在RHEL 6.8中打开防火墙端口

我正在努力确定是否根据Redhat 6.8中的防火墙打开特定的端口

我想打开2222端口。

我已经尝试了以下内容：

system-config-firewall，以sudo的身份运行，并将端口2222描述为要打开的特定端口：

• 如何阻止与鱿鱼和iptables的Gmail的networking聊天？
• 用iptables用NAT标记数据包
• 与局域网桥接VPN连接
• 通过特定的接口路由应用程序stream
• 你认为哪个iptables规则是“必须拥有”

然而，港口并不公开。 我通过尝试通过SSH连接到2222端口来testing。目前SSH运行在22端口上，而且我可以正常连接，但是当我configurationSSH通过2222运行时，使用/ etc / ssh /中sshd_config中的Port 2222 ，连接超时。 我知道SSHD被configuration为侦听该端口，因为我可以使用netstat来testing。

我也尝试过对/ etc / sysconfig / iptables进行各种编辑，包括添加下列规则：

 -I INPUT 9 -m state --state NEW -m tcp -p tcp --dport 2222 -j ACCEPT 

和

 -A INPUT -m state --state NEW -m tcp -p tcp --dport 2222 -j ACCEPT 

每一个这些变化后，我执行sudo service iptables restart ，我无法连接。 有趣的是，如果我做cat /etc/sysconfig/iptables | grep 2222 cat /etc/sysconfig/iptables | grep 2222我没有看到我的新规则，我希望我应该。 运行sudo iptables -L -n时，我也看不到它sudo iptables -L -n这是正常的吗？

我已经意识到主机正在运行SELinux – 根据这个输出：

 [andyarmstrong@o0201320382301 ~]$ sestatus SELinux status: enabled SELinuxfs mount: /selinux Current mode: permissive Mode from config file: permissive Policy version: 24 Policy from config file: targeted 

