linux中的firewalld防火墙配置

一直想写一篇关于firewalld的博客，奈何最近事情多也加上一部分家庭的事情，导致没有闲情雅致来进行博客的更新。

0.序言

写这么一篇文章的用处是用于加强linux主机的安全，在很多linux博客文章，一些人上来就哐叽一下让吧firewalld功能给关闭，这是一种不负责人的做法，也是一种不安全的做法。实际是需要进行防火墙的关闭或者开通特定端口或者允许特定IP地址的访问。这里将围绕三个方向来进行讲解。

• 运行任意网段访问特定端口或者服务
• 允许特定网络访问特定端口或者服务
• 拒绝特定端口访问特定端口或者服务

1.firewalld规则的演示

1.1.常用firewalld的命令

• firewalld命令

# 查看现有防火墙运行状态
systemctl status firewalld
# 重启现有防火墙
systemctl restart firewalld
# 停止防火墙
systemctl stop firewalld
# 开机自启动防火墙
systemctl enable firewalld

• firewall-cmd命令

# 查看现有防火墙规则
firewall-cmd --list-all
# 重启应用现有防火墙策略
firewall-cmd --reload

1.2.默认情况下firewalld的配置

默认情况下，firewalld会把接口放在public区域,文章将按public区域来进行讲解

[root@fwd ~]# firewall-cmd --get-zones
block dmz drop external home internal nm-shared public trusted work
[root@fwd ~]# 
[root@fwd ~]# firewall-cmd --get-active-zones
public
  interfaces: eth0
[root@fwd ~]# 

防火墙的策略加载方式是以xml文件进行的，常规情况文件会存储在如下路径

# 系统默认下的策略xml文件
/usr/lib/firewalld/zones/public.xml
# 用户配置后生成的策略xml文件路径
/etc/firewalld/zones/public.xml

1.3.配置放行特定端口

通过命令行方式操作

• 例如，放行linux机器中的8080端口，允许任何网段访问，语法为：firewall-cmd --permanent --add-port=8080/tcp

# 添加放形端口
[root@fwd ~]# firewall-cmd --permanent --add-port=8080/tcp
success
[root@fwd ~]# 
# 应用策略
[root@fwd ~]# firewall-cmd --reload
success
[root@fwd ~]# 
# 查看生效的策略，可以看到端口中放行了8080端口
[root@fwd ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 8080/tcp
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
[root@fwd ~]# 

通过修改xml文件方式操作

• 通过vim或者nano文件编辑器，在xml文件内添加，进行8081端口放行

[root@fwd ~]# cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="dhcpv6-client"/>
  <service name="ssh"/>
  <service name="cockpit"/>
  <port port="8080" protocol="tcp"/>
  <port port="8081" protocol="tcp"/>
  <forward/>
</zone>
[root@fwd ~]# 

• 应用策略和查看配置是否生效

[root@fwd ~]# firewall-cmd --reload
success
[root@fwd ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 8080/tcp 8081/tcp
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
[root@fwd ~]# 

1.4. 拒绝特定网段访问

此方式为黑名单模式，常用于拒绝特定IP或者网段访问，例如：拒绝1.1.1.x访问本机的3306端口。此方式有一个限制条件，需要先全部放行，然后才能进行黑名单规则（即：firewall-cmd --permanent --add-port=3306/tcp）

通过命令行方式操作

• 语法：firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="1.1.1.3" port protocol="tcp" port="3306" reject'

[root@fwd ~]# firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="1.1.1.3" port protocol="tcp" port="3306" reject'
success
[root@fwd ~]# firewall-cmd --reload
success
[root@fwd ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 8080/tcp 8081/tcp
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="1.1.1.3" port port="3306" protocol="tcp" reject
[root@fwd ~]# 

通过修改xml文件方式操作

• 例如在/etc/firewalld/zones/public.xml文件中添加如下规则，来是1.1.1.4禁止访问本机的3306端口

  <rule family="ipv4">
    <source address="1.1.1.4"/>
    <port port="3306" protocol="tcp"/>
    <reject/>
  </rule>

[root@fwd ~]# cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="dhcpv6-client"/>
  <service name="ssh"/>
  <service name="cockpit"/>
  <port port="8080" protocol="tcp"/>
  <port port="8081" protocol="tcp"/>
  <rule family="ipv4">
    <source address="1.1.1.3"/>
    <port port="3306" protocol="tcp"/>
    <reject/>
  </rule>
  <rule family="ipv4">
    <source address="1.1.1.4"/>
    <port port="3306" protocol="tcp"/>
    <reject/>
  </rule>
  <forward/>
</zone>
[root@fwd ~]# firewall-cmd --reload
success
[root@fwd ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 8080/tcp 8081/tcp
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="1.1.1.4" port port="3306" protocol="tcp" reject
        rule family="ipv4" source address="1.1.1.3" port port="3306" protocol="tcp" reject
[root@fwd ~]# 

