JIYIK CN >

1. Add a rule to allow access to a port

$ iptables -A INPUT -p tcp --dport 3005 -j ACCEPT

Add a rule and append a rule to the INPUT chain to allow access to port 3005. The rules added in this way are only temporarily saved in the memory and will become invalid as long as the iptables service is restarted.

If you want to make this rule permanent, that is, the rule is still valid after the iptables service is restarted, you need to use commands iptables-saveto achieve this goal.

$ iptables-save

By default, if we just run this command, only a bunch of rules will be output in the terminal, similar to the following.

:INPUT_direct - [0:0]
:IN_public - [0:0]
:IN_public_allow - [0:0]
:IN_public_deny - [0:0]
:IN_public_log - [0:0]
:OUTPUT_direct - [0:0]
-A INPUT -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -j INPUT_direct
-A INPUT -j INPUT_ZONES_SOURCE
-A INPUT -j INPUT_ZONES
-A INPUT -m conntrack --ctstate INVALID -j DROP
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3306 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 3005 -j ACCEPT
-A FORWARD -j DOCKER-USER
-A FORWARD -j DOCKER-ISOLATION-STAGE-1
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT

This still does not work. In fact, we know that the iptables service has a configuration file when it is started /etc/sysconfig/iptables. So we have two ways:

1. Manually write rules to iptables

-A INPUT -p tcp -m tcp --dport 3005 -j ACCEPT

Save and exit, restart the service to take effect

2. Use  iptables-save redirection

We can see above that iptables-savethe command output is actually the content in /etc/sysconfig/iptables, but we have added our own configured rules, so we can redirect the output content to the configuration file

​$ iptables-save > /etc/sysconfig/iptables

The last thing to note is -A that we need to add a rule. In fact, in many cases, we find that

​$ iptables -A INPUT -p tcp --dport 3005 -j ACCEPT

It will not take effect, even if iptables-savethe configuration file is updated.

In fact, as long as we understand iptablesthe matching rules, it is easy to understand. When a rule is matched, the following rules will no longer be matched, even if there are other rules that meet the requirements. In iptablesthe default configuration file, there is such a rule

​-A INPUT -j REJECT --reject-with icmp-host-prohibited

Deny all access to the host. As long as the previous rule does not match, this rule will definitely match. So  -A INPUT add a rule after this one, and it will definitely not be accessible.

Therefore, we can  -I INPUT insert a rule in chain INPUT. The inserted rule is at the front, so it can be matched.

​$ iptables -I INPUT -p tcp --dport 3005 -j ACCEPT