centos iptables 允许本地访问指定外网ip的特定端口

Question

[root@iZ25y7mub68Z ~]# service iptables status
Table: nat
Chain PREROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain POSTROUTING (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination         

Table: filter
Chain INPUT (policy ACCEPT)
num  target     prot opt source               destination         
1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
2    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
3    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:8080 
4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:3306 
5    DROP       all  --  0.0.0.0/0            0.0.0.0/0           

Chain FORWARD (policy ACCEPT)
num  target     prot opt source               destination         

Chain OUTPUT (policy ACCEPT)
num  target     prot opt source               destination

这样的配置，我现在本机访问不了任何外网

我现在想实现，本机只能访问外网的指定IP的指定端口

还有就是，本机的8080端口也只能是指定IP访问

如何写策略？

Answer 1

iptables -F && iptables -X && iptables -Z

iptables -P INPUT DROP

iptables -P OUTPUT DROP

iptables -P FORWARD DROP

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

iptables -A INPUT -m state --state NEW -p tcp -s 192.168.0.10 --dport 8080 -j ACCEPT

iptables -A OUTPUT -m state --state NEW -p tcp -d 172.16.20.10 --dport 80,21 -j ACCEPT

service iptables save