返回总目录页

CentOS7 防火墙（firewall）的命令详解

 

复制代码
安装：yum install firewalld
 

1、firewalld的基本使用
启动： systemctl start firewalld
查看状态： systemctl status firewalld 
禁用，禁止开机启动： systemctl disable firewalld
停止运行： systemctl stop firewalld
 
 

2.配置firewalld-cmd
查看版本： firewall-cmd --version
查看帮助： firewall-cmd --help
显示状态： firewall-cmd --state
查看所有打开的端口： firewall-cmd --zone=public --list-ports
更新防火墙规则： firewall-cmd --reload
更新防火墙规则，重启服务： firewall-cmd --completely-reload
查看已激活的Zone信息:  firewall-cmd --get-active-zones
查看指定接口所属区域： firewall-cmd --get-zone-of-interface=eth0
拒绝所有包：firewall-cmd --panic-on
取消拒绝状态： firewall-cmd --panic-off
查看是否拒绝： firewall-cmd --query-panic
 
3.信任级别，通过Zone的值指定
drop: 丢弃所有进入的包，而不给出任何响应 
block: 拒绝所有外部发起的连接，允许内部发起的连接 
public: 允许指定的进入连接 
external: 同上，对伪装的进入连接，一般用于路由转发 
dmz: 允许受限制的进入连接 
work: 允许受信任的计算机被限制的进入连接，类似 workgroup 
home: 同上，类似 homegroup 
internal: 同上，范围针对所有互联网用户 
trusted: 信任所有连接

4.firewall开启和关闭端口
以下都是指在public的zone下的操作，不同的Zone只要改变Zone后面的值就可以
永久添加指定开放端口：
firewall-cmd --zone=public --add-port=80/tcp --permanent    （--permanent永久生效，没有此参数重启后失效）
重新载入(修改防火墻后，不重载就不生效)：
firewall-cmd --reload
查看指定端口状态，开发返回yes，否则no：
firewall-cmd --zone=public --query-port=80/tcp
删除：
firewall-cmd --zone=public --remove-port=80/tcp --permanent
 
5.管理服务
以smtp服务为例， 添加到work zone
添加：
firewall-cmd --zone=work --add-service=smtp
查看：
firewall-cmd --zone=work --query-service=smtp
删除：
firewall-cmd --zone=work --remove-service=smtp
 
5.配置 IP 地址伪装
查看：
firewall-cmd --zone=external --query-masquerade
打开：
firewall-cmd --zone=external --add-masquerade
关闭：
firewall-cmd --zone=external --remove-masquerade
 
6.端口转发
打开端口转发，首先需要打开IP地址伪装
　　firewall-cmd --zone=external --add-masquerade
 
转发 tcp 22 端口至 3753：
firewall-cmd --zone=external --add-forward-port=22:porto=tcp:toport=3753
转发端口数据至另一个IP的相同端口：
firewall-cmd --zone=external --add-forward-port=22:porto=tcp:toaddr=192.168.1.112
转发端口数据至另一个IP的 3753 端口：
firewall-cmd --zone=external --add-forward-port=22:porto=tcp:：toport=3753:toaddr=192.168.1.112
 
6.systemctl是CentOS7的服务管理工具中主要的工具，它融合之前service和chkconfig的功能于一体。
启动一个服务：systemctl start firewalld.service
关闭一个服务：systemctl stop firewalld.service
重启一个服务：systemctl restart firewalld.service
显示一个服务的状态：systemctl status firewalld.service
在开机时启用一个服务：systemctl enable firewalld.service
在开机时禁用一个服务：systemctl disable firewalld.service
查看服务是否开机启动：systemctl is-enabled firewalld.service
查看已启动的服务列表：systemctl list-unit-files|grep enabled
查看启动失败的服务列表：systemctl --failed
命令集合

 常用命令演示

[root@mcw1 ~]# systemctl status firewalld #一开始就是开启的
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2021-11-12 08:01:10 CST; 8min ago
Docs: man:firewalld(1)
Main PID: 957 (firewalld)
CGroup: /system.slice/firewalld.service
└─957 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Nov 12 08:01:06 mcw1 systemd[1]: Starting firewalld - dynamic firewall daemon...
Nov 12 08:01:10 mcw1 systemd[1]: Started firewalld - dynamic firewall daemon.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
[root@mcw1 ~]# systemctl stop firewalld #关闭防火墙
[root@mcw1 ~]# systemctl status firewalld #关掉了
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Fri 2021-11-12 08:10:09 CST; 4s ago
Docs: man:firewalld(1)
Process: 957 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=exited, status=0/SUCCESS)
Main PID: 957 (code=exited, status=0/SUCCESS)

