CentOS 7.7 配置防火墙

最新推荐文章于 2025-05-12 18:56:22 发布

shayuwei

最新推荐文章于 2025-05-12 18:56:22 发布

阅读量1.6k

点赞数

CC 4.0 BY-SA版权

分类专栏：笔记 Linux

本文链接：https://blog.youkuaiyun.com/shayuwei/article/details/103767823

笔记同时被 2 个专栏收录

164 篇文章

订阅专栏

Linux

30 篇文章

订阅专栏

本文详细记录了在CentOS系统中安装并配置iptables防火墙的过程，包括解决因iptables文件错误导致的服务启动失败问题，以及如何正确修改iptables配置文件以确保防火墙正常运行。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

新装完数据库后，想查看防火墙白名单，但是报错：

[root@weblog ~]# cat /etc/sysconfig/iptables
cat: /etc/sysconfig/iptables: No such file or directory

iptables的相关命令也说没有

[root@weblog ~]# service iptables status
Redirecting to /bin/systemctl status iptables.service
Unit iptables.service could not be found.
[root@weblog ~]# /bin/systemctl status iptables.service
Unit iptables.service could not be found.

查看sysconfig目录下的文件

[root@weblog ~]# cd /etc/sysconfig
[root@weblog sysconfig]# ll
total 184
-rw-r--r--. 1 root root  326 Dec 17 10:43 anaconda
-rw-r--r--. 1 root root  403 Oct 31  2018 atd
-rw-r--r--. 1 root root  484 Dec 17 10:42 authconfig
-rw-r--r--. 1 root root  339 Aug  8 20:06 autofs
drwxr-xr-x. 2 root root   55 Dec 17 10:53 cbq
-rw-r--r--. 1 root root  105 Aug  9 08:14 cgred
-rw-r--r--. 1 root root   46 Aug  8 19:40 chronyd
drwxr-xr-x. 2 root root   10 Aug  9 07:52 console
-rw-r--r--. 1 root root  150 Dec  7 00:00 cpupower
-rw-------. 1 root root  110 Aug  9 07:07 crond
-rw-------. 1 root root 1390 Apr 11  2018 ebtables-config
-rw-r--r--. 1 root root  169 Mar 14  2019 fcoe
-rw-r--r--. 1 root root   73 Oct 19 00:02 firewalld
lrwxrwxrwx. 1 root root   15 Dec 17 10:55 grub -> ../default/grub
-rw-r--r--. 1 root root  798 Aug  9 07:52 init
-rw-------. 1 root root 2134 Aug  8 19:41 ip6tables-config
-rw-------. 1 root root 2116 Aug  8 19:41 iptables-config
-rw-r--r--. 1 root root  903 Aug  6 21:44 irqbalance
-rw-r--r--. 1 root root 1733 Aug  8 19:41 kdump
-rw-r--r--. 1 root root  180 Dec 17 10:42 kernel
-rw-r--r--. 1 root root  168 Sep 14 00:40 ksm
-rw-r--r--. 1 root root 1136 Dec  3 01:48 libvirtd
-rw-r--r--. 1 root root  200 Oct 30  2018 man-db
drwxr-xr-x. 2 root root   10 Aug  9 07:52 modules
-rw-r--r--. 1 root root  634 Aug  9 07:52 netconsole
-rw-r--r--. 1 root root   22 Dec 17 10:55 network
drwxr-xr-x. 2 root root 4096 Dec 17 10:55 network-scripts
-rw-r--r--. 1 root root 1679 Aug  9 09:16 nfs
-rw-r--r--. 1 root root   45 Aug  6 21:44 ntpd
-rw-r--r--. 1 root root  111 Aug  6 21:44 ntpdate
-rw-r--r--. 1 root root  911 Aug  6 21:44 qemu-ga
-rw-r--r--. 1 root root  186 Oct 31  2018 radvd
-rw-r--r--. 1 root root 2915 Aug  6 21:44 raid-check
-rw-r--r--. 1 root root   15 Aug  4  2017 rdisc
-rw-r--r--. 1 root root  905 Aug  9 07:52 readonly-root
-rw-r--r--. 1 root root   73 Aug  8 20:12 rpcbind
-rw-r--r--. 1 root root  395 Aug  6 21:44 rpc-rquotad
-rw-r--r--. 1 root root   12 Apr 26  2019 rsyncd
-rw-r--r--. 1 root root  196 Oct 18 23:48 rsyslog
-rw-r--r--. 1 root root    0 Jun 10  2014 run-parts
-rw-r--r--. 1 root root  428 Dec  3 01:48 samba
-rw-r--r--. 1 root root  429 Apr 11  2018 saslauthd
lrwxrwxrwx. 1 root root   17 Dec 17 10:35 selinux -> ../selinux/config
-rw-r--r--. 1 root root  125 Aug  6 21:44 smartmontools
-rw-r-----. 1 root root  506 Aug  9 09:40 sshd
-rw-r--r--. 1 root root  138 Apr 11  2018 svnserve
-rw-r--r--. 1 root root  474 Aug  9 10:54 sysstat
-rw-r--r--. 1 root root 6228 Aug  9 10:54 sysstat.ioconf
-rw-r--r--. 1 root root   55 Dec  3 01:48 virtlockd
-rw-r--r--. 1 root root   53 Dec  3 01:48 virtlogd
-rw-r--r--. 1 root root  610 Oct 31  2018 wpa_supplicant

