linux 방화벽 열기

ex ) 8080 포트 열기

[root@blogserver bin]# vi /etc/sysconfig/iptables

# Firewall configuration written by system-config-firewall
# Manual customization of this file is not recommended.
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT

-A INPUT -m state --state NEW -m tcp -p tcp --dport 8103 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 8080 -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT



[root@blogserver bin]#
[root@blogserver bin]# /etc/init.d/iptables restart
iptables: 방화벽 규칙을 지웁니다: [  OK  ]
iptables: chain을 ACCEPT 규칙으로 설정 중:  filter [  OK  ]
iptables: 모듈을 언로드하는 중: [  OK  ]
iptables: 방화벽 규칙 적용 중:  [  OK  ]
[root@blogserver bin]#
[root@blogserver bin]# /etc/init.d/iptables status
테이블: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination        
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED
2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0          
3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0          
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:8103
5    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:3306
6    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:21
7    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:8080 
8    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination        
1    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination        

[root@blogserver bin]#

방화벽 상태 알아보기
/sbin/service iptables status

방화벽 올리고 내리기
/sbin/service iptables stop
/sbin/service iptables start

특정 아이피 막기
iptables -A INPUT -s xx.xx.xx.xx -j DROP

특정 아이피 해제
iptables -D INPUT -s xx.xx.xx.xx -j DROP

특정 IP  웹  접속 차단
iptables -A INPUT -s xx.xx.xx.xx -p tcp --dport 80 -j DROP

해당 C class 웹 접속 차단
iptables -A INPUT -s 210.221.204.0/24 -p tcp --dport 80 -j DROP

[출처] http://pippen80.cafe24.com/271