Nov 12 08:01:06 mcw1 systemd[1]: Starting firewalld - dynamic firewall daemon...
Nov 12 08:01:10 mcw1 systemd[1]: Started firewalld - dynamic firewall daemon.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Nov 12 08:01:13 mcw1 firewalld[957]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Nov 12 08:10:09 mcw1 systemd[1]: Stopping firewalld - dynamic firewall daemon...
Nov 12 08:10:09 mcw1 systemd[1]: Stopped firewalld - dynamic firewall daemon.
[root@mcw1 ~]# systemctl start firewalld #开启防火墙
[root@mcw1 ~]# systemctl status firewalld #开启了
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Fri 2021-11-12 08:10:32 CST; 2s ago
Docs: man:firewalld(1)
Main PID: 1536 (firewalld)
CGroup: /system.slice/firewalld.service
└─1536 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Nov 12 08:10:32 mcw1 systemd[1]: Starting firewalld - dynamic firewall daemon...
Nov 12 08:10:32 mcw1 systemd[1]: Started firewalld - dynamic firewall daemon.
Nov 12 08:10:32 mcw1 firewalld[1536]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6.
Nov 12 08:10:32 mcw1 firewalld[1536]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Nov 12 08:10:32 mcw1 firewalld[1536]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Nov 12 08:10:32 mcw1 firewalld[1536]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Nov 12 08:10:32 mcw1 firewalld[1536]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Nov 12 08:10:32 mcw1 firewalld[1536]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.

[root@mcw1 ~]# firewall-cmd --version #查看版本：
0.4.4.4
[root@mcw1 ~]# firewall-cmd --help #查看帮助：

Usage: firewall-cmd [OPTIONS...]

General Options
-h, --help Prints a short help text and exists
-V, --version Print the version string of firewalld
-q, --quiet Do not print status messages

Status Options
--state Return and print firewalld state
--reload Reload firewall and keep state information
--complete-reload Reload firewall and lose state information
--runtime-to-permanent
Create permanent from runtime configuration

Log Denied Options
--get-log-denied Print the log denied value
--set-log-denied=<value>
Set log denied value

Automatic Helpers Options
--get-automatic-helpers
Print the automatic helpers value
--set-automatic-helpers=<value>
Set automatic helpers value

Permanent Options
--permanent Set an option permanently
Usable for options marked with [P]

Zone Options
--get-default-zone Print default zone for connections and interfaces
--set-default-zone=<zone>
Set default zone
--get-active-zones Print currently active zones
--get-zones Print predefined zones [P]
--get-services Print predefined services [P]
--get-icmptypes Print predefined icmptypes [P]
--get-zone-of-interface=<interface>
Print name of the zone the interface is bound to [P]
--get-zone-of-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Print name of the zone the source is bound to [P]
--list-all-zones List everything added for or enabled in all zones [P]
--new-zone=<zone> Add a new zone [P only]
--new-zone-from-file=<filename> [--name=<zone>]
Add a new zone from file with optional name [P only]
--delete-zone=<zone> Delete an existing zone [P only]
--load-zone-defaults=<zone>
Load zone default settings [P only] [Z]
--zone=<zone> Use this zone to set or query options, else default zone
Usable for options marked with [Z]
--get-target Get the zone target [P only] [Z]
--set-target=<target>
Set the zone target [P only] [Z]
--info-zone=<zone> Print information about a zone
--path-zone=<zone> Print file path of a zone [P only]

