06_防火墙相关操作

软件包：
]# yum -y install firewalld
]# systemctl start firewalld
]# systemctl status firewalld

1.查看防火墙区域
]# firewall-cmd --get-default-zone

2.修改默认区域为public
]# firewall-cmd --set-default-zone=public
]# firewall-cmd --get-default-zone

3.查看public区域规则
]# firewall-cmd --zone=public --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

4.永久添加http服务
]# firewall-cmd --permanent --zone=public --add-service=http
]# firewall-cmd --reload  # 重新加载防火墙所有永久策略
]# firewall-cmd --zone=public --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client http ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

5.永久删除http服务
]# firewall-cmd --permanent --zone=public --remove-service=http
]# firewall-cmd --reload

物理机访问测试
zk ~]# firefox 10.10.11.10
连接失败！
Firefox 无法建立到 10.10.11.10 服务器的连接。

7.单独拒绝test1（10.10.11.11）访问 黑名单
]# firewall-cmd --zone=block --add-source=10.10.11.11
]# firewall-cmd --zone=block --list-all
block (active)
  target: %%REJECT%%
  icmp-block-inversion: no
  interfaces:
  sources: 10.10.11.11
  services:
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

test1进行ping操作
test1 ~]# ping 10.10.11.10
PING 10.10.11.10 (10.10.11.10) 56(84) bytes of data.
From 10.10.11.10 icmp_seq=1 Destination Host Prohibited
From 10.10.11.10 icmp_seq=2 Destination Host Prohibited
From 10.10.11.10 icmp_seq=3 Destination Host Prohibited

移除黑名单
]# firewall-cmd --zone=block --remove-source=10.10.11.11

8.端口重定向
• 本地应用的端口重定向(5423 -----> 80)
– 从客户机访问5423 的请求,自动映射到本机80

比如,访问以下两个地址可以看到相同的页面:
客户端访问--->10.10.11.10:5423--->防火墙--->172.25.0.11:80
]# firewall-cmd --permanent --zone=public --add-forward-port=port=5423:proto=tcp:toport=80
]# firewall-cmd --reload
]# firewall-cmd --zone=public --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client http ssh
  ports:
  protocols:
  masquerade: no
  forward-ports: port=5423:proto=tcp:toport=80:toaddr=
  source-ports:
  icmp-blocks:
  rich rules:

物理机访问测试：
zk~]# firefox 10.10.11.10:5423