确实没有iptables，原因是需要安装iptables-services包

[root@weblog sysconfig]# yum install iptables-services
Loaded plugins: fastestmirror, langpacks
Repository base is listed more than once in the configuration
Repository updates is listed more than once in the configuration
Repository extras is listed more than once in the configuration
Repository centosplus is listed more than once in the configuration
Loading mirror speeds from cached hostfile
* base: mirror.bit.edu.cn
* extras: mirror.bit.edu.cn
* updates: mirrors.huaweicloud.com
base                                                                                          | 3.6 kB  00:00:00     
extras                                                                                        | 2.9 kB  00:00:00     
updates                                                                                       | 2.9 kB  00:00:00     
Resolving Dependencies
--> Running transaction check
---> Package iptables-services.x86_64 0:1.4.21-33.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

=====================================================================================================================
Package                           Arch                   Version                         Repository            Size
=====================================================================================================================
Installing:
iptables-services                 x86_64                 1.4.21-33.el7                   base                  52 k

Transaction Summary
=====================================================================================================================
Install  1 Package

Total download size: 52 k
Installed size: 22 k
Is this ok [y/d/N]: y
Downloading packages:
iptables-services-1.4.21-33.el7.x86_64.rpm                                                    |  52 kB  00:00:00     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : iptables-services-1.4.21-33.el7.x86_64                                                            1/1
  Verifying  : iptables-services-1.4.21-33.el7.x86_64                                                            1/1

Installed:
  iptables-services.x86_64 0:1.4.21-33.el7                                                                           

Complete!