IPSet Options
--get-ipset-types Print the supported ipset types
--new-ipset=<ipset> --type=<ipset type> [--option=<key>[=<value>]]..
Add a new ipset [P only]
--new-ipset-from-file=<filename> [--name=<ipset>]
Add a new ipset from file with optional name [P only]
--delete-ipset=<ipset>
Delete an existing ipset [P only]
--load-ipset-defaults=<ipset>
Load ipset default settings [P only]
--info-ipset=<ipset> Print information about an ipset
--path-ipset=<ipset> Print file path of an ipset [P only]
--get-ipsets Print predefined ipsets
--ipset=<ipset> --set-description=<description>
Set new description to ipset [P only]
--ipset=<ipset> --get-description
Print description for ipset [P only]
--ipset=<ipset> --set-short=<description>
Set new short description to ipset [P only]
--ipset=<ipset> --get-short
Print short description for ipset [P only]
--ipset=<ipset> --add-entry=<entry>
Add a new entry to an ipset [P]
--ipset=<ipset> --remove-entry=<entry>
Remove an entry from an ipset [P]
--ipset=<ipset> --query-entry=<entry>
Return whether ipset has an entry [P]
--ipset=<ipset> --get-entries
List entries of an ipset [P]
--ipset=<ipset> --add-entries-from-file=<entry>
Add a new entries to an ipset [P]
--ipset=<ipset> --remove-entries-from-file=<entry>
Remove entries from an ipset [P]

IcmpType Options
--new-icmptype=<icmptype>
Add a new icmptype [P only]
--new-icmptype-from-file=<filename> [--name=<icmptype>]
Add a new icmptype from file with optional name [P only]
--delete-icmptype=<icmptype>
Delete an existing icmptype [P only]
--load-icmptype-defaults=<icmptype>
Load icmptype default settings [P only]
--info-icmptype=<icmptype>
Print information about an icmptype
--path-icmptype=<icmptype>
Print file path of an icmptype [P only]
--icmptype=<icmptype> --set-description=<description>
Set new description to icmptype [P only]
--icmptype=<icmptype> --get-description
Print description for icmptype [P only]
--icmptype=<icmptype> --set-short=<description>
Set new short description to icmptype [P only]
--icmptype=<icmptype> --get-short
Print short description for icmptype [P only]
--icmptype=<icmptype> --add-destination=<ipv>
Enable destination for ipv in icmptype [P only]
--icmptype=<icmptype> --remove-destination=<ipv>
Disable destination for ipv in icmptype [P only]
--icmptype=<icmptype> --query-destination=<ipv>
Return whether destination ipv is enabled in icmptype [P only]
--icmptype=<icmptype> --get-destinations
List destinations in icmptype [P only]

Service Options
--new-service=<service>
Add a new service [P only]
--new-service-from-file=<filename> [--name=<service>]
Add a new service from file with optional name [P only]
--delete-service=<service>
Delete an existing service [P only]
--load-service-defaults=<service>
Load icmptype default settings [P only]
--info-service=<service>
Print information about a service
--path-service=<service>
Print file path of a service [P only]
--service=<service> --set-description=<description>
Set new description to service [P only]
--service=<service> --get-description
Print description for service [P only]
--service=<service> --set-short=<description>
Set new short description to service [P only]
--service=<service> --get-short
Print short description for service [P only]
--service=<service> --add-port=<portid>[-<portid>]/<protocol>
Add a new port to service [P only]
--service=<service> --remove-port=<portid>[-<portid>]/<protocol>
Remove a port from service [P only]
--service=<service> --query-port=<portid>[-<portid>]/<protocol>
Return whether the port has been added for service [P only]
--service=<service> --get-ports
List ports of service [P only]
--service=<service> --add-protocol=<protocol>
Add a new protocol to service [P only]
--service=<service> --remove-protocol=<protocol>
Remove a protocol from service [P only]
--service=<service> --query-protocol=<protocol>
Return whether the protocol has been added for service [P only]
--service=<service> --get-protocols
List protocols of service [P only]
--service=<service> --add-source-port=<portid>[-<portid>]/<protocol>
Add a new source port to service [P only]
--service=<service> --remove-source-port=<portid>[-<portid>]/<protocol>
Remove a source port from service [P only]
--service=<service> --query-source-port=<portid>[-<portid>]/<protocol>
Return whether the source port has been added for service [P only]
--service=<service> --get-source-ports
List source ports of service [P only]
--service=<service> --add-module=<module>
Add a new module to service [P only]
--service=<service> --remove-module=<module>
Remove a module from service [P only]
--service=<service> --query-module=<module>
Return whether the module has been added for service [P only]
--service=<service> --get-modules
List modules of service [P only]
--service=<service> --set-destination=<ipv>:<address>[/<mask>]
Set destination for ipv to address in service [P only]
--service=<service> --remove-destination=<ipv>
Disable destination for ipv i service [P only]
--service=<service> --query-destination=<ipv>:<address>[/<mask>]
Return whether destination ipv is set for service [P only]
--service=<service> --get-destinations
List destinations in service [P only]

