CentOS 7에서 iptables 사용

1. 기본인 firewalld를 중지하고 iptables를 설치한다.
systemctl status firewalld
systemctl stop firewalld
systemctl disable firewalld
yum install -y iptables-services
systemctl start iptables
systemctl enable iptables
systemctl is-enabled iptables

2. 방화벽 룰 스크립트를 작성한다.
mkdir /etc/iptables
vi /etc/iptables/setup.sh *아래는 작성 예
#!/bin/bash
#Network
LOCALNET=192.168.0.0/24
#F/W stop
systemctl stop iptables
#Initialize
iptables -F
iptables -X
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD DROP
#Loopback, Localnet, Chain Fragments
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -s $LOCALNET -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -f -j DROP
#PIng
iptables -N PINGBAN
iptables -A PINGBAN -m limit --limit 1/s --limit-burst 4 -j ACCEPT
iptables -A PINGBAN -j DROP
iptables -A INPUT -p icmp --icmp-type echo-request -j PINGBAN
#Cast
iptables -A INPUT -d 255.255.255.255 -j DROP
iptables -A INPUT -d 224.0.0.1 -j DROP
#AUTH
iptables -A INPUT -p tcp --dport 113 -j REJECT --reject-with tcp-reset
#SSH
iptables -A INPUT -p tcp --dport 22 -j ACCEPT
#WEB
iptables -A INPUT -p tcp --dport 80,443 -j ACCEPT
#FTP
iptables -A INPUT -p tcp --sport 20,21 -j ACCEPT
iptables -A INPUT -p tcp --dport 989,990 -j ACCEPT
iptables -A INPUT -p tcp --dport 5001:5050 -j ACCEPT
#SMTP
iptables -A INPUT -p tcp --dport 25,465 -j ACCEPT
#POP3
iptables -A INPUT -p tcp --dport 110,995 -j ACCEPT
#IMAP
iptables -A INPUT -p tcp --dport 143,993 -j ACCEPT
#SMB
iptables -A INPUT ! -s $LOCALNET -p tcp -m multiport --dports 135:139,445 -j ACCEPT
iptables -A INPUT ! -s $LOCALNET -p udp -m multiport --dports 135:139,445 -j ACCEPT
iptables -A OUTPUT ! -d $LOCALNET -p tcp -m multiport --sports 135:139,445 -j ACCEPT
iptables -A OUTPUT ! -d $LOCALNET -p udp -m multiport --sports 135:139,445 -j ACCEPT
#Save
/usr/libexec/iptables/iptables.init save
#F/W start
systemctl start iptables

3. 실행한다.
chmod 700 /etc/iptables/setup.sh
/etc/iptables/setup.sh