Linux下设置防火墙白名单(RHEL 6和CentOS 7)的步骤

进入linux 命令行，编辑防火墙规则配置文件 iptables
vi /etc/sysconfig/iptables

下面是一个白名单设置的例子：

# firewall configuration written by system-config-securitylevel
# manual customization of this file is not recommended.
*filter
:input accept [0:0]
:forward accept [0:0]
:output accept [0:0]
:rh-firewall-1-input - [0:0]

-n whitelist
-a whitelist -s 10.202.106.1 -j accept
-a whitelist -s 10.202.106.2 -j accept
-a whitelist -s 10.202.106.3 -j accept
-a whitelist -s 10.202.106.4 -j accept
-a whitelist -s 10.202.106.5 -j accept
-a whitelist -s 10.202.106.6 -j accept
-a whitelist -s 10.202.106.7 -j accept

-a input -j rh-firewall-1-input
-a forward -j rh-firewall-1-input
-a rh-firewall-1-input -i lo -j accept
-a rh-firewall-1-input -p icmp --icmp-type any -j accept
-a rh-firewall-1-input -p 50 -j accept
-a rh-firewall-1-input -p 51 -j accept
-a rh-firewall-1-input -p udp --dport 5353 -d 224.0.0.251 -j accept
-a rh-firewall-1-input -p udp -m udp --dport 631 -j accept
-a rh-firewall-1-input -p tcp -m tcp --dport 631 -j accept
-a rh-firewall-1-input -m state --state established,related -j accept
-a rh-firewall-1-input -m state --state new -m tcp -p tcp --dport 22 -j accept
-a rh-firewall-1-input -m state --state new -m tcp -p tcp --dport 4750 -j accept
-a rh-firewall-1-input -m state --state new -m tcp -p tcp --dport 3306 -j whitelist
-a rh-firewall-1-input -j reject --reject-with icmp-host-prohibited

commit

其中设置白名单的部分为：

-n whitelist
-a whitelist -s 10.202.106.1 -j accept
-a whitelist -s 10.202.106.2 -j accept
-a whitelist -s 10.202.106.3 -j accept
-a whitelist -s 10.202.106.4 -j accept
-a whitelist -s 10.202.106.5 -j accept
-a whitelist -s 10.202.106.6 -j accept
-a whitelist -s 10.202.106.7 -j accept

使用白名单规则使用 j 参数指定：

-a rh-firewall-1-input -m state --state new -m tcp -p tcp --dport 3306 -j whitelist

以上这篇linux下设置防火墙白名单(rhel 6和centos 7)的步骤就是小编分享给大家的全部内容了，希望能给大家一个参考，也希望大家多多支持。