#私藏项目实操分享# 使用iptable实现: 放行telnet, ftp, web服务,放行samba服务,其他端口服务全部拒绝

Posted 2022-02-18 qq5e3a878504161

服务端口说明

ssh：22

ftp tcp：20、21

telnet tcp：23

web tcp：80、443

samba udp：137、138

         tcp：139、445

安装命令补全命令，可以不装
[root@localhost <sub>]#yum -y install bash-completion

#允许本机访问ssh端口
[root@localhost </sub>]# iptables -I INPUT -s 10.10.6.190 -p tcp --dport 22 -j ACCEPT
#保持后续连接
[root@localhost <sub>]# iptables -I INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
#放行端口
[root@localhost </sub>]# iptables -A INPUT -p tcp -m multiport --dports 20,21,23,80,443,139,445 -j ACCEPT
[root@localhost <sub>]# iptables -A INPUT -p udp --dport 137:138 -j ACCEPT
#拒绝连接
[root@localhost </sub>]# iptables -A INPUT -j REJECT

查看防火墙规则
[root@localhost ~]# iptables -vnL
Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         
   67  4624 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            state RELATED,ESTABLISHED
    0     0 ACCEPT     tcp  --  *      *       10.10.6.190          0.0.0.0/0            tcp dpt:22
    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            multiport dports 20,21,23,80,443,139,445
    0     0 ACCEPT     udp  --  *      *       0.0.0.0/0            0.0.0.0/0            udp dpts:137:138
    0     0 REJECT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            reject-with icmp-port-unreachable

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination         

Chain OUTPUT (policy ACCEPT 22 packets, 2276 bytes)
 pkts bytes target     prot opt in     out     source               destination