CentOS 7 默认是使用Firewall作为防火墙，这里我们把它改为我们熟悉的iptables！

[root@Centos7~]#iptables-vnL#看着很不舒服，改为我们习惯的iptables
ChainINPUT(policyACCEPT0packets,0bytes)
pktsbytestargetprotoptinoutsourcedestination
39434135ACCEPTall--**0.0.0.0/00.0.0.0/0ctstateRELATED,ESTABLISHED
00ACCEPTall--lo*0.0.0.0/00.0.0.0/0
828322INPUT_directall--**0.0.0.0/00.0.0.0/0
828322INPUT_ZONES_SOURCEall--**0.0.0.0/00.0.0.0/0
828322INPUT_ZONESall--**0.0.0.0/00.0.0.0/0
00ACCEPTicmp--**0.0.0.0/00.0.0.0/0
808218REJECTall--**0.0.0.0/00.0.0.0/0reject-withicmp-host-prohibited

ChainFORWARD(policyACCEPT0packets,0bytes)
pktsbytestargetprotoptinoutsourcedestination
00ACCEPTall--**0.0.0.0/00.0.0.0/0ctstateRELATED,ESTABLISHED
00ACCEPTall--lo*0.0.0.0/00.0.0.0/0
00FORWARD_directall--**0.0.0.0/00.0.0.0/0
00FORWARD_IN_ZONES_SOURCEall--**0.0.0.0/00.0.0.0/0
00FORWARD_IN_ZONESall--**0.0.0.0/00.0.0.0/0
00FORWARD_OUT_ZONES_SOURCEall--**0.0.0.0/00.0.0.0/0
00FORWARD_OUT_ZONESall--**0.0.0.0/00.0.0.0/0
00ACCEPTicmp--**0.0.0.0/00.0.0.0/0
00REJECTall--**0.0.0.0/00.0.0.0/0reject-withicmp-host-prohibited

ChainOUTPUT(policyACCEPT41packets,5963bytes)
pktsbytestargetprotoptinoutsourcedestination
33135720OUTPUT_directall--**0.0.0.0/00.0.0.0/0

ChainFORWARD_IN_ZONES(1references)
pktsbytestargetprotoptinoutsourcedestination
00FWDI_publicall--eno16777728*0.0.0.0/00.0.0.0/0[goto]
00FWDI_publicall--+*0.0.0.0/00.0.0.0/0[goto]

ChainFORWARD_IN_ZONES_SOURCE(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainFORWARD_OUT_ZONES(1references)
pktsbytestargetprotoptinoutsourcedestination
00FWDO_publicall--*eno167777280.0.0.0/00.0.0.0/0[goto]
00FWDO_publicall--*+0.0.0.0/00.0.0.0/0[goto]

ChainFORWARD_OUT_ZONES_SOURCE(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainFORWARD_direct(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainFWDI_public(2references)
pktsbytestargetprotoptinoutsourcedestination
00FWDI_public_logall--**0.0.0.0/00.0.0.0/0
00FWDI_public_denyall--**0.0.0.0/00.0.0.0/0
00FWDI_public_allowall--**0.0.0.0/00.0.0.0/0

ChainFWDI_public_allow(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainFWDI_public_deny(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainFWDI_public_log(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainFWDO_public(2references)
pktsbytestargetprotoptinoutsourcedestination
00FWDO_public_logall--**0.0.0.0/00.0.0.0/0
00FWDO_public_denyall--**0.0.0.0/00.0.0.0/0
00FWDO_public_allowall--**0.0.0.0/00.0.0.0/0

ChainFWDO_public_allow(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainFWDO_public_deny(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainFWDO_public_log(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainINPUT_ZONES(1references)
pktsbytestargetprotoptinoutsourcedestination
152IN_publicall--eno16777728*0.0.0.0/00.0.0.0/0[goto]
00IN_publicall--+*0.0.0.0/00.0.0.0/0[goto]

ChainINPUT_ZONES_SOURCE(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainINPUT_direct(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainIN_public(2references)
pktsbytestargetprotoptinoutsourcedestination
828322IN_public_logall--**0.0.0.0/00.0.0.0/0
828322IN_public_denyall--**0.0.0.0/00.0.0.0/0
828322IN_public_allowall--**0.0.0.0/00.0.0.0/0

