CNDBA社区
现在云主机的使用率越来越高，安装问题也越来越重要，目前云主机的Linux系统默认都是没有安装防火墙的，所以在购买云主机后，第一件事就是安装并配置防火墙，否则就等于裸奔。具体配置如下。
安装防火墙
[root@cndba.cn ~]# yum install iptables Loaded plugins: fastestmirror, security Loading mirror speeds from cached hostfile Setting up Install Process Resolving Dependencies --> Running transaction check ---> Package iptables.x86_64 0:1.4.7-11.el6 will be updated --> Processing Dependency: iptables = 1.4.7-11.el6 for package: iptables-ipv6-1.4.7-11.el6.x86_64 ---> Package iptables.x86_64 0:1.4.7-16.el6 will be an update --> Running transaction check ---> Package iptables-ipv6.x86_64 0:1.4.7-11.el6 will be updated ---> Package iptables-ipv6.x86_64 0:1.4.7-16.el6 will be an update --> Finished Dependency Resolution Dependencies Resolved ============================================================================================================= Package Arch Version Repository Size ============================================================================================================= Updating: iptables x86_64 1.4.7-16.el6 os 254 k Updating for dependencies: iptables-ipv6 x86_64 1.4.7-16.el6 os 103 k Transaction Summary ============================================================================================================= Upgrade 2 Package(s) Total download size: 357 k Is this ok [y/N]: y Downloading Packages: (1/2): iptables-1.4.7-16.el6.x86_64.rpm | 254 kB 00:00 (2/2): iptables-ipv6-1.4.7-16.el6.x86_64.rpm | 103 kB 00:00 ------------------------------------------------------------------------------------------------------------- Total 1.0 MB/s | 357 kB 00:00 Running rpm_check_debug Running Transaction Test Transaction Test Succeeded Running Transaction Updating : iptables-1.4.7-16.el6.x86_64 1/4 Updating : iptables-ipv6-1.4.7-16.el6.x86_64 2/4 Cleanup : iptables-ipv6-1.4.7-11.el6.x86_64 3/4 Cleanup : iptables-1.4.7-11.el6.x86_64 4/4 Verifying : iptables-1.4.7-16.el6.x86_64 1/4 Verifying : iptables-ipv6-1.4.7-16.el6.x86_64 2/4 Verifying : iptables-1.4.7-11.el6.x86_64 3/4 Verifying : iptables-ipv6-1.4.7-11.el6.x86_64 4/4 Updated: iptables.x86_64 0:1.4.7-16.el6 Dependency Updated: iptables-ipv6.x86_64 0:1.4.7-16.el6 Complete! [root@cndba.cn ~]# service iptables status iptables: Firewall is not running. [root@cndba.cn ~]# service iptables start iptables: Applying firewall rules: [ OK ]
修改防火墙开机自启动：
[root@cndba.cn ~]# chkconfig iptables on [root@cndba.cn ~]# chkconfig --list iptables iptables 0:off1:off2:on3:on4:on5:on6:off
查看防火墙默认规则文件：
[root@cndba.cn ~]# cat /etc/sysconfig/iptables # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] #-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT #-A INPUT -p icmp -j ACCEPT #-A INPUT -i lo -j ACCEPT #-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT #-A INPUT -j REJECT --reject-with icmp-host-prohibited #-A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT [root@cndba.cn ~]#
修改防火墙规则：
[root@cndba.cn ~]# cat /etc/sysconfig/iptables # Firewall configuration written by system-config-firewall # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p icmp -j ACCEPT -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m tcp --dport 1024 -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT -A INPUT -j REJECT --reject-with icmp-host-prohibited -A FORWARD -j REJECT --reject-with icmp-host-prohibited COMMIT [root@cndba.cn ~]#
重启防火墙：
[root@cndba.cn ~]# service iptables restart iptables: Setting chains to policy ACCEPT: filter [ OK ] iptables: Flushing firewall rules: [ OK ] iptables: Unloading modules: [ OK ] iptables: Applying firewall rules: [ OK ]
晚上以上操作就解决了防火墙问题，当然从安全角度，还需要禁ping 和修改SSH 端口。
禁止ping 服务器IP：
[root@cndba.cn ~]# echo 1 > /proc/sys/net/ipv4/icmp_echo_ignore_all [root@cndba.cn ~]# cat /proc/sys/net/ipv4/icmp_echo_ignore_all 1
修改SSH 连接端口：
修改/etc/ssh/ssh_config 和/etc/ssh/sshd_config 文件，
取消Port前的#注释，并将端口22改成8888
然后重启SSH即可：
[root@cndba.cn ~]# service sshd restart Stopping sshd: [ OK ] Starting sshd: [ OK ] [root@cndba.cn ~]#
版权声明：本文为博主原创文章，未经博主允许不得转载。
