$ systemctl enable iptables.service

[root@localhost ~]$ iptables -nL