我安装了semanage，并运行了： semanage port -a -t ssh_port_t -p tcp 2222 – 但是我仍然无法完成。

整个/ etc / sysconfig / iptables文件包含以下内容：

 #GENERATED BY Modular IPTABLES Config *filter :FORWARD DROP [0:0] :INPUT DROP [0:0] -A INPUT -i lo -j ACCEPT -A INPUT -p tcp -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p udp -m state --state RELATED,ESTABLISHED -j ACCEPT -A INPUT -p tcp -m tcp --dport 113 -j REJECT --reject-with icmp-port-unreachable -A INPUT -p tcp -m tcp --dport 5308 -j ACCEPT -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT -A INPUT -p tcp -m tcp --dport 5900 -j ACCEPT -A INPUT -p tcp -m tcp --dport 5901 -j ACCEPT # Sametime File Transfers use ports 443 and 5656 -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT -A INPUT -p tcp -m tcp --dport 5656 -j ACCEPT #VoiceJam Rules -A INPUT -p udp -m udp --dport 5004:5005 -j ACCEPT -A INPUT -p tcp -m tcp --dport 5004:5005 -j ACCEPT -A INPUT -p udp -m udp --dport 20830 -j ACCEPT -A INPUT -p tcp -m tcp --dport 20830 -j ACCEPT -A INPUT -p tcp -m tcp --dport 5060:5062 -j ACCEPT -A INPUT -p udp -m udp --dport 5060:5062 -j ACCEPT -A INPUT -p tcp -m tcp --dport 12080 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 53 -j ACCEPT -A INPUT -m state --state NEW -m udp -p udp --dport 53 -j ACCEPT -A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT # CDS Peering #60050 -A INPUT -p tcp -m tcp --dport 21100 -j ACCEPT # My Help SSL P2P migration -A INPUT -p tcp -m tcp --dport 2001 -j ACCEPT -A INPUT -p udp -m udp --dport 2001 -j ACCEPT -A INPUT -p ah -j ACCEPT -A INPUT -p esp -j ACCEPT -A INPUT -m state --state NEW -m udp -p udp --dport 500 -j ACCEPT -A INPUT -i ipsec+ -p 254 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 3 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 4 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 11 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 12 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 9 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 8 -j ACCEPT -A INPUT -p icmp -m icmp --icmp-type 0 -j ACCEPT # Enable forward between KVM server and virtual machines -I FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu -A FORWARD -d 192.168.122.0/24 -o virbr0 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 192.168.122.0/24 -i virbr0 -j ACCEPT -A FORWARD -i virbr0 -o virbr0 -j ACCEPT -A FORWARD -o virbr0 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr0 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -d 192.168.123.0/24 -o virbr1 -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -s 192.168.123.0/24 -i virbr1 -j ACCEPT -A FORWARD -i virbr1 -o virbr1 -j ACCEPT -A FORWARD -o virbr1 -j REJECT --reject-with icmp-port-unreachable -A FORWARD -i virbr1 -j REJECT --reject-with icmp-port-unreachable # Rule required by package ibm-config-kvm-printing # Allow printer sharing between Linux host and KVM guests -A INPUT -i virbr0 -p tcp --dport 631 -j ACCEPT -A INPUT -p tcp -m tcp --dport 8081 -j ACCEPT -A INPUT -p tcp -m tcp --dport 1533 -j ACCEPT -A INPUT -m state --state NEW -m udp -p udp --dport 52311 -j ACCEPT -A INPUT -p tcp -m tcp --dport 30000:30005 -j ACCEPT -A INPUT -p tcp -m tcp --dport 67:68 -j DROP -A INPUT -p udp -m udp --dport 67:68 -j DROP -A INPUT -p tcp -m tcp --dport 137 -j DROP -A INPUT -p udp -m udp --dport 137 -j DROP -A INPUT -p tcp -m tcp --dport 138 -j DROP -A INPUT -p udp -m udp --dport 138 -j DROP -A INPUT -p tcp -m tcp --dport 139 -j DROP -A INPUT -p udp -m udp --dport 139 -j DROP -A INPUT -p tcp -m tcp --dport 1:20 -j DROP -A INPUT -p tcp -m tcp --dport 111 -j DROP -A INPUT -p tcp -m tcp --dport 161:162 -j DROP -A INPUT -p tcp -m tcp --dport 520 -j DROP -A INPUT -p tcp -m tcp --dport 6348:6349 -j DROP -A INPUT -p tcp -m tcp --dport 6345:6347 -j DROP -A INPUT -i virbr0 -p tcp -d 192.168.122.1 --dport 445 -j ACCEPT -A INPUT -i virbr0 -p tcp -d 192.168.122.1 --dport 1445 -j ACCEPT -A INPUT -i virbr1 -p tcp -d 192.168.123.1 --dport 445 -j ACCEPT -A INPUT -i virbr1 -p tcp -d 192.168.123.1 --dport 1445 -j ACCEPT # Accept local Samba connections -I INPUT -i virbr0 -p udp -m udp --dport 53 -j ACCEPT -I INPUT -i virbr0 -p tcp -m tcp --dport 53 -j ACCEPT -I INPUT -i virbr0 -p udp -m udp --dport 67 -j ACCEPT -I INPUT -i virbr0 -p tcp -m tcp --dport 67 -j ACCEPT -I INPUT -i virbr0 -p udp -m udp --dport 137 -j ACCEPT -I INPUT -i virbr0 -p udp -m udp --dport 138 -j ACCEPT -I INPUT -i virbr0 -p tcp -m tcp --dport 139 -j ACCEPT -I INPUT -i virbr0 -p tcp -m tcp --dport 445 -j ACCEPT -I INPUT -i virbr1 -p udp -m udp --dport 53 -j ACCEPT -I INPUT -i virbr1 -p tcp -m tcp --dport 53 -j ACCEPT -I INPUT -i virbr1 -p udp -m udp --dport 67 -j ACCEPT -I INPUT -i virbr1 -p tcp -m tcp --dport 67 -j ACCEPT -I INPUT -i virbr1 -p udp -m udp --dport 137 -j ACCEPT -I INPUT -i virbr1 -p udp -m udp --dport 138 -j ACCEPT -I INPUT -i virbr1 -p tcp -m tcp --dport 139 -j ACCEPT -I INPUT -i virbr1 -p tcp -m tcp --dport 445 -j ACCEPT -A INPUT -i virbr0 -p tcp -m tcp --dport 48500 -j ACCEPT -A INPUT -i virbr1 -p tcp -m tcp --dport 48500 -j ACCEPT -A INPUT -p tcp -m limit --limit 3/min -j LOG --log-prefix "FIREWALL: " --log-level 6 -A INPUT -p udp -m limit --limit 3/min -j LOG --log-prefix "FIREWALL: " --log-level 6 -A INPUT -j DROP :OUTPUT ACCEPT [0:0] COMMIT *mangle :FORWARD ACCEPT [0:0] :INPUT ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -A POSTROUTING -o virbr0 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill -A POSTROUTING -o virbr1 -p udp -m udp --dport 68 -j CHECKSUM --checksum-fill :PREROUTING ACCEPT [0:0] COMMIT *nat :OUTPUT ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -p udp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.122.0/24 ! -d 192.168.122.0/24 -j MASQUERADE -A POSTROUTING -s 192.168.123.0/24 ! -d 192.168.123.0/24 -p tcp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.123.0/24 ! -d 192.168.123.0/24 -p udp -j MASQUERADE --to-ports 1024-65535 -A POSTROUTING -s 192.168.123.0/24 ! -d 192.168.123.0/24 -j MASQUERADE :PREROUTING ACCEPT [0:0] -A PREROUTING -i virbr0 -p tcp -d 192.168.122.1 --dport 445 -j REDIRECT --to-port 1445 -A PREROUTING -i virbr1 -p tcp -d 192.168.123.1 --dport 445 -j REDIRECT --to-port 1445 COMMIT 