安装好iptables之后，sysconfig目录下就有iptables文件了

[root@weblog sysconfig]# ll
total 192
-rw-r--r--. 1 root root  326 Dec 17 10:43 anaconda
-rw-r--r--. 1 root root  403 Oct 31  2018 atd
-rw-r--r--. 1 root root  484 Dec 17 10:42 authconfig
-rw-r--r--. 1 root root  339 Aug  8 20:06 autofs
drwxr-xr-x. 2 root root   55 Dec 17 10:53 cbq
-rw-r--r--. 1 root root  105 Aug  9 08:14 cgred
-rw-r--r--. 1 root root   46 Aug  8 19:40 chronyd
drwxr-xr-x. 2 root root   10 Aug  9 07:52 console
-rw-r--r--. 1 root root  150 Dec  7 00:00 cpupower
-rw-------. 1 root root  110 Aug  9 07:07 crond
-rw-------. 1 root root 1390 Apr 11  2018 ebtables-config
-rw-r--r--. 1 root root  169 Mar 14  2019 fcoe
-rw-r--r--. 1 root root   73 Oct 19 00:02 firewalld
lrwxrwxrwx. 1 root root   15 Dec 17 10:55 grub -> ../default/grub
-rw-r--r--. 1 root root  798 Aug  9 07:52 init
-rw-------  1 root root  635 Aug  8 19:41 ip6tables
-rw-------. 1 root root 2134 Aug  8 19:41 ip6tables-config
-rw-------  1 root root  550 Aug  8 19:41 iptables
-rw-------. 1 root root 2116 Aug  8 19:41 iptables-config
-rw-r--r--. 1 root root  903 Aug  6 21:44 irqbalance
-rw-r--r--. 1 root root 1733 Aug  8 19:41 kdump
-rw-r--r--. 1 root root  180 Dec 17 10:42 kernel
-rw-r--r--. 1 root root  168 Sep 14 00:40 ksm
-rw-r--r--. 1 root root 1136 Dec  3 01:48 libvirtd
-rw-r--r--. 1 root root  200 Oct 30  2018 man-db
drwxr-xr-x. 2 root root   10 Aug  9 07:52 modules
-rw-r--r--. 1 root root  634 Aug  9 07:52 netconsole
-rw-r--r--. 1 root root   22 Dec 17 10:55 network
drwxr-xr-x. 2 root root 4096 Dec 17 10:55 network-scripts
-rw-r--r--. 1 root root 1679 Aug  9 09:16 nfs
-rw-r--r--. 1 root root   45 Aug  6 21:44 ntpd
-rw-r--r--. 1 root root  111 Aug  6 21:44 ntpdate
-rw-r--r--. 1 root root  911 Aug  6 21:44 qemu-ga
-rw-r--r--. 1 root root  186 Oct 31  2018 radvd
-rw-r--r--. 1 root root 2915 Aug  6 21:44 raid-check
-rw-r--r--. 1 root root   15 Aug  4  2017 rdisc
-rw-r--r--. 1 root root  905 Aug  9 07:52 readonly-root
-rw-r--r--. 1 root root   73 Aug  8 20:12 rpcbind
-rw-r--r--. 1 root root  395 Aug  6 21:44 rpc-rquotad
-rw-r--r--. 1 root root   12 Apr 26  2019 rsyncd
-rw-r--r--. 1 root root  196 Oct 18 23:48 rsyslog
-rw-r--r--. 1 root root    0 Jun 10  2014 run-parts
-rw-r--r--. 1 root root  428 Dec  3 01:48 samba
-rw-r--r--. 1 root root  429 Apr 11  2018 saslauthd
lrwxrwxrwx. 1 root root   17 Dec 17 10:35 selinux -> ../selinux/config
-rw-r--r--. 1 root root  125 Aug  6 21:44 smartmontools
-rw-r-----. 1 root root  506 Aug  9 09:40 sshd
-rw-r--r--. 1 root root  138 Apr 11  2018 svnserve
-rw-r--r--. 1 root root  474 Aug  9 10:54 sysstat
-rw-r--r--. 1 root root 6228 Aug  9 10:54 sysstat.ioconf
-rw-r--r--. 1 root root   55 Dec  3 01:48 virtlockd
-rw-r--r--. 1 root root   53 Dec  3 01:48 virtlogd
-rw-r--r--. 1 root root  610 Oct 31  2018 wpa_supplicant

[root@weblog sysconfig]# cat /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

添加白名单

[root@weblog sysconfig]# vi iptables

但是启动服务时报错

[root@weblog sysconfig]# service iptables restart
Redirecting to /bin/systemctl restart iptables.service
Job for iptables.service failed because the control process exited with error code. See "systemctl status iptables.service" and "journalctl -xe" for details.

尝试重启服务

[root@weblog sysconfig]# /bin/systemctl restart iptables.service
Job for iptables.service failed because the control process exited with error code. See "systemctl status iptables.service" and "journalctl -xe" for details.
[root@weblog sysconfig]# systemctl enable iptables
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
[root@weblog sysconfig]# systemctl start iptables
Job for iptables.service failed because the control process exited with error code. See "systemctl status iptables.service" and "journalctl -xe" for details.
[root@weblog sysconfig]# systemctl status iptables.service
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Wed 2019-12-18 09:45:45 CST; 24s ago
  Process: 9126 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=1/FAILURE)
Main PID: 9126 (code=exited, status=1/FAILURE)

Dec 18 09:45:45 weblog systemd[1]: Starting IPv4 firewall with iptables...
Dec 18 09:45:45 weblog iptables.init[9126]: iptables: Applying firewall rules: iptables-restore: line 15 failed
Dec 18 09:45:45 weblog iptables.init[9126]: [FAILED]
Dec 18 09:45:45 weblog systemd[1]: iptables.service: main process exited, code=exited, status=1/FAILURE
Dec 18 09:45:45 weblog systemd[1]: Failed to start IPv4 firewall with iptables.
Dec 18 09:45:45 weblog systemd[1]: Unit iptables.service entered failed state.
Dec 18 09:45:45 weblog systemd[1]: iptables.service failed.