ChainIN_public_allow(1references)
pktsbytestargetprotoptinoutsourcedestination
2104ACCEPTtcp--**0.0.0.0/00.0.0.0/0tcpdpt:22ctstateNEW

ChainIN_public_deny(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainIN_public_log(1references)
pktsbytestargetprotoptinoutsourcedestination

ChainOUTPUT_direct(1references)
pktsbytestargetprotoptinoutsourcedestination
[root@Centos7~]#yum-yinstalliptables#安装iptables，基本上都是存在的
[root@Centos7~]#yum-yinstalliptables-services#安装iptables-services服务
[root@Centos7~]#systemctlstopfirewalld.service#停止firealld服务
[root@Centos7~]#systemctldisablefirewalld.service#禁止firealld服务自动启动
Removedsymlink/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
Removedsymlink/etc/systemd/system/basic.target.wants/firewalld.service.
[root@Centos7~]#systemctlenableiptables.service#开启iptables自动启动
Createdsymlinkfrom/etc/systemd/system/basic.target.wants/iptables.serviceto/usr/lib/systemd/system/iptables.service.
[root@Centos7~]#systemctlstartiptables.service#开启iptables服务
[root@Centos7~]#iptables-vnL#使用iptables查看，胡三汉回来了！~
ChainINPUT(policyACCEPT0packets,0bytes)
pktsbytestargetprotoptinoutsourcedestination

ChainFORWARD(policyACCEPT0packets,0bytes)
pktsbytestargetprotoptinoutsourcedestination

ChainOUTPUT(policyACCEPT0packets,0bytes)
pktsbytestargetprotoptinoutsourcedestination
[root@Centos7~]#iptables-save#加载配置文件的规则
#Generatedbyiptables-savev1.4.21onSunOct2302:34:482016
*filter
:INPUTACCEPT[0:0]
:FORWARDACCEPT[0:0]
:OUTPUTACCEPT[121:22068]
-AINPUT-mstate--stateRELATED,ESTABLISHED-jACCEPT
-AINPUT-picmp-jACCEPT
-AINPUT-ilo-jACCEPT
-AINPUT-ptcp-mstate--stateNEW-mtcp--dport22-jACCEPT
-AINPUT-jREJECT--reject-withicmp-host-prohibited
-AFORWARD-jREJECT--reject-withicmp-host-prohibited
COMMIT
#CompletedonSunOct2302:34:482016
[root@Centos7~]#iptables-vnL#查看状态
ChainINPUT(policyACCEPT0packets,0bytes)
pktsbytestargetprotoptinoutsourcedestination
17913428ACCEPTall--**0.0.0.0/00.0.0.0/0stateRELATED,ESTABLISHED
00ACCEPTicmp--**0.0.0.0/00.0.0.0/0
00ACCEPTall--lo*0.0.0.0/00.0.0.0/0
00ACCEPTtcp--**0.0.0.0/00.0.0.0/0stateNEWtcpdpt:22
00REJECTall--**0.0.0.0/00.0.0.0/0reject-withicmp-host-prohibited

ChainFORWARD(policyACCEPT0packets,0bytes)
pktsbytestargetprotoptinoutsourcedestination
00REJECTall--**0.0.0.0/00.0.0.0/0reject-withicmp-host-prohibited

ChainOUTPUT(policyACCEPT135packets,23948bytes)
pktsbytestargetprotoptinoutsourcedestination
[root@Centos7~]#iptables-F#清空规则
[root@Centos7~]#iptables-save#保持规则
#Generatedbyiptables-savev1.4.21onSunOct2302:35:052016
*filter
:INPUTACCEPT[14:1096]
:FORWARDACCEPT[0:0]
:OUTPUTACCEPT[11:1156]
COMMIT
#CompletedonSunOct2302:35:052016
[root@Centos7~]#serviceiptablessave#也可以使用这个保持规则
iptables:Savingfirewallrulesto/etc/sysconfig/iptables:[OK]
[root@Centos7~]#