[root@centos7 html]# systemctl stop firewalld #停止firewall防火墙

[root@centos7 html]# systemctl disable firewalld  #禁止firewall开机启动

[root@centos7 html]# systemctl status firewalld

● firewalld.service - firewalld - dynamic firewall daemon

   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)

   Active: inactive (dead)

     Docs: man:firewalld()

Aug  :: centos7 systemd[]: Starting firewalld - dynamic firewall daemon...

Aug  :: centos7 systemd[]: Started firewalld - dynamic firewall daemon.

Aug  :: centos7 systemd[]: Stopping firewalld - dynamic firewall daemon...

Aug  :: centos7 systemd[]: Stopped firewalld - dynamic firewall daemon.

Aug  :: centos7 systemd[]: Starting firewalld - dynamic firewall daemon...

Aug  :: centos7 systemd[]: Started firewalld - dynamic firewall daemon.

Aug  :: centos7 systemd[]: Stopping firewalld - dynamic firewall daemon...

Aug  :: centos7 systemd[]: Stopped firewalld - dynamic firewall daemon.

[root@centos7 html]# 

[root@centos7 html]# yum install  -y iptables  iptables-services

Loaded plugins: fastestmirror

Loading mirror speeds from cached hostfile

 * base: mirrors..com

 * extras: mirrors.sohu.com

 * updates: mirrors..com

Package iptables-1.4.-.el7.x86_64 already installed and latest version

Package iptables-services-1.4.-.el7.x86_64 already installed and latest version

Nothing to do

[root@centos7 html]# systemctl start iptables

[root@centos7 html]# systemctl status iptables

● iptables.service - IPv4 firewall with iptables

   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)

   Active: active (exited) since Fri -- :: CST; 14s ago

  Process:  ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=/SUCCESS)

 Main PID:  (code=exited, status=/SUCCESS)

Aug  :: centos7 systemd[]: Starting IPv4 firewall with iptables...

Aug  :: centos7 iptables.init[]: iptables: Applying firewall rules: [  OK  ]

Aug  :: centos7 systemd[]: Started IPv4 firewall with iptables.

[root@centos7 html]# service iptables status

Redirecting to /bin/systemctl status  iptables.service

● iptables.service - IPv4 firewall with iptables

   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)

   Active: active (exited) since Fri -- :: CST; 28s ago

  Process:  ExecStart=/usr/libexec/iptables/iptables.init start (code=exited, status=/SUCCESS)

 Main PID:  (code=exited, status=/SUCCESS)

Aug  :: centos7 systemd[]: Starting IPv4 firewall with iptables...

Aug  :: centos7 iptables.init[]: iptables: Applying firewall rules: [  OK  ]

Aug  :: centos7 systemd[]: Started IPv4 firewall with iptables.

[root@centos7 html]# 

[root@centos7 html]# iptables -L

Chain INPUT (policy ACCEPT)

target     prot opt source               destination

ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED

ACCEPT     icmp --  anywhere             anywhere

ACCEPT     all  --  anywhere             anywhere

ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:ssh

ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:mysql

ACCEPT     tcp  --  anywhere             anywhere             state NEW tcp dpt:http

REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain FORWARD (policy ACCEPT)

target     prot opt source               destination

REJECT     all  --  anywhere             anywhere             reject-with icmp-host-prohibited

Chain OUTPUT (policy ACCEPT)

target     prot opt source               destination

[root@centos7 html]# cat /etc/sysconfig/iptables

# sample configuration for iptables service

# you can edit this manually or use system-config-firewall

# please do not ask us to add additional ports/services to this default configuration

*filter

:INPUT ACCEPT [:]

:FORWARD ACCEPT [:]

:OUTPUT ACCEPT [:]

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

-A INPUT -p icmp -j ACCEPT

-A INPUT -i lo -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport  -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport   -j ACCEPT

-A INPUT -p tcp -m state --state NEW -m tcp --dport   -j ACCEPT

-A INPUT -j REJECT --reject-with icmp-host-prohibited

-A FORWARD -j REJECT --reject-with icmp-host-prohibited

COMMIT

[root@centos7 html]# 

[root@centos7 html]# systemctl enable iptables

Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.

[root@centos7 html]# systemctl status iptables

● iptables.service - IPv4 firewall with iptables

   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)

   Active: active (exited) since Fri -- :: CST; 2min 22s ago

 Main PID:  (code=exited, status=/SUCCESS)

Aug  :: centos7 systemd[]: Starting IPv4 firewall with iptables...

Aug  :: centos7 iptables.init[]: iptables: Applying firewall rules: [  OK  ]

Aug  :: centos7 systemd[]: Started IPv4 firewall with iptables.

[root@centos7 html]#