防火墙策略——端口访问

设置步骤

检测端口

如果远程连接不上Mysql，检查下默认的3306端口是否允许访问：

[root@localhost /]# iptables -L -n|grep 3306
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            state NEW tcp dpt:3306

允许访问

如果没有，则需要允许此端口访问：

[root@localhost /]# iptables -I INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT

保存策略

这是临时的允许访问，需要保存防火墙的策略:

[root@localhost /]# iptables-save > iptables.rules

禁用firewall

因为Centos7的改动，把firewall禁用：

[root@localhost /]# systemctl stop firewalld.service 
[root@localhost /]# systemctl mask firewalld.service 
Created symlink from /etc/systemd/system/firewalld.service to /dev/null.

安装iptables

安装iptables-services：

[root@localhost /]# yum install iptables-services.x86_64 -y
Loaded plugins: fastestmirror, langpacks
base                                                                | 3.6 kB  00:00:00     
extras                                                              | 3.4 kB  00:00:00     
mysql-connectors-community                                          | 2.5 kB  00:00:00     
mysql-tools-community                                               | 2.5 kB  00:00:00     
mysql56-community                                                   | 2.5 kB  00:00:00     
updates                                                             | 3.4 kB  00:00:00     
Loading mirror speeds from cached hostfile
 * base: mirrors.yun-idc.com
 * extras: mirrors.cn99.com
 * updates: mirrors.zju.edu.cn
Resolving Dependencies
--> Running transaction check
---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed
--> Processing Dependency: iptables = 1.4.21-17.el7 for package: iptables-services-1.4.21-17.el7.x86_64
--> Running transaction check
---> Package iptables.x86_64 0:1.4.21-16.el7 will be updated
---> Package iptables.x86_64 0:1.4.21-17.el7 will be an update
--> Finished Dependency Resolution

Dependencies Resolved

===========================================================================================
 Package                     Arch             Version                 Repository      Size
===========================================================================================
Installing:
 iptables-services           x86_64           1.4.21-17.el7           base            50 k
Updating for dependencies:
 iptables                    x86_64           1.4.21-17.el7           base           426 k

Transaction Summary
===========================================================================================
Install  1 Package
Upgrade             ( 1 Dependent package)

Total download size: 476 k
Downloading packages:
No Presto metadata available for base
(1/2): iptables-services-1.4.21-17.el7.x86_64.rpm                   |  50 kB  00:00:00     
(2/2): iptables-1.4.21-17.el7.x86_64.rpm                            | 426 kB  00:00:01     
-------------------------------------------------------------------------------------------
Total                                                      251 kB/s | 476 kB  00:00:01     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Updating   : iptables-1.4.21-17.el7.x86_64                                           1/3 
  Installing : iptables-services-1.4.21-17.el7.x86_64                                  2/3 
  Cleanup    : iptables-1.4.21-16.el7.x86_64                                           3/3 
  Verifying  : iptables-services-1.4.21-17.el7.x86_64                                  1/3 
  Verifying  : iptables-1.4.21-17.el7.x86_64                                           2/3 
  Verifying  : iptables-1.4.21-16.el7.x86_64                                           3/3 

Installed:
  iptables-services.x86_64 0:1.4.21-17.el7                                                 

Dependency Updated:
  iptables.x86_64 0:1.4.21-17.el7                                                          

Complete!

开机启动

安装成功后，设置开机启动：

[root@localhost /]# systemctl enable iptables.service 
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.

加载策略

7. 重新加载策略：

[root@localhost /]# iptables-restore iptables.rules

初始化

8. 策略初始化保存：

[root@localhost /]# /usr/libexec/iptables/iptables.init save
iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

总结

分成两部分，一是安装iptables-service，二是修改策略。

安装iptables-service

1. 禁用firewall： systemctl stop firewalld.service / systemctl mask firewalld.service；
2. 安装iptables-services:yum install iptables-services；
3. 开机启动：systemctl enable iptables.service。

修改策略

1. 检测端口访问：iptables -L -n|grep 3306；
2. 允许访问：iptables -I INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT；
3. 保存策略：iptables-save > iptables.rules；
4. 加载策略：iptables-restore iptables.rules；
5. 初始化策略：/usr/libexec/iptables/iptables.init save