基本的なiptablesの設定方法です
すべてのチェインの中身を削除する
/sbin/iptables -K
ユーザー定義チェインを削除する
/sbin/iptables -X
/sbin/iptables -A INPUT -i lo -j ACCEPT /sbin/iptables -A INPUT -p icmp --icmp-type any -j ACCEPT /sbin/iptables -A INPUT -p 50 -j ACCEPT /sbin/iptables -A INPUT -p 51 -j ACCEPT /sbin/iptables -A INPUT -p udp --dport 5353 -d 224.0.0.251 -j ACCEPT /sbin/iptables -A INPUT -p udp -m udp --dport 631 -j ACCEPT /sbin/iptables -A INPUT -p tcp -m tcp --dport 631 -j ACCEPT /sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 20 -j ACCEPT /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 10022 -j ACCEPT /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 25 -j ACCEPT /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 443 -j ACCEPT /sbin/iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 4949 -j ACCEPT /sbin/iptables -A INPUT -m limit --limit 1/s -j LOG --log-prefix "[IPTABLES INPUT] : " /sbin/iptables -A INPUT -j REJECT --reject-with icmp-host-prohibited
設定の確認
# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere icmp any ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ACCEPT udp -- anywhere anywhere udp dpt:ipp ACCEPT tcp -- anywhere anywhere tcp dpt:ipp ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp-data ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ftp ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:ssh ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:10022 ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:smtp ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:http ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:https ACCEPT tcp -- anywhere anywhere state NEW tcp dpt:munin LOG all -- anywhere anywhere limit: avg 1/sec burst 5 LOG level warning prefix `[IPTABLES INPUT] : ' REJECT all -- anywhere anywhere reject-with icmp-host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination Chain OUTPUT (policy ACCEPT) target prot opt source destination
設定内容を保存します
service iptables save
iptablesを再起動します
service iptables restart