Options to Adapt and Query Zones
--list-all List everything added for or enabled in a zone [P] [Z]
--list-services List services added for a zone [P] [Z]
--timeout=<timeval> Enable an option for timeval time, where timeval is
a number followed by one of letters 's' or 'm' or 'h'
Usable for options marked with [T]
--set-description=<description>
Set new description to zone [P only] [Z]
--get-description Print description for zone [P only] [Z]
--set-short=<description>
Set new short description to zone [P only] [Z]
--get-short Print short description for zone [P only] [Z]
--add-service=<service>
Add a service for a zone [P] [Z] [T]
--remove-service=<service>
Remove a service from a zone [P] [Z]
--query-service=<service>
Return whether service has been added for a zone [P] [Z]
--list-ports List ports added for a zone [P] [Z]
--add-port=<portid>[-<portid>]/<protocol>
Add the port for a zone [P] [Z] [T]
--remove-port=<portid>[-<portid>]/<protocol>
Remove the port from a zone [P] [Z]
--query-port=<portid>[-<portid>]/<protocol>
Return whether the port has been added for zone [P] [Z]
--list-protocols List protocols added for a zone [P] [Z]
--add-protocol=<protocol>
Add the protocol for a zone [P] [Z] [T]
--remove-protocol=<protocol>
Remove the protocol from a zone [P] [Z]
--query-protocol=<protocol>
Return whether the protocol has been added for zone [P] [Z]
--list-source-ports List source ports added for a zone [P] [Z]
--add-source-port=<portid>[-<portid>]/<protocol>
Add the source port for a zone [P] [Z] [T]
--remove-source-port=<portid>[-<portid>]/<protocol>
Remove the source port from a zone [P] [Z]
--query-source-port=<portid>[-<portid>]/<protocol>
Return whether the source port has been added for zone [P] [Z]
--list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z]
--add-icmp-block=<icmptype>
Add an ICMP block for a zone [P] [Z] [T]
--remove-icmp-block=<icmptype>
Remove the ICMP block from a zone [P] [Z]
--query-icmp-block=<icmptype>
Return whether an ICMP block has been added for a zone
[P] [Z]
--add-icmp-block-inversion
Enable inversion of icmp blocks for a zone [P] [Z]
--remove-icmp-block-inversion
Disable inversion of icmp blocks for a zone [P] [Z]
--query-icmp-block-inversion
Return whether inversion of icmp blocks has been enabled
for a zone [P] [Z]
--list-forward-ports List IPv4 forward ports added for a zone [P] [Z]
--add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Add the IPv4 forward port for a zone [P] [Z] [T]
--remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Remove the IPv4 forward port from a zone [P] [Z]
--query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
Return whether the IPv4 forward port has been added for
a zone [P] [Z]
--add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T]
--remove-masquerade Disable IPv4 masquerade for a zone [P] [Z]
--query-masquerade Return whether IPv4 masquerading has been enabled for a
zone [P] [Z]
--list-rich-rules List rich language rules added for a zone [P] [Z]
--add-rich-rule=<rule>
Add rich language rule 'rule' for a zone [P] [Z] [T]
--remove-rich-rule=<rule>
Remove rich language rule 'rule' from a zone [P] [Z]
--query-rich-rule=<rule>
Return whether a rich language rule 'rule' has been
added for a zone [P] [Z]

Options to Handle Bindings of Interfaces
--list-interfaces List interfaces that are bound to a zone [P] [Z]
--add-interface=<interface>
Bind the <interface> to a zone [P] [Z]
--change-interface=<interface>
Change zone the <interface> is bound to [Z]
--query-interface=<interface>
Query whether <interface> is bound to a zone [P] [Z]
--remove-interface=<interface>
Remove binding of <interface> from a zone [P] [Z]

Options to Handle Bindings of Sources
--list-sources List sources that are bound to a zone [P] [Z]
--add-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Bind the source to a zone [P] [Z]
--change-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Change zone the source is bound to [Z]
--query-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Query whether the source is bound to a zone [P] [Z]
--remove-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
Remove binding of the source from a zone [P] [Z]

