一、添加規則：設置禁止所有IP訪問指定端口8075
[root@zabbix_server ~]# iptables -I INPUT -p tcp --dport 8075 -j DROP
二、測試telnet
[root@zabbix_server ~]# telnet 127.0.0.1 8075 Trying 127.0.0.1... telnet: connect to address 127.0.0.1: Connection timed out
三、刪除規則：
1、查詢規則編號
[root@zabbix_server ~]# iptables --line -nvL INPUT Chain INPUT (policy DROP 83 packets, 4016 bytes) num pkts bytes target prot opt in out source destination 1 8 408 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8075 2 144M 15G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 3 4037 214K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 4 3 156 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25601 5 4085 218K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 6 22638 1169K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3306 7 264K 14M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:9000 8 443K 23M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10050 9 76134 4093K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10051
可以看到禁止訪問8075的規則編號為1
2、刪除指定規則編號的規則
[root@zabbix_server ~]# iptables -D INPUT 1
再查詢
[root@zabbix_server ~]# iptables --line -nvL INPUT Chain INPUT (policy DROP 20 packets, 961 bytes) num pkts bytes target prot opt in out source destination 1 144M 15G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 2 4038 214K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 3 3 156 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25601 4 4087 218K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 5 22644 1169K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3306 6 264K 14M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:9000 7 443K 23M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10050 8 76156 4094K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10051 9 44 2208 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dp
已經刪除了，測試telnet
[root@zabbix_server ~]# telnet 127.0.0.1 8075 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'.
四、設置指定IP訪問指定端口8075
1、添加規則：禁止所有IP訪問8075
[root@zabbix_server ~]# iptables -I INPUT -p tcp --dport 8075 -j DROP [root@zabbix_server ~]# iptables --line -nvL INPUT Chain INPUT (policy DROP 3 packets, 156 bytes) num pkts bytes target prot opt in out source destination 1 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8075 2 145M 15G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 3 4038 214K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 4 3 156 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25601 5 4090 219K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 6 22650 1169K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3306 7 264K 14M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:9000 8 443K 23M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10050 9 76183 4095K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10051 10 44 2208 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3000 11 7 284 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:5672 12 2 80 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dp
2、添加規則：允許127.0.0.1訪問8075
[root@zabbix_server ~]# iptables -I INPUT -s 127.0.0.1 -p tcp --dport 8075 -j ACCEPT
3、查詢規則：
[root@zabbix_server ~]# iptables --line -nvL INPUT Chain INPUT (policy DROP 20 packets, 1004 bytes) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0 tcp dpt:8075 2 0 0 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8075 3 145M 15G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 4 4039 214K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 5 3 156 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25601 6 4096 219K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 7 22660 1170K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3306 8 264K 14M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:9000 9 443K 23M ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:10050
規則已經添加，測試
[root@zabbix_server ~]# telnet 127.0.0.1 8075 Trying 127.0.0.1... Connected to 127.0.0.1. Escape character is '^]'.
本機可以訪問8075,其他機器上不能訪問8075
[root@localhost etc]# telnet 172.28.18.75 8075
Trying 172.28.18.75...
telnet: connect to address 172.28.18.75: Connection timed out
4、允許172.28.18.71可以訪問8075,(172.28.18.71是需要訪問8075的服務器)
[root@zabbix_server ~]# iptables -I INPUT -s 172.28.18.71 -p tcp --dport 8075 -j ACCEPT
查看規則
[root@zabbix_server ~]# iptables --line -nvL INPUT Chain INPUT (policy DROP 9 packets, 456 bytes) num pkts bytes target prot opt in out source destination 1 0 0 ACCEPT tcp -- * * 172.28.18.71 0.0.0.0/0 tcp dpt:8075 2 3 132 ACCEPT tcp -- * * 127.0.0.1 0.0.0.0/0 tcp dpt:8075 3 7 420 DROP tcp -- * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:8075 4 145M 15G ACCEPT all -- * * 0.0.0.0/0 0.0.0.0/0 state RELATED,ESTABLISHED 5 4040 214K ACCEPT icmp -- * * 0.0.0.0/0 0.0.0.0/0 6 3 156 ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:25601 7 4100 219K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:80 8 22674 1171K ACCEPT tcp -- * * 0.0.0.0/0 0.0.0.0/0 state NEW tcp dpt:3306
在172.28.18.71上測試telnet 8075
[root@localhost etc]# telnet 172.28.18.75 8075 Trying 172.28.18.75... Connected to 172.28.18.75. Escape character is '^]'.
訪問成功，保存規則
[root@zabbix_server ~]# service iptables save
iptables：將防火牆規則保存到 /etc/sysconfig/iptables：[確定]
重啟服務
[root@zabbix_server ~]# service iptables save iptables：將防火牆規則保存到 /etc/sysconfig/iptables：[確定] [root@zabbix_server ~]# service iptables restart iptables：將鏈設置為政策 ACCEPT：filter [確定] iptables：清除防火牆規則：[確定] iptables：正在卸載模塊：[確定] iptables：應用防火牆規則：[確定]