原因是active的状态是failed，查找资料，原来是需要开启filewall服务

[root@weblog sysconfig]# service iptables start
Redirecting to /bin/systemctl start iptables.service
Job for iptables.service failed because the control process exited with error code. See "systemctl status iptables.service" and "journalctl -xe" for details.
[root@weblog sysconfig]# systemctl start firewalld.service
[root@weblog sysconfig]# service iptables start
Redirecting to /bin/systemctl start iptables.service
Job for iptables.service failed because the control process exited with error code. See "systemctl status iptables.service" and "journalctl -xe" for details.

但是依旧报错

[root@weblog sysconfig]# systemctl start iptables
Job for iptables.service failed because the control process exited with error code. See "systemctl status iptables.service" and "journalctl -xe" for details.
[root@weblog sysconfig]# journalctl -xe
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit iptables.service has failed.
--
-- The result is failed.
Dec 18 09:48:37 weblog systemd[1]: Unit iptables.service entered failed state.
Dec 18 09:48:37 weblog systemd[1]: iptables.service failed.
Dec 18 09:48:37 weblog polkitd[2152]: Unregistered Authentication Agent for unix-process:9521:8187404 (system bus nam
Dec 18 09:49:24 weblog polkitd[2152]: Registered Authentication Agent for unix-process:9597:8192106 (system bus name
Dec 18 09:49:24 weblog systemd[1]: Starting IPv4 firewall with iptables...
-- Subject: Unit iptables.service has begun start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit iptables.service has begun starting up.
Dec 18 09:49:24 weblog iptables.init[9603]: iptables: Applying firewall rules: iptables-restore: line 15 failed
Dec 18 09:49:24 weblog iptables.init[9603]: [FAILED]
Dec 18 09:49:24 weblog systemd[1]: iptables.service: main process exited, code=exited, status=1/FAILURE
Dec 18 09:49:24 weblog systemd[1]: Failed to start IPv4 firewall with iptables.
-- Subject: Unit iptables.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit iptables.service has failed.
--
-- The result is failed.
Dec 18 09:49:24 weblog systemd[1]: Unit iptables.service entered failed state.
Dec 18 09:49:24 weblog systemd[1]: iptables.service failed.
Dec 18 09:49:24 weblog polkitd[2152]: Unregistered Authentication Agent for unix-process:9597:8192106 (system bus nam
Dec 18 09:50:01 weblog systemd[1]: Started Session 174 of user root.
-- Subject: Unit session-174.scope has finished start-up
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit session-174.scope has finished starting up.
--
-- The start-up result is done.
Dec 18 09:50:01 weblog CROND[9648]: (root) CMD (/usr/lib64/sa/sa1 1 1)

从这里可以看出是iptables文件错误，修改iptables文件后重新启动iptables服务

[root@weblog network-scripts]# cd /etc/sysconfig/
[root@weblog sysconfig]# mv iptables iptables.bak
[root@weblog sysconfig]# vi iptables
[root@weblog sysconfig]# service iptables restart
Redirecting to /bin/systemctl restart iptables.service
[root@weblog sysconfig]# systemctl restart iptables.service
[root@weblog sysconfig]# systemctl status iptables.service
● iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
   Active: active (exited) since Wed 2019-12-18 09:56:07 CST; 7s ago
  Process: 10072 ExecStop=/usr/libexec/iptables/iptables.init stop (code=exited, status=0/SUCCESS)
  Process: 10092 ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=0/SUCCESS)
Main PID: 10092 (code=exited, status=0/SUCCESS)

Dec 18 09:56:07 weblog systemd[1]: Starting IPv4 firewall with iptables...
Dec 18 09:56:07 weblog iptables.init[10092]: iptables: Applying firewall rules: [  OK  ]
Dec 18 09:56:07 weblog systemd[1]: Started IPv4 firewall with iptables.

文件出错时之前没想到的，iptables文件的内容是根据别的服务器的文件配的，但是格式不一样了。CentoOS 7.7和6.9的格式一样

命令	内容
systemctl start firewalld.service	启动
systemctl enable firewalld.service	开机启动
systemctl stop firewalld.service	停止
systemctl disable firewalld.service	禁止开机启动
systemctl status firewalld.service	查看状态