Linux firewalld使用教程+rhce课程实验
--timeout=300 设置规则生效300秒
调试阶段使用，防止规则设置错误导致无法远程连接
实验：
在server0机器上部署httpd服务，通过添加富规则，只允许172.25.0.10/32访问，并且记录日志，日志级别为notice,日志前注为"NEW HTTP"，限制每秒3个并发，要求持久化生效
1、在server0上执行
yum install httpd -y
systemctl start httpd
systemctl enable httpd
[root@server0 zones]# yum install httpd -y [root@server0 zones]# systemctl start httpd [root@server0 zones]# systemctl enable httpd ln -s '/usr/lib/systemd/system/httpd.service' '/etc/systemd/system/multi-user.target.wants/httpd.service' [root@server0 zones]# lsof -i:80 -n COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME httpd 8386 root 4u IPv6 44433 0t0 TCP *:http (LISTEN) httpd 8387 apache 4u IPv6 44433 0t0 TCP *:http (LISTEN) httpd 8388 apache 4u IPv6 44433 0t0 TCP *:http (LISTEN) httpd 8389 apache 4u IPv6 44433 0t0 TCP *:http (LISTEN) httpd 8390 apache 4u IPv6 44433 0t0 TCP *:http (LISTEN) httpd 8391 apache 4u IPv6 44433 0t0 TCP *:http (LISTEN) httpd 8392 apache 4u IPv6 44433 0t0 TCP *:http (LISTEN)
此时desktop机器是无法访问网页，但是server0机器可以看到网页
[root@desktop0 ~]# curl http://server0 curl: (7) Failed connect to server0:80; No route to host [root@server0 ~]# curl localhost hello world
因为firewalld中并没有允许http协议的连接连进来
[root@server0 ~]# firewall-cmd --list-all
You're performing an operation over default zone ('public'),
but your connections/interfaces are in zone 'ROL' (see --get-active-zones)
You most likely need to use --zone=ROL option.
public (default)
interfaces:
sources:
services: dhcpv6-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
所有的zones都没有允许，所以外部访问会被拦截
[root@server0 ~]# firewall-cmd --get-default-zone
public
[root@server0 ~]# firewall-cmd --list-all-zones
ROL
interfaces:
sources: 172.25.0.252/32
services: ssh vnc-server
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
block
interfaces:
sources:
services:
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
dmz
interfaces:
sources:
services: ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
drop
interfaces:
sources:
services:
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
external
interfaces:
sources:
services: ssh
ports:
masquerade: yes
forward-ports:
icmp-blocks:
rich rules:
home
interfaces:
sources:
services: dhcpv6-client ipp-client mdns samba-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
internal
interfaces:
sources:
services: dhcpv6-client ipp-client mdns samba-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
public (default)
interfaces:
sources:
services: dhcpv6-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
trusted
interfaces:
sources:
services:
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
work
interfaces:
sources:
services: dhcpv6-client ipp-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
我们设置一下防火墙的规则
[root@server0 ~]# firewall-cmd --permanent --add-rich-rule=' rule family=ipv4 source address="172.25.0.10/32" service name="http" log prefix="NEW HTTP " level=notice limit value="3/s" accept '
You're performing an operation over default zone ('public'),
but your connections/interfaces are in zone 'ROL' (see --get-active-zones)
You most likely need to use --zone=ROL option.
success
重新加载 一下
[root@server0 ~]# firewall-cmd --reload
success
查看规则，已经可以看到刚才添加的规则已生效
[root@server0 ~]# firewall-cmd --list-all
You're performing an operation over default zone ('public'),
but your connections/interfaces are in zone 'ROL' (see --get-active-zones)
You most likely need to use --zone=ROL option
public (default)
interfaces:
sources:
services: dhcpv6-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="172.25.0.10/32" service name="http" log prefix="NEW HTTP " level="notice" limit value="3/s" accept
查看firewalld xml文件
[root@server0 ~]# cat /usr/lib/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>Public</short>
<description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
<service name="ssh"/>
<service name="dhcpv6-client"/>
</zone>
[root@server0 ~]#
重新进行页面访问，发现已经可以访问了
[root@desktop0 ~]# curl http://172.25.0.11 hello world [root@desktop0 ~]#
查看日志，日志中已经记载出来了
[root@server0 ~]# cat /var/log/messages | tail -n 1 Dec 23 18:22:37 localhost kernel: NEW HTTP IN=eth0 OUT= MAC=52:54:00:00:00:0b:52:54:00:00:00:0a:08:00 SRC=172.25.0.10 DST=172.25.0.11 LEN=60 TOS=0x00 PREC=0x00 TTL=64 ID=8704 DF PROTO=TCP SPT=48464 DPT=80 WINDOW=14600 RES=0x00 SYN URGP=0 [root@server0 ~]#
附加：拒绝另一个地址链接，并且记录日志
添加一条规则，并且重新加载
[root@server0 ~]# firewall-cmd --permanent --add-rich-rule=' rule family=ipv4 source address="172.25.0.1/24" service name=http log level=notice prefix="HARD_LOG " reject '
You're performing an operation over default zone ('public'),
but your connections/interfaces are in zone 'ROL' (see --get-active-zones)
You most likely need to use --zone=ROL option.
success
[root@server0 ~]# firewall-cmd --reload
success
[root@server0 ~]# firewall-cmd --list-all
You're performing an operation over default zone ('public'),
but your connections/interfaces are in zone 'ROL' (see --get-active-zones)
You most likely need to use --zone=ROL option.
public (default)
interfaces:
sources:
services: dhcpv6-client ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="172.25.0.1/24" service name="http" log prefix="HARD_LOG " level="notice" reject
rule family="ipv4" source address="172.25.0.10/32" service name="http" log prefix="NEW HTTP " level="notice" limit value="3/s" accept
[root@server0 ~]#
另一个地址进行访问，但是没有访问进来，查看日志，可以看到访问记录
[root@server0 ~]# cat /var/log/messages | grep HARD_LOG Dec 23 18:40:51 localhost kernel: HARD_LOG IN=eth0 OUT= MAC=52:54:00:00:00:0b:00:50:56:c0:00:01:08:00 SRC=172.25.0.1 DST=172.25.0.11 LEN=52 TOS=0x00 PREC=0x00 TTL=128 ID=27789 DF PROTO=TCP SPT=56158 DPT=80 WINDOW=8192 RES=0x00 SYN URGP=0