Helper Options
--new-helper=<helper> --module=<module> [--family=<family>]
Add a new helper [P only]
--new-helper-from-file=<filename> [--name=<helper>]
Add a new helper from file with optional name [P only]
--delete-helper=<helper>
Delete an existing helper [P only]
--load-helper-defaults=<helper>
Load helper default settings [P only]
--info-helper=<helper> Print information about an helper
--path-helper=<helper> Print file path of an helper [P only]
--get-helpers Print predefined helpers
--helper=<helper> --set-description=<description>
Set new description to helper [P only]
--helper=<helper> --get-description
Print description for helper [P only]
--helper=<helper> --set-short=<description>
Set new short description to helper [P only]
--helper=<helper> --get-short
Print short description for helper [P only]
--helper=<helper> --add-port=<portid>[-<portid>]/<protocol>
Add a new port to helper [P only]
--helper=<helper> --remove-port=<portid>[-<portid>]/<protocol>
Remove a port from helper [P only]
--helper=<helper> --query-port=<portid>[-<portid>]/<protocol>
Return whether the port has been added for helper [P only]
--helper=<helper> --get-ports
List ports of helper [P only]
--helper=<helper> --set-module=<module>
Set module to helper [P only]
--helper=<helper> --get-module
Get module from helper [P only]
--helper=<helper> --set-family={ipv4|ipv6|}
Set family for helper [P only]
--helper=<helper> --get-family
Get module from helper [P only]

Direct Options
--direct First option for all direct options
--get-all-chains
Get all chains [P]
--get-chains {ipv4|ipv6|eb} <table>
Get all chains added to the table [P]
--add-chain {ipv4|ipv6|eb} <table> <chain>
Add a new chain to the table [P]
--remove-chain {ipv4|ipv6|eb} <table> <chain>
Remove the chain from the table [P]
--query-chain {ipv4|ipv6|eb} <table> <chain>
Return whether the chain has been added to the table [P]
--get-all-rules
Get all rules [P]
--get-rules {ipv4|ipv6|eb} <table> <chain>
Get all rules added to chain in table [P]
--add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
Add rule to chain in table [P]
--remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
Remove rule with priority from chain in table [P]
--remove-rules {ipv4|ipv6|eb} <table> <chain>
Remove rules from chain in table [P]
--query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
Return whether a rule with priority has been added to
chain in table [P]
--passthrough {ipv4|ipv6|eb} <arg>...
Pass a command through (untracked by firewalld)
--get-all-passthroughs
Get all tracked passthrough rules [P]
--get-passthroughs {ipv4|ipv6|eb} <arg>...
Get tracked passthrough rules [P]
--add-passthrough {ipv4|ipv6|eb} <arg>...
Add a new tracked passthrough rule [P]
--remove-passthrough {ipv4|ipv6|eb} <arg>...
Remove a tracked passthrough rule [P]
--query-passthrough {ipv4|ipv6|eb} <arg>...
Return whether the tracked passthrough rule has been
added [P]

Lockdown Options
--lockdown-on Enable lockdown.
--lockdown-off Disable lockdown.
--query-lockdown Query whether lockdown is enabled

Lockdown Whitelist Options
--list-lockdown-whitelist-commands
List all command lines that are on the whitelist [P]
--add-lockdown-whitelist-command=<command>
Add the command to the whitelist [P]
--remove-lockdown-whitelist-command=<command>
Remove the command from the whitelist [P]
--query-lockdown-whitelist-command=<command>
Query whether the command is on the whitelist [P]
--list-lockdown-whitelist-contexts
List all contexts that are on the whitelist [P]
--add-lockdown-whitelist-context=<context>
Add the context context to the whitelist [P]
--remove-lockdown-whitelist-context=<context>
Remove the context from the whitelist [P]
--query-lockdown-whitelist-context=<context>
Query whether the context is on the whitelist [P]
--list-lockdown-whitelist-uids
List all user ids that are on the whitelist [P]
--add-lockdown-whitelist-uid=<uid>
Add the user id uid to the whitelist [P]
--remove-lockdown-whitelist-uid=<uid>
Remove the user id uid from the whitelist [P]
--query-lockdown-whitelist-uid=<uid>
Query whether the user id uid is on the whitelist [P]
--list-lockdown-whitelist-users
List all user names that are on the whitelist [P]
--add-lockdown-whitelist-user=<user>
Add the user name user to the whitelist [P]
--remove-lockdown-whitelist-user=<user>
Remove the user name user from the whitelist [P]
--query-lockdown-whitelist-user=<user>
Query whether the user name user is on the whitelist [P]

