#添加防火墻INPUT默認(rèn)規(guī)則,將所有發(fā)送到INPUT列數(shù)據(jù)包DROP掉
$ipt -P INPUT DROP
#清除防火墻filter中所有規(guī)則
$ipt -t filter -F
#允許192.168.1.30主機(jī)向防火墻發(fā)送ICMP數(shù)據(jù)包
$ipt -t filter -A INPUT -p icmp -s 192.168.1.30 -d $Server -j ACCEPT
#允許192.168.1.0網(wǎng)段主機(jī)訪問防火墻的web服務(wù)
$ipt -t filter -A INPUT -p tcp -s $network -d $Server --dport 80 -j ACCEPT
#允許192.168.1.0網(wǎng)段主機(jī)訪問防火墻的ftp服務(wù)
$ipt -t filter -A INPUT -p tcp -s $network -d $Server --dport 21 -j ACCEPT
$ipt -t filter -A INPUT -p tcp -s $network -d $Server --dport 20 -j ACCEPT
#允許192.168.1.0網(wǎng)段主機(jī)訪問防火墻的email服務(wù)
$ipt -t filter -A INPUT -p tcp -s $network -d $Server --dport 443 -j ACCEPT
$ipt -t filter -A INPUT -p tcp -s $network -d $Server --dport 110 -j ACCEPT
#允許192.168.1.30主機(jī)對防火墻進(jìn)行遠(yuǎn)程訪問
$ipt -t filter -A INPUT -p tcp -s 192.168.1.30 -d $Server --dport 22 -j ACCEPT
$ipt -t filter -A INPUT -p tcp -s 192.168.1.30 -d $Server --dport 23 -j ACCEPT
#允許所有協(xié)議狀態(tài)為ESTABLISHED,RELATED數(shù)據(jù)包通過
$ipt -t filter -A INPUT -p tcp -m state --state ESTABLISHED,RELATED -j ACCEPT
查看訪問規(guī)則
[root@linuxinfo ~]# iptables -t filter -L
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT icmp -- 192.168.1.30 linuxinfo
ACCEPT tcp -- 192.168.1.0/24 linuxinfo tcp dpt:http
ACCEPT tcp -- 192.168.1.0/24 linuxinfo tcp dpt:ftp
ACCEPT tcp -- 192.168.1.0/24 linuxinfo tcp dpt:ftp-data
ACCEPT tcp -- 192.168.1.0/24 linuxinfo tcp dpt:https
ACCEPT tcp -- 192.168.1.0/24 linuxinfo tcp dpt:pop3
ACCEPT tcp -- 192.168.1.30 linuxinfo tcp dpt:60000
ACCEPT tcp -- 192.168.1.30 linuxinfo tcp dpt:telnet
ACCEPT tcp -- anywhere anywhere state RELATED,ESTABLISHED
Chain FORWARD (policy ACCEPT)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
