Centos7——防火墙(Firewall)命令

centos防火墙根据系统大致有2种，一种是centos6时代的iptables；一种是centos7时代的firewalld；
CentOS 7中防火墙是一个非常的强大的功能，在CentOS 6.5中在iptables防火墙中进行了升级了

Centos7默认安装了firewalld，如果没有安装的话，则需要YUM命令安装；firewalld真的用不习惯，与之前的iptable防火墙区别太大。

安装Firewall命令：

yum install firewalld firewalld-config

Firewall开放常见端口：（80、443、21、22、53）

firewall-cmd --zone=public --add-port=80/tcp --permanent

Firewall关闭常见端口：（80、443、21、22、53）

firewall-cmd --zone=public --remove-port=80/tcp --permanent

命令含义：

--zone #作用域

--add-port=80/tcp #添加端口，格式为：端口/通讯协议

--permanent #永久生效，没有此参数重启后失效

批量添加区间端口

firewall-cmd --zone=public --add-port=8000-9999/udp --permanent

firewall-cmd --zone=public --add-port=8000-9999/tcp --permanent

开启防火墙命令：

systemctl start firewalld.service

重启防火墙命令：

systemctl restart firewalld.service 或者 service firewalld restart 或者 firewall-cmd --reload

查看端口列表：

firewall-cmd --permanent --list-port

禁用防火墙

systemctl stop firewalld

设置开机启动

systemctl enable firewalld

停止并禁用开机启动

sytemctl disable firewalld

查看状态

systemctl status firewalld 或者 service firewalld status 或者 firewall-cmd --state

设置firewalld 允许指定IP访问某端口

1.防火墙规则

Postgresql端口设置。允许192.168.142.166访问5432端口

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.142.166" port protocol="tcp" port="5432" accept"

redis端口设置。允许192.168.142.166访问6379端口

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.142.166" port protocol="tcp" port="6379" accept"

2. 重启防火墙，使配置生效
systemctl restart firewalld.service

3. 查看配置结果，验证配置
firewall-cmd --list-all

4. 删除规则
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="192.168.142.166" port protocol="tcp" port="11300" accept"

systemctl restart firewalld.service

5.规则查询端口是否打开
firewall-cmd --query-port=80/tcp

firewall-cmd --zone=public --add-port=80/tcp --permanent

Centos7防火墙配置rich-rule实现IP端口限制访问 & firewall-cmd命令

rich-rule实现IP端口限制访问
1、添加规则
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.51.54.1" port protocol="tcp" port="80" accept"

2、批量添加网段
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.51.54.1/24" port protocol="tcp" port="80" accept"

3、暴露端口
#开启某个端口（所有IP可访问）
firewall-cmd --permanent --zone=public --add-port=80/tcp

4、删除策略：
firewall-cmd --permanent --zone=public --remove-port=80/tcp

5、批量添加屏蔽ip网段
firewall-cmd --permanent --zone="public" --add-rich-rule="rule family="ipv4" source address="10.30.125.0/24" drop"

#查看所有防火墙配置
firewall-cmd --list-all
#查看rich-rules 
[root@new-center ~]# firewall-cmd --list-rich-rules
#重载firewalld
[root@new-center ~]# firewall-cmd --reload 
success

#1、添加规则
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.168.1" port protocol="tcp" port="80" accept"

#2、批量添加网段
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.51.54.1/24" port protocol="tcp" port="80" accept"

#3、批量添加屏蔽ip网段
firewall-cmd --permanent --zone="public" --add-rich-rule="rule family="ipv4" source address="10.30.125.0/24" drop"
#
firewall-cmd --permanent --zone="public" --add-rich-rule="rule family="ipv4" source address="0.0.0.0/0" forward-port port="8000" protocol="tcp" to-port="8000" to-addr="192.168.11.118""

#4、删除rich rule
[root@new-center ~]# firewall-cmd --permanent --remove-rich-rule 'rule family="ipv4" source address="0.0.0.0/0" forward-port port="2224" protocol="tcp" to-port="2224" to-addr="192.168.11.241"'
success

[root@new-center ~]# firewall-cmd --list-rich-rules 
rule family="ipv4" source address="0.0.0.0/0" forward-port port="8078" protocol="tcp" to-port="8080" to-addr="192.168.11.234"
rule family="ipv4" source address="0.0.0.0/0" forward-port port="8000" protocol="tcp" to-port="8000" to-addr="192.168.11.118"
rule family="ipv4" source address="0.0.0.0/0" forward-port port="3722" protocol="tcp" to-port="22" to-addr="192.168.11.249"