markdown [linux：iptables]限制在CentOS6上通过IPTables从另一个实例访问端口。* #linux

Posted 2021-05-06

## 初期状態を確認
インスタンス生成直後の Linux ちゃんは制限なし状態。

```
$ sudo iptables -L
> Chain INPUT (policy ACCEPT)
> target     prot opt source               destination

> Chain FORWARD (policy ACCEPT)
> target     prot opt source               destination

> Chain OUTPUT (policy ACCEPT)
> target     prot opt source               destination
```

## 設定サンプル

### 1. 設定ファイル生成
```
# /etc/sysconfig/iptables を生成
$ sudo vi /etc/sysconfig/iptables
```

記述例は以下を参照。ほかに memcached とかサーバ間で許可したいものがあれば ALLOW 列挙していく。

```
*filter
:INPUT   ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT  ACCEPT [0:0]

##### ALLOW DNS #####
-A OUTPUT -p tcp --dport 53 -j ACCEPT
-A OUTPUT -p udp --dport 53 -j ACCEPT

##### ALLOW HTTP / HTTPS #####
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80    -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 443   -j ACCEPT
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

##### DENY SSH (If you want) #####
# Allow your machine ip address.
# -A INPUT -s 192.0.2.100 -p tcp --dport 22 -j ACCEPT
# Deny from other than above.
# -A INPUT -p tcp --dport 22 -j REJECT

##### DENY MySQL (If you want) #####
# Allow your machine ip address.
# -A INPUT -s 192.0.2.100 -p tcp --dport 3306 -j ACCEPT
# Deny from other than above.
# -A INPUT -p tcp --dport 3306 -j REJECT

##### DENY ALL OTHER THAN ABOVE #####
-A INPUT -j REJECT --reject-with icmp-host-prohibited

#####
COMMIT
```

### 2. IPTables を起動 & 起動時の有効化設定
```
$ sudo /etc/init.d/iptables start
$ sudo chkconfig iptables on
# 確認！
$ sudo iptables -L
```