centos7下部署iptables环境纪录，关闭默认的firewalle

下面介绍centos7关闭firewall安装iptables，并且开启80端口、3306端口的操作记录：

[root@localhost ~]# cat /etc/redhat-release

CentOS Linux release 7.2.1511 (Core)

1、关闭firewall：

[root@localhost ~]# systemctl stop firewalld.service //停止firewall

[root@localhost ~]# systemctl disable firewalld.service //禁止firewall开机启动

2、安装iptables防火墙

[root@localhost ~]# yum install iptables-services //安装

[root@localhost ~]# vim /etc/sysconfig/iptables //编辑防火墙配置文件

# Firewall configuration written by system-config-firewall

# Manual customization of this file is not recommended.

*filter

:INPUT ACCEPT [0:0]

:FORWARD ACCEPT [0:0]

:OUTPUT ACCEPT [0:0]

-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

[root@localhost ~]# systemctl restart iptables.service //最后重启防火墙使配置生效

[root@localhost ~]# systemctl enable iptables.service //设置防火墙开机启动

防止DoS攻击

iptables -A INPUT -p tcp --dport 80 -m limit --limit 25/minute --limit-burst 100 -j ACCEPT

-m limit: 启用limit扩展，限制速度。

--limit 25/minute: 允许最多每分钟25个连接

--limit-burst 100: 当达到100个连接后，才启用上述25/minute限制

--icmp-type 8 表示 Echo request——回显请求（Ping请求）。下面表示本机ping主机192.168.1.109时候的限速设置：

iptables -I INPUT -d 192.168.1.109 -p icmp --icmp-type 8 -m limit --limit 3/minute --limit-burst 5 -j ACCEPT