配置Cento6.4 iptables防火墙。

1. 查看防火墙状态

serviceiptablesstatus
#或/etc/init.d/iptablesstatus

2.关闭 /开启/重启防火墙

#serviceiptablesstop
#serviceiptablesstart
#serviceiptablesrestart

4.永久关闭防火墙

#chkconfig--level35iptablesoff

然后重启系统使其生效：

# shutdown-rnow

5.设置开启80端口访问

>先查看防火墙状态：

[root@localhost Nginx]# service iptables status

Table: filter
Chain INPUT (policy ACCEPT)
num target   prot opt source        destination    
1  ACCEPT   all -- 0.0.0.0/0      0.0.0.0/0      state RELATED,ESTABLISHED
2  ACCEPT   icmp -- 0.0.0.0/0      0.0.0.0/0     
3  ACCEPT   all -- 0.0.0.0/0      0.0.0.0/0     
4  ACCEPT   tcp -- 0.0.0.0/0      0.0.0.0/0      state NEW tcp dpt:22
5  REJECT   all -- 0.0.0.0/0      0.0.0.0/0      reject-with icmp-host-prohibited


Chain FORWARD (policy ACCEPT)
num target   prot opt source        destination    
1  REJECT   all -- 0.0.0.0/0      0.0.0.0/0      reject-with icmp-host-prohibited


Chain OUTPUT (policy ACCEPT)
num target   prot opt source        destination 

>设置80端口（或者手动修改/etc/sysconfig/iptables）

[root@localhost ~]# /sbin/iptables -I INPUT -p tcp --dport 80 -j ACCEPT
You have new mail in /var/spool/mail/root

#保存设置

[root@localhost ~]# /etc/rc.d/init.d/iptables save
iptables: Saving firewall rules to /etc/sysconfig/iptables: [ OK ]

>再查看防火墙状态

[root@localhost ~]# service iptables status
Table: filter
Chain INPUT (policy ACCEPT)
num target   prot opt source        destination    
1  ACCEPT   tcp -- 0.0.0.0/0      0.0.0.0/0      tcp dpt:80
2  ACCEPT   all -- 0.0.0.0/0      0.0.0.0/0      state RELATED,ESTABLISHED
3  ACCEPT   icmp -- 0.0.0.0/0      0.0.0.0/0     
4  ACCEPT   all -- 0.0.0.0/0      0.0.0.0/0     
5  ACCEPT   tcp -- 0.0.0.0/0      0.0.0.0/0      state NEW tcp dpt:22
6  REJECT   all -- 0.0.0.0/0      0.0.0.0/0      reject-with icmp-host-prohibited


Chain FORWARD (policy ACCEPT)
num target   prot opt source        destination    
1  REJECT   all -- 0.0.0.0/0      0.0.0.0/0      reject-with icmp-host-prohibited


Chain OUTPUT (policy ACCEPT)
num target   prot opt source        destination

>设置80端口--修改/etc/sysconfig/iptables配置文件

[root@localhost~]#vi/etc/sysconfig/iptables
#添加下面内容
-AINPUT-ptcp-mstate--stateNEW-mtcp--dport80-jACCEPT

最后重启防火墙使配置生效。

service iptables restart