CentOS 7.0默认使用的是firewall作为防火墙，这里改为iptables防火墙。CentOS 7使用systemd替换以前的sysv，因此用systemctl替换原来的service来管理服务，service和chkconfig还是可以使用，当使用service来管理服务时将自动跳转到systemctl来管理。

关闭firewall

# systemctl stop firewalld.service

禁止firewall开机启动

# systemctl disable firewalld.service

安装iptables防火墙

# yum -y install iptables-services

编辑防火墙配置文件

# vim /etc/sysconfig/iptables

添加如下内容

# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT

管理iptables

启动iptables

# systemctl start iptables.service

停止iptables

# systemctl stop iptables.service

重启iptables

# systemctl restart iptables.service

设置防火墙开机启动

# systemctl enable iptables.service