CentOS server iptables configuration simple tutorial

iptables is an important network security protection system tool for servers of class Linux. Considering that most servers are managed by special teams, server administrators can only manage remotely through SSH most of the time. To ensure the legal connection of SSH, the following configuration is required.

iptables -P INPUT ACCEPT
iptables -F
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT ACCEPT
iptables -L -v

This ensures that port 22 of SSH is used legally. Finally, service iptables save is executed and the configuration is saved.

cat /etc/sysconfig/iptables can be used to view the information of the iptables configuration file. In the future, you can directly edit the file to add or delete configuration entries.

The rule instructions for viewing iptables in action are: lsmod | grep ip_tables or iptables-L.

This site adds one more point: the simple attack iptables policy

#!/bin/sh
IPTABLES=/sbin/iptables



# clear
$IPTABLES -F

# if pkg type is allow, then accept
#$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT



#  If at the same time 80 The number of ports connected is greater than 10 , Drop Off the ip

netstat -an | grep :80 | awk -F: '{ print $8 }' | sort | uniq -c | awk -F\  '$1>10 && $2!="" { print $2 }' >> /etc/fw.list
less /etc/fw.list | sort | uniq -c | awk -F\  '$2!="" { print $2 }' > /etc/fw.list2
less /etc/fw.list2 > /etc/fw.list
while read line

    do
    t=`echo "$line"`
    $IPTABLES -A INPUT -p tcp -s $t -j DROP
done < /etc/fw.list2

# IP forwarding 
$IPTABLES -A INPUT -p tcp --dport 20002 -j ACCEPT
$IPTABLES -A INPUT -d 172.16.204.7 -p tcp -m tcp --dport 20002 -i eth0 -j ACCEPT
$IPTABLES -t nat -A PREROUTING -d 211.100.39.44 -p tcp -m tcp --dport 20002 -j DNAT --to-destination 172.16.204.7:20002
$IPTABLES -t nat -A POSTROUTING -d 172.16.204.7 -p tcp -m tcp --dport 20002 -j SNAT --to-source 10.6.39.44


# if pkg visit 80,7710 port then accept
$IPTABLES -A INPUT -p tcp --dport 80 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 8080 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 873 -j ACCEPT
# $IPTABLES -A INPUT -i eth0 -m limit --limit 1/sec --limit-burst 5 -j ACCEPT
$IPTABLES -A INPUT -p tcp --tcp-flags SYN,ACK,FIN,RST SYN -m limit --limit 30/m --limit-burst 2 -j ACCEPT
$IPTABLES -A FORWARD -p tcp --syn -m limit --limit 10/s -j ACCEPT
$IPTABLES -A FORWARD -f -m limit --limit 100/s --limit-burst 100 -j ACCEPT


# if pkg from allow ip then accept

$IPTABLES -A INPUT -p tcp -s 127.0.0.1  -j ACCEPT



# if pkg not above then deny

$IPTABLES -A INPUT -p tcp --syn -j DROP

 The following firewall test results are more correct, can play 1 Fixed anti - attack function 



#!/bin/sh

IPTABLES="/sbin/iptables"

echo "1" > /proc/sys/net/ipv4/ip_forward

$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
$IPTABLES -P OUTPUT DROP
$IPTABLES -F
$IPTABLES -X


$IPTABLES -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 22 -j ACCEPT
$IPTABLES -A INPUT -p tcp --dport 80 --tcp-flags SYN,ACK,FIN,RST SYN -m limit --limit 30/m --limit-burst 2 -j ACCEPT


$IPTABLES -A OUTPUT -p tcp -s 127.0.0.1 -j ACCEPT
$IPTABLES -A OUTPUT -p tcp -s 192.168.1.102 -j ACCEPT
$IPTABLES -A OUTPUT -p udp -s 127.0.0.1 -j ACCEPT
$IPTABLES -A OUTPUT -p udp -s 192.168.1.102 -j ACCEPT



$IPTABLES -A INPUT -p tcp --syn -j DROP