Linux firewall related settings

============iptables============

#!/bin/bash

iptables -F

iptables -P INPUT DROP

iptables -P OUTPUT ACCEPT

iptables -A INPUT -i lo -j ACCEPT

iptables -A INPUT -i lan0 -j ACCEPT

iptables -A INPUT -i ens21f0 -j ACCEPT

iptables -A INPUT -i ens21f1 -j ACCEPT

iptables -A INPUT -p tcp -m tcp --dport 22 -j ACCEPT

iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

=============NAT via firewall-cmd=================

vim /etc/sysctl.conf 

net.ipv4.ip_forward = 1

sysctl -p

#define zone

firewall-cmd --permanent --zone=external --change-interface=eth0 

firewall-cmd --permanent --zone=internal --change-interface=eth1

#set NAT masquerade

firewall-cmd --zone=external --add-masquerade --permanent

#NAT rules

firewall-cmd --permanent --direct --passthrough ipv4 -t nat -I POSTROUTING -o em1 -j MASQUERADE -s 172.16.10.0/24

firewall-cmd --reload

#Check:

[root@620 ~]# firewall-cmd  --direct --get-passthroughs ipv4 -t nat -I POSTROUTING -o em1 -j MASQUERADE -s 172.16.10.0/24