blocks|key|5370047|text|CentOS+7现在正在使用FirewallD！使用--permanent标志保存设置。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5370048|示例：|5370049|firewall-cmd+--zone=public+--add-port=3000/tcp+--permanent|code-block|syntax|javascript|5370050|然后重新加载规则：|5370051|firewall-cmd+--reload|entityMap|0|LINK|mutability|MUTABLE|url|http://www.firewalld.org/^0|Q|B|E|9|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|X|8|@$9|Y|A|Z|B|C]]|D|@$9|10|A|11|1|12]]|E|$]]|$1|F|3|G|5|6|7|13|8|@]|D|@]|E|$]]|$1|H|3|I|5|J|7|14|8|@]|D|@]|E|$K|L]]|$1|M|3|N|5|6|7|15|8|@]|D|@]|E|$]]|$1|O|3|P|5|J|7|16|8|@]|D|@]|E|$K|L]]]|Q|$R|$5|S|T|U|E|$V|W]]]]

CentOS 7 is using <a href="http://www.firewalld.org/" rel="nofollow noreferrer">FirewallD</a> now! Use the <code>--permanent</code> flag to save settings.
Example:
<pre><code>firewall-cmd --zone=public --add-port=3000/tcp --permanent
</code></pre>
Then reload rules:
<pre><code>firewall-cmd --reload
</code></pre>

blocks|key|5370256|text|通过以下命令禁用firewalld：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5370257|systemctl+disable+firewalld|code-block|syntax|javascript|5370258|然后通过以下命令安装iptables-service：|5370259|yum+install+iptables-services|5370260|然后启用iptable作为服务：|5370261|systemctl+enable+iptables|5370262|现在，您可以通过以下命令保存您的iptable规则：|5370263|service+iptables+save|entityMap^0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|T|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|U|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|V|8|@]|9|@]|A|$]]|$1|I|3|J|5|D|7|W|8|@]|9|@]|A|$E|F]]|$1|K|3|L|5|6|7|X|8|@]|9|@]|A|$]]|$1|M|3|N|5|D|7|Y|8|@]|9|@]|A|$E|F]]|$1|O|3|P|5|6|7|Z|8|@]|9|@]|A|$]]|$1|Q|3|R|5|D|7|10|8|@]|9|@]|A|$E|F]]]|S|$]]

Disable firewalld by the following command:

<pre><code>systemctl disable firewalld
</code></pre>

Then install iptables-service by following command:

<pre><code>yum install iptables-services
</code></pre>

Then enable iptables as services:

<pre><code>systemctl enable iptables
</code></pre>

Now you can save your iptable rules by following command:

<pre><code>service iptables save
</code></pre>

blocks|key|5370192|text|在CentOS+7上，您可能需要安装iptables-services包(多亏了建议的@RichieACC+)：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|5370193|sudo+yum+install+-y+iptables-services|code-block|syntax|javascript|5370194|然后使用systemd启用服务：|5370195|sudo+systemctl+enable+iptables.service|5370196|并运行initscript以保存防火墙规则：|5370197|sudo+/usr/libexec/iptables/iptables.init+save|entityMap|0|LINK|mutability|MUTABLE|url|https://serverfault.com/questions/626521/centos-7-save-iptables-settings#comment786743_626540|1|https://serverfault.com/users/32584/richieacc^0|I|H|14|2|0|17|A|1|0|0|4|7|0|0|0^^$0|@$1|2|3|4|5|6|7|11|8|@$9|12|A|13|B|C]]|D|@$9|14|A|15|1|16]|$9|17|A|18|1|19]]|E|$]]|$1|F|3|G|5|H|7|1A|8|@]|D|@]|E|$I|J]]|$1|K|3|L|5|6|7|1B|8|@$9|1C|A|1D|B|C]]|D|@]|E|$]]|$1|M|3|N|5|H|7|1E|8|@]|D|@]|E|$I|J]]|$1|O|3|P|5|6|7|1F|8|@]|D|@]|E|$]]|$1|Q|3|R|5|H|7|1G|8|@]|D|@]|E|$I|J]]]|S|$T|$5|U|V|W|E|$X|Y]]|Z|$5|U|V|W|E|$X|10]]]]

On CentOS 7 Minimal you may need to install the <code>iptables-services</code> package (thanks to <a href="https://serverfault.com/users/32584/richieacc">@RichieACC</a> for the <a href="https://serverfault.com/questions/626521/centos-7-save-iptables-settings#comment786743_626540">suggestion</a>):

<pre><code>sudo yum install -y iptables-services
</code></pre>

And then enable the service using <code>systemd</code>:

<pre><code>sudo systemctl enable iptables.service
</code></pre>

And run the initscript to save your firewall rules:

<pre><code>sudo /usr/libexec/iptables/iptables.init save
</code></pre>

blocks|key|6411871|text|iptables-save+>+/etc/sysconfig/iptables|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|6411872|将保存当前配置，而无需安装任何其他库或服务。|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|H|8|@]|9|@]|A|$B|C]]|$1|D|3|E|5|F|7|I|8|@]|9|@]|A|$]]]|G|$]]

<pre><code>iptables-save &gt; /etc/sysconfig/iptables
</code></pre>
will save the current configuration without the need to install any other libraries or services.

blocks|key|6411765|text|您可以直接修改/etc/sysconfig/iptables文件。重新加载iptables服务以重新加载该文件中的规则。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|6411766|然而，正如您已经听说过的，firewalld是Centos的新默认防火墙系统，这是一个学习如何使用它的好机会，您不认为吗？|entityMap^0|7|N|11|8|0|D|9^^$0|@$1|2|3|4|5|6|7|I|8|@$9|J|A|K|B|C]|$9|L|A|M|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@]|E|$]]]|H|$]]