1.5. 允许特定网段访问

通过命令行方式操作

• 例如在/etc/firewalld/zones/public.xml文件中添加如下规则，来是1.1.1.3访问本机的80端口

[root@fwd ~]# firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source address="1.1.1.3" port protocol="tcp" port="80" accept'
success
[root@fwd ~]# firewall-cmd --reload
success
[root@fwd ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 8080/tcp 8081/tcp
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="1.1.1.4" port port="3306" protocol="tcp" reject
        rule family="ipv4" source address="1.1.1.3" port port="3306" protocol="tcp" reject
        rule family="ipv4" source address="1.1.1.3" port port="80" protocol="tcp" accept
[root@fwd ~]# 

通过修改xml文件方式操作

• 在xml添加相应的配置文件

[root@fwd ~]# cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="dhcpv6-client"/>
  <service name="ssh"/>
  <service name="cockpit"/>
  <port port="8080" protocol="tcp"/>
  <port port="8081" protocol="tcp"/>
  <rule family="ipv4">
    <source address="1.1.1.3"/>
    <port port="3306" protocol="tcp"/>
    <reject/>
  </rule>
  <rule family="ipv4">
    <source address="1.1.1.4"/>
    <port port="3306" protocol="tcp"/>
    <reject/>
  </rule>
  <rule family="ipv4">
    <source address="1.1.1.3"/>
    <port port="80" protocol="tcp"/>
    <accept/>
  </rule>
  <rule family="ipv4">
    <source address="1.1.1.4"/>
    <port port="80" protocol="tcp"/>
    <accept/>
  </rule>
  <forward/>
</zone>
[root@fwd ~]# firewall-cmd --reload
success
[root@fwd ~]# 

2.firewalld高级xml配置

2.1. firewalld的地址集

在策略的时候，如果需要反复对某一些地址进行编写策略的时候，会需要很多规则，显示方面不具备可读性和操作性，因此需要引入地址组的概念，直接在策略中调用地址组，减轻运维难度

firewall-cmd --permanent --new-ipset=<地址组名称> --type=hash:ip
firewall-cmd --permanent --ipset=<地址组名称> --add-entry=<IP地址>
# 生成的地址组文件
/etc/firewalld/ipsets/<地址组名称>.xml

• 演示操作

[root@fwd ~]# firewall-cmd --permanent --new-ipset=allowlist --type=hash:ip
[root@fwd ~]# firewall-cmd --permanent --ipset=allowlist --add-entry=198.51.100.16
# 查看地址内的IP信息
[root@fwd ~]# cat /etc/firewalld/ipsets/allowlist.xml
<?xml version="1.0" encoding="utf-8"?>
<ipset type="hash:ip">
  <entry>198.51.100.16</entry>
</ipset>
[root@fwd ~]# 
# 获取现有地址集名称
[root@fwd ~]# firewall-cmd --get-ipsets
allowlist
[root@fwd ~]# 

• 策略中调用地址集

[root@fwd ~]# firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" source ipset="allowlist" port protocol="tcp" port="3389" accept'
success
[root@fwd ~]# firewall-cmd --reload
success
[root@fwd ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 8080/tcp 8081/tcp
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="1.1.1.3" port port="3306" protocol="tcp" reject
        rule family="ipv4" source address="1.1.1.3" port port="80" protocol="tcp" accept
        rule family="ipv4" source address="1.1.1.4" port port="3306" protocol="tcp" reject
        rule family="ipv4" source address="1.1.1.4" port port="80" protocol="tcp" accept
        rule family="ipv4" source ipset="allowlist" port port="3389" protocol="tcp" accept
[root@fwd ~]# 

2.2. 规则的优先级

有时候需要设置优先级，设置先允许后拒绝

[root@fwd ~]# firewall-cmd --permanent --zone=public --add-rich-rule='rule priority=32760 family="ipv4" source address="1.1.1.5" port protocol="tcp" port="3306" accept'
[root@fwd ~]# firewall-cmd --permanent --zone=public --add-rich-rule='rule priority=32767 family="ipv4" port protocol="tcp" port="3306" reject' 
[root@fwd ~]# firewall-cmd --reload
success
[root@fwd ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: cockpit dhcpv6-client ssh
  ports: 8080/tcp 8081/tcp
  protocols: 
  forward: yes
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="1.1.1.3" port port="3306" protocol="tcp" reject
        rule family="ipv4" source address="1.1.1.3" port port="80" protocol="tcp" accept
        rule family="ipv4" source address="1.1.1.4" port port="3306" protocol="tcp" reject
        rule family="ipv4" source address="1.1.1.4" port port="80" protocol="tcp" accept
        rule family="ipv4" source ipset="allowlist" port port="3389" protocol="tcp" accept
        rule priority="32760" family="ipv4" source address="1.1.1.5" port port="3306" protocol="tcp" accept
        rule priority="32767" family="ipv4" port port="3306" protocol="tcp" reject
[root@fwd ~]#