How to Configure iptables Firewall on CentOS 7 (Avoid Common Pitfalls)

Recently the author set up a new server on Alibaba Cloud using CentOS 7 and installed a LAMP stack. While configuring the firewall, they discovered that the default firewalld service does not behave as expected, so they switched to the traditional iptables.

First, stop and disable firewalld:

# systemctl stop firewalld.service
# systemctl disable firewalld.service

Then install iptables‑services, edit /etc/sysconfig/iptables and add the required rules:

yum install iptables-services
vi /etc/sysconfig/iptables
# (example rules below)
*filter
:INPUT DROP [0:0]
:FORWARD DROP [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

After saving, restart and enable iptables:

systemctl restart iptables.service
systemctl enable iptables.service

The default policy sets INPUT and FORWARD chains to DROP and OUTPUT to ACCEPT. The 15 rules explained include opening web ports (80, 8080), SSH (22122), allowing loopback, ICMP, established/related connections, and specific IP ranges for Alibaba Cloud DNS and the company's IPs, as well as rules required by Alibaba Cloud's security agent.