centos7防火墙iptables
修改默认端口22
1
| vim /etc/ssh/sshd_config
|
注释
#Port 22
下面添加这一行
重启ssh
1
| systemctl restart sshd.service
|
关闭firewall
1 2
| systemctl stop firewalld systemctl mask firewalld
|
安装iptables
1 2 3 4 5
| yum install -y iptables yum update iptables yum install -y iptables-services systemctl enable iptables.service systemctl start iptables.service
|
其他
1 2 3 4 5 6 7
| vim /etc/sysconfig/iptables
service iptables save
systemctl restart iptables.service
service docker restart
|
完整脚本
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38
| cat >> /usr/local/bin/fired.sh <<'EOF' #!/bin/bash
iptables -P INPUT ACCEPT iptables -F iptables -X iptables -Z iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p tcp --dport 61900 -j ACCEPT iptables -A INPUT -p tcp --dport 21 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 63791 -j ACCEPT iptables -A INPUT -p tcp --dport 33061 -j ACCEPT iptables -A INPUT -p tcp --dport 23751 -j ACCEPT iptables -A INPUT -p tcp --dport 5673 -j ACCEPT iptables -A INPUT -p tcp --dport 9000 -j ACCEPT
iptables -A INPUT -p tcp --dport 2376 -j ACCEPT iptables -A INPUT -p tcp --dport 2377 -j ACCEPT iptables -A INPUT -p tcp --dport 7946 -j ACCEPT iptables -A INPUT -p udp --dport 7946 -j ACCEPT iptables -A INPUT -p tcp --dport 4789 -j ACCEPT iptables -A INPUT -p udp --dport 4789 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP
service iptables save systemctl restart iptables.service systemctl restart docker sudo chmod 666 /var/run/docker.sock EOF chmod +x /usr/local/bin/fired.sh
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35
| cat >> /usr/local/bin/fired.sh <<'EOF' #!/bin/bash
iptables -P INPUT ACCEPT iptables -F iptables -X iptables -Z iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p tcp --dport 61900 -j ACCEPT iptables -A INPUT -p tcp --dport 21 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 23751 -j ACCEPT iptables -A INPUT -p tcp --dport 9000 -j ACCEPT
iptables -A INPUT -p tcp --dport 2376 -j ACCEPT iptables -A INPUT -p tcp --dport 2377 -j ACCEPT iptables -A INPUT -p tcp --dport 7946 -j ACCEPT iptables -A INPUT -p udp --dport 7946 -j ACCEPT iptables -A INPUT -p tcp --dport 4789 -j ACCEPT iptables -A INPUT -p udp --dport 4789 -j ACCEPT
iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP
service iptables save systemctl restart iptables.service systemctl restart docker sudo chmod 666 /var/run/docker.sock EOF chmod +x /usr/local/bin/fired.sh
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28
| cat >> /usr/local/bin/fired.sh <<'EOF' #!/bin/bash
iptables -P INPUT ACCEPT iptables -F iptables -X iptables -Z iptables -A INPUT -i lo -j ACCEPT iptables -A INPUT -p tcp --dport 61900 -j ACCEPT iptables -A INPUT -p tcp --dport 21 -j ACCEPT iptables -A INPUT -p tcp --dport 80 -j ACCEPT iptables -A INPUT -p tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 23751 -j ACCEPT iptables -A INPUT -p tcp --dport 9000 -j ACCEPT iptables -A INPUT -p icmp --icmp-type 8 -j ACCEPT iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT iptables -P INPUT DROP iptables -P OUTPUT ACCEPT iptables -P FORWARD DROP
service iptables save systemctl restart iptables.service systemctl restart docker sudo chmod 666 /var/run/docker.sock EOF chmod +x /usr/local/bin/fired.sh
|
jenkins赋权
1
| sudo chmod 666 /var/run/docker.sock
|
加入开机启动项
1 2 3 4 5 6 7 8
| cat >> /etc/rc.d/rc.local <<EOF # Firewall & Docker /usr/bin/systemctl start iptables.service /usr/local/bin/fired.sh /usr/bin/systemctl start docker EOF
chmod +x /etc/rc.d/rc.local
|
https://www.centos.bz/2018/01/centos-7-docker-%E9%98%B2%E7%81%AB%E5%A2%99%E7%AE%80%E5%8D%95%E9%85%8D%E7%BD%AE/
https://kknews.cc/code/j4yl8py.html