CentOS7 修改默认防火墙firewalld为iptables

关闭默认firewalld：

systemctl stop firewalld      #关闭
systemctl restart firewalld   #重启
systemctl start firewalld     #开启

禁止开机启动firewalld

systemctl disable firewalld  #禁止
systemctl enable firewalld   #设置开机启动

安装iptables-services

yum install -y iptables-services

启动iptables

systemctl start iptables     #开启
systemctl stop iptables      #关闭
systemctl restart iptables   #重启

配置详情

cat /etc/sysconfig/iptables

[root@localhost network-scripts]# cat /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
[root@localhost network-scripts]# cat /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

配置命令

-A INPUT -m state –state NEW -m tcp -p tcp –dport 80 -j ACCEPT  #（允许80端口通过防火墙）  
-A INPUT -m state –state NEW -m tcp -p tcp –dport 3306 -j ACCEPT  #（允许3306端口通过防火墙）

设置开机启动iptables

systemctl enable iptables   #设置开机启动 
systemctl disable iptables  #禁止