linux iptables 端口防火墙规则（转） - 贤钟的博客- 博客园企业库|免费b2b网站

[root@tp ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

Chain OUTPUT (policy ACCEPT)
target prot opt source destination

Chain RH-Firewall-1-INPUT (0 references)
target     prot opt source               destination
ACCEPT     all -- 0.0.0.0/0            0.0.0.0/0
ACCEPT     icmp -- 0.0.0.0/0            0.0.0.0/0           icmp type 255
ACCEPT     esp -- 0.0.0.0/0            0.0.0.0/0
ACCEPT     ah   -- 0.0.0.0/0            0.0.0.0/0
ACCEPT     udp -- 0.0.0.0/0            224.0.0.251         udp dpt:5353
ACCEPT     udp -- 0.0.0.0/0            0.0.0.0/0           udp dpt:631
ACCEPT     all -- 0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
ACCEPT     tcp -- 0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22
ACCEPT     tcp -- 0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:80
ACCEPT     tcp -- 0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:25
REJECT     all -- 0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited
可以看出我在安装linux时,选择了有防火墙,并且开放了22,80,25端口.

[root@tp ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

[root@tp ~]# iptables -L -n
Chain INPUT (policy ACCEPT)
target prot opt source destination

Chain FORWARD (policy ACCEPT)
target prot opt source destination

[root@tp rc.d]# iptables -t nat -L
Chain PREROUTING (policy ACCEPT)
target prot opt source destination

Chain POSTROUTING (policy ACCEPT)
target prot opt source destination
SNAT all -- 192.168.0.0/24 anywhere to:211.101.46.235

[root@tp sysconfig]# iptables -t nat -A PREROUTING -i eth0 -s 10.0.0.0/8 -j DROP
[root@tp sysconfig]# iptables -t nat -A PREROUTING -i eth0 -s 172.16.0.0/12 -j DROP
[root@tp sysconfig]# iptables -t nat -A PREROUTING -i eth0 -s 192.168.0.0/16 -j DROP
如果我们想,比如阻止MSN,QQ,BT等的话,需要找到它们所用的端口或者IP,(个人认为没有太大必要)

drop非法连接
[root@tp ~]# iptables -A INPUT -m state --state INVALID -j DROP
[root@tp ~]# iptables -A OUTPUT -m state --state INVALID -j DROP
[root@tp ~]# iptables-A FORWARD -m state --state INVALID -j DROP
允许所有已经建立的和相关的连接
[root@tp ~]# iptables-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
[root@tp ~]# iptables-A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

[root@tp ~]# /etc/rc.d/init.d/iptables save

这样就可以写到/etc/sysconfig/iptables文件里了.写入后记得把防火墙重起一下,才能起作用．

[root@tp ~]# service iptables restart

别忘了保存，不行就写一部保存一次．你可以一边保存，一边做实验，看看是否达到你的要求，