mjhjmtu

I want to disable iptables completely. I followed the instruction like

/etc/init.d/iptables close

it said there No such file or directory

[root@dataapp02 tmp]# service iptables stop
Redirecting to /bin/systemctl stop iptables.service
Failed to stop iptables.service: Unit iptables.service not loaded.

And I found another command firewalld

[root@dataapp02 tmp]# service firewalld stop
Redirecting to /bin/systemctl stop firewalld.service

So far I am not sure iptables are disabled or not?

How do I check whether iptables disabled or not.

On my computer I can open

http://mirror.centos.org/centos/7/os/x86_64/repodata/repomd.xml

But on the on-premises computer with firewall, iptables and http proxy whitelist, it said the connection time out.

iptables is a tool that allows you to control netfilter. You can't "disable" iptables but you can ensure that netfilter is not interfering with your network traffic.

Permit all traffic and flush all rules:

iptables -P INPUT ACCEPT # ensure that default policy is ACCEPT
iptables -F INPUT # flush all input rules
iptables -P FORWARD ACCEPT
iptables -F FORWARD
iptables -P OUTPUT ACCEPT 
iptables -F OUTPUT

iptables -t nat -F PREROUTING # flush the NAT tables
iptables -t nat -F INPUT
iptables -t nat -F OUTPUT
iptables -t nat -F POSTROUTING

It's up to you to replicate the same pattern on the IPv6 stack (using ip6tables) and work out how to make these changes permanent. It could be iptables-save > /etc/iptables/rules.v4 (for v4) but not guaranteed.

My understanding is that what you seem to want is impossible (or very difficult). I don't think there's any easy way to truly remove the firewall functionality from the operating system. The best you can do, I think, is configure the OS to allow all network traffic.

The simplest, most straight-forward way I know of to accept all network traffic is to use the iptables-restore and ip6tables-restore commands to clear out all of the firewall rules and reset the policies to ACCEPT. You can use a settings file such as the following:

# accept-all.iptables

# Clear all iptables rules
# Load using iptables-restore and ip6tables-restore

*raw
:PREROUTING ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

*mangle
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

*nat
:PREROUTING ACCEPT [0:0]
:INPUT ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]
COMMIT

*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
COMMIT

This format is read by iptables-restore and written by iptables-save.

You could then clear the IP4 rules using iptables-restore as follows:

sudo iptables-restore accept-all.iptables

And you could clear the IP6 rules using ip6tables-restore as follows:

sudo ip6tables-restore accept-all.iptables

Or you could do both at once:

cat accept-all.iptables 
| tee >(ip6tables-restore) 
| iptables-restore

The way to make these settings persist would depend on your OS. On Debian, for example, there is an iptables-persistent package which was designed for this purpose.

/sbin/iptables -L

Will list all the active rules.