CentOS7的firewall和安装iptables
前言：CentOS7 的防火墙默认使用是firewall，而我们通常使用iptables；
本文记录了firewall基础的命令和iptables的安装和使用。
firewall部分：
part1 : 服务命令
systemctl start firewalld#启动
systemctl status firewalld #查看运行状态
systemctl stop firewalld.service #停止firewall
systemctl disable firewalld.service #禁用：禁止firewall开机启动
firewall-cmd --state #
firewall-cmd--reload 重启
part2 : 端口命令：
添加
firewall-cmd --zone=public --add-port=80/tcp --permanent （--permanent永久生效，没有此参数重启后失效）
重新载入
firewall-cmd --reload
查看
firewall-cmd --zone= public --query-port=80/tcp
删除
firewall-cmd --zone= public --remove-port=80/tcp --permanent
part3:示例
示例：firewall端口操作完之后需要重启服务生效
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
- no
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3307/tcp --permanent
- success
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
- no
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload
- success
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
- yes
示例：mysql开放远程端口
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3306/tcp --permanent
- success
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload
- success
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --state
- running
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3306/tcp
- yes
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
iptables部分
part1 : 服务命令
systemctl start iptables #启动
systemctl status iptables #查看运行状态
systemctl restart iptables.service #停止iptables
systemctl stop iptables.service #停止iptables
systemctl disable iptables.service #禁用：禁止iptables开机启动
systemctl enable iptables.service #
part2 : 安装
step1 ： 查看是否安装
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
- Unit iptables.service could not be found.
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
没有相关服务
step2 : yum install
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# yum install iptables-services
- Loaded plugins: fastestmirror
- base | 3.6 kB 00:00:00
- epel | 4.3 kB 00:00:00
- extras | 3.4 kB 00:00:00
- mysql-connectors-community | 2.5 kB 00:00:00
- mysql-tools-community | 2.5 kB 00:00:00
- mysql56-community | 2.5 kB 00:00:00
- updates | 3.4 kB 00:00:00
- updates/7/x86_64/primary_db | 6.4 MB 00:00:06
- Loading mirror speeds from cached hostfile
- * base: mirrors.aliyuncs.com
- * epel: mirrors.aliyuncs.com
- * extras: mirrors.aliyuncs.com
- * updates: mirrors.aliyuncs.com
- Resolving Dependencies
- --> Running transaction check
- ---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed
- --> Finished Dependency Resolution
- Dependencies Resolved
- ========================================================================================================================================
- Package Arch Version Repository Size
- ========================================================================================================================================
- Installing:
- iptables-services x86_64 1.4.21-17.el7 base 50 k
- Transaction Summary
- ========================================================================================================================================
- Install 1 Package
- Total download size: 50 k
- Installed size: 24 k
- Is this ok [y/d/N]: Y
- Downloading packages:
- iptables-services-1.4.21-17.el7.x86_64.rpm | 50 kB 00:00:00
- Running transaction check
- Running transaction test
- Transaction test succeeded
- Running transaction
- Installing : iptables-services-1.4.21-17.el7.x86_64 1/1
- warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew
- Verifying : iptables-services-1.4.21-17.el7.x86_64 1/1
- Installed:
- iptables-services.x86_64 0:1.4.21-17.el7
- Complete!
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
安装成功！
step3 : check
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
- iptables.service - IPv4 firewall with iptables
- Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
- Active: inactive (dead)
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
step4 : start
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl start iptables
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl enable iptables.service
- Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
- iptables.service - IPv4 firewall with iptables
- Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
- Active: active (exited) since Wed 2017-06-21 15:44:41 CST; 1min 17s ago
- Main PID: 506 (code=exited, status=0/SUCCESS)
- Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Starting IPv4 firewall with iptables...
- Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ iptables.init[506]: iptables: Applying firewall rules: [ OK ]
- Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Started IPv4 firewall with iptables.
- [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
step5 : 修改配置文件
vi /etc/sysconfig/iptables
systemctl restart iptables.service #重启防火墙使配置生效
step6 ： 关闭SELINUX
vi/etc/selinux/config
#SELINUX=enforcing #注释掉
#SELINUXTYPE=targeted #注释掉
SELINUX=disabled #增加
:wq! #保存退出
setenforce 0 #使配置立即生效
备注：
SELINUX不关闭时，iptables不读取配置文件，一般采取关闭SELINUX的方式避免这种冲突