You can modify directly the <code>/etc/sysconfig/iptables</code> file.
Reload the <code>iptables</code> service to reload the rules from that file.
Yet, as you were told already, <code>firewalld</code> is the new default firewall system for Centos, and this is a good chance to learn how to use it, don't you think?

blocks|key|5370302|text|也许这样的剧本对任何人都有帮助？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5370303|警告您将丢失当前配置的任何内容，因为它移除了|header-two|5370304|输入表中的任何当前规则。|5370305|yum+remove+firewalld+&&+yum+install+iptables-services

iptables+--flush+INPUT
iptables+-A+INPUT+-m+state+--state+ESTABLISHED,RELATED+-j+ACCEPT++++++++++++#+Any+packages+related+to+an+existing+connection+are+OK
iptables+-A+INPUT+-m+state+--state+NEW+-m+tcp+-p+tcp+--dport+22+-j+ACCEPT+++#+ssh+is+OK
iptables+-A+INPUT+-m+state+--state+NEW+-m+tcp+-p+tcp+--dport+3000+-j+ACCEPT+++#+Port+3000+for+IPv4+is+OK
iptables+-A+INPUT+-j+REJECT+#+any+other+traffic+is+not+welcome+-+this+should+be+the+last+line
service+iptables+save+++++++#+Save+IPv4+IPTABLES+rules+van+memory+naar+disk
systemctl+enable+iptables+++#+To+make+sure+the+IPv4+rules+are+reloaded+at+system+startup|code-block|syntax|javascript|5370306|如果您的系统可能会被IPv6流量(现在或以后的任何时候)访问，我想您也希望如此：|5370307|ip6tables+--flush+INPUT
ip6tables+-A+INPUT+-m+state+--state+ESTABLISHED,RELATED+-j+ACCEPT++++++++++++#+Any+packages+related+to+an+existing+connection+are+OK
ip6tables+-A+INPUT+-m+state+--state+NEW+-m+tcp+-p+tcp+--dport+22+-j+ACCEPT+++#+ssh+is+OK
ip6tables+-A+INPUT+-m+state+--state+NEW+-m+tcp+-p+tcp+--dport+3000+-j+ACCEPT+++#+Port+3000+for+IPv6+is+OK
ip6tables+-A+INPUT+-j+REJECT+#+any+other+traffic+is+not+welcome+-+this+should+be+the+last+line
service+ip6tables+save+++++++#+Save+IPv6+IPTABLES+rules+van+memory+naar+disk
systemctl+enable+ip6tables+++#+To+make+sure+the+IPv6+rules+are+reloaded+at+system+startup|entityMap^0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|R|8|@]|9|@]|A|$]]|$1|E|3|F|5|6|7|S|8|@]|9|@]|A|$]]|$1|G|3|H|5|I|7|T|8|@]|9|@]|A|$J|K]]|$1|L|3|M|5|6|7|U|8|@]|9|@]|A|$]]|$1|N|3|O|5|I|7|V|8|@]|9|@]|A|$J|K]]]|P|$]]

Maybe a script like this would have been helpful to anyone?

Beware that you will loose anything currently configured because it removes firewalld and flushes any current rules in the INPUT table:

<pre><code>yum remove firewalld &amp;&amp; yum install iptables-services

iptables --flush INPUT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Any packages related to an existing connection are OK
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT # ssh is OK
iptables -A INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT # Port 3000 for IPv4 is OK
iptables -A INPUT -j REJECT # any other traffic is not welcome - this should be the last line
service iptables save # Save IPv4 IPTABLES rules van memory naar disk
systemctl enable iptables # To make sure the IPv4 rules are reloaded at system startup
</code></pre>

I guess you want the same in case your system might be reached (now or anytime later) by IPv6 traffic:

<pre><code>ip6tables --flush INPUT
ip6tables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT # Any packages related to an existing connection are OK
ip6tables -A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT # ssh is OK
ip6tables -A INPUT -m state --state NEW -m tcp -p tcp --dport 3000 -j ACCEPT # Port 3000 for IPv6 is OK
ip6tables -A INPUT -j REJECT # any other traffic is not welcome - this should be the last line
service ip6tables save # Save IPv6 IPTABLES rules van memory naar disk
systemctl enable ip6tables # To make sure the IPv6 rules are reloaded at system startup
</code></pre>

Problem: iptables resets to default settings after server reboot.

I'm trying to set rule like this:

<code>iptables -I INPUT -p tcp --dport 3000 -j ACCEPT</code>

after that I do:

<code>service iptables save</code>

and it writes back something like this 

<code>iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]</code>

and after this I just ran (this was done once):

<code>chkconfig iptables on</code> (I have read that this has to be done in order to restore settings after reboot)

After that I reboot and run this command:

<code>systemctl list-unit-files | grep iptables</code>

and I see that iptables.service is enabled, however, the rule (to open port 3000) does not work anymore.

How do I persist these settings?

Centos 7 save iptables settings

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

问题: iptables在服务器重新启动后重置为默认设置。我正试图像这样制定规则：iptables -I INPUT -p tcp --dport 3000 -j ACCEPT在那之后，我会：service iptables save它会写回像这样的东西iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]在这之后我就

问Centos 7保存iptables设置
EN

回答 6

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Centos 7保存iptables设置EN

回答 6

Server Fault用户

Server Fault用户

Server Fault用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Centos 7保存iptables设置
EN