iptablesconfiguration文件是：

 # Load additional iptables modules (nat helpers) # Default: -none- # Space separated list of nat helpers (eg 'ip_nat_ftp ip_nat_irc'), which # are loaded after the firewall rules are applied. Options for the helpers are # stored in /etc/modprobe.conf. IPTABLES_MODULES="ip_conntrack_ftp" # Unload modules on restart and stop # Value: yes|no, default: yes # This option has to be 'yes' to get to a sane state for a firewall # restart or stop. Only set to 'no' if there are problems unloading netfilter # modules. IPTABLES_MODULES_UNLOAD="yes" # Save current firewall rules on stop. # Value: yes|no, default: no # Saves all firewall rules to /etc/sysconfig/iptables if firewall gets stopped # (eg on system shutdown). IPTABLES_SAVE_ON_STOP="no" # Save current firewall rules on restart. # Value: yes|no, default: no # Saves all firewall rules to /etc/sysconfig/iptables if firewall gets # restarted. IPTABLES_SAVE_ON_RESTART="no" # Save (and restore) rule and chain counter. # Value: yes|no, default: no # Save counters for rules and chains to /etc/sysconfig/iptables if # 'service iptables save' is called or on stop or restart if SAVE_ON_STOP or # SAVE_ON_RESTART is enabled. IPTABLES_SAVE_COUNTER="no" # Numeric status output # Value: yes|no, default: yes # Print IP addresses and port numbers in numeric format in the status output. IPTABLES_STATUS_NUMERIC="yes" # Verbose status output # Value: yes|no, default: yes # Print info about the number of packets and bytes plus the "input-" and # "outputdevice" in the status output. IPTABLES_STATUS_VERBOSE="no" # Status output with numbered lines # Value: yes|no, default: yes # Print a counter/number for every rule in the status output. IPTABLES_STATUS_LINENUMBERS="yes" FILE=`mktemp -q /tmp/iptables-rules.XXXXXXXXXX` /opt/ibm/c4eb/firewall/create-rule-file.sh > $FILE cp $FILE /etc/sysconfig/iptables rm $FILE 

—-进度更新—–当我运行我的命令： sudo iptables -A INPUT -p tcp --dport 2222 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT和sudo iptables -A OUTPUT -p tcp --dport 2222 -m conntrack --ctstate ESTABLISHED -j ACCEPT

我看到/etc/sysconfig/iptables文件的大小增加到了6583.然后我做sudo service iptables保存。 保存是一样的。 然后我做sudo服务iptables重新启动，文件恢复到原来的大小（6219）没有我的更新！ 为什么！

我错过了什么吗？ 你能看到我错过的任何东西吗？

感谢所有的支持

 FILE=`mktemp -q /tmp/iptables-rules.XXXXXXXXXX` /opt/ibm/c4eb/firewall/create-rule-file.sh > $FILE cp $FILE /etc/sysconfig/iptables rm $FILE 

 # Don't edit this file directly, instead edit the files under X and run Y 

 #GENERATED BY Modular IPTABLES Config