# 设置默认策略
$ iptables -P INPUT DROP
$ iptables -P OUTPUT ACCEPT
$ iptables -P FORWARD DROP

# 允许本地回环
$ iptables -A INPUT -i lo -j ACCEPT

# 允许已建立的连接
$ iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT

# 允许SSH访问
$ iptables -A INPUT -p tcp –dport 22 -j ACCEPT

# 允许HTTP和HTTPS访问
$ iptables -A INPUT -p tcp –dport 80 -j ACCEPT
$ iptables -A INPUT -p tcp –dport 443 -j ACCEPT

# 保存规则
$ iptables-save > /etc/iptables/rules.v4