Panic Options
--panic-on Enable panic mode
--panic-off Disable panic mode
--query-panic Query whether panic mode is enabled

[root@mcw1 ~]# firewall-cmd --state #显示状态：
running
[root@mcw1 ~]# firewall-cmd --zone=public --list-ports #查看所有打开的端口：

[root@mcw1 ~]# firewall-cmd --get-active-zones #查看已激活的Zone信息:。实际显示了所拥有的两个网卡接口
interfaces: ens33 ens37
[root@mcw1 ~]# ip a
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens33: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:d3:09:d5 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.131/24 brd 10.0.0.255 scope global ens33
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fed3:9d5/64 scope link
valid_lft forever preferred_lft forever
3: ens37: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 00:0c:29:d3:09:df brd ff:ff:ff:ff:ff:ff
inet 172.16.1.131/24 brd 172.16.1.255 scope global ens37
valid_lft forever preferred_lft forever
inet6 fe80::20c:29ff:fed3:9df/64 scope link
valid_lft forever preferred_lft forever

[root@mcw1 ~]# firewall-cmd --query-panic #查看是否拒绝
no
[root@mcw1 ~]# firewall-cmd --panic-on #拒绝所有包，连xshell也连接不上了，危险命令

Connection closed by foreign host.

Disconnected from remote host(mcw1) at 00:20:04.

Type `help' to learn how to use Xshell prompt.
[c:\~]$

Connecting to 10.0.0.131:22...
Could not connect to '10.0.0.131' (port 22): Connection failed.

Type `help' to learn how to use Xshell prompt.

取消拒绝状态： firewall-cmd --panic-off vmveare执行完之后，重新连上xshell
[root@mcw1 ~]# firewall-cmd --get-zone-of-interface=eth0 #查看指定接口所属区域，没有的网卡
no zone
[root@mcw1 ~]# firewall-cmd --get-zone-of-interface=ens33 #存在的网卡
public
[root@mcw1 ~]# firewall-cmd --get-zone-of-interface=ens37
public
[root@mcw1 ~]# firewall-cmd --get-active-zones #查看已激活的Zone信息:
public
interfaces: ens33 ens37


======================

防火墙开放端口演示
mcw1上装个Nginx，启动正常访问
[root@mcw1 ~]# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
[root@mcw1 ~]# nginx
[root@mcw1 ~]# ps -ef|grep nginx
root 1925 1 0 08:33 ? 00:00:00 nginx: master process nginx
nginx 1926 1925 0 08:33 ? 00:00:00 nginx: worker process
root 1928 1829 0 08:33 pts/0 00:00:00 grep --color=auto nginx
[root@mcw1 ~]# curl -I 10.0.0.131:80
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 12 Nov 2021 00:34:31 GMT
Content-Type: text/html
Content-Length: 4833
Last-Modified: Fri, 16 May 2014 15:12:48 GMT
Connection: keep-alive
ETag: "53762af0-12e1"
Accept-Ranges: bytes

在mcw2上访问mcw1上80端口，被防火墙挡住了
[root@mcw2 ~]# curl -I 10.0.0.131:80
curl: (7) Failed connect to 10.0.0.131:80; No route to host

在mcw1上添加开放端口。下面是在public的zone下的操作，不同的Zone只要改变Zone后面的值就可以
[root@mcw1 ~]# firewall-cmd --state
running
[root@mcw1 ~]# firewall-cmd --zone=public --add-port=80/tcp --permanent #--permanent永久生效，没有此参数重启后失效）
success

在mcw2上访问开放端口，还是被挡住了
[root@mcw2 ~]# curl -I 10.0.0.131:80
curl: (7) Failed connect to 10.0.0.131:80; No route to host

在mcw1上更新防火墙规则：
[root@mcw1 ~]# firewall-cmd --reload
success

在mcw2上访问开放端口服务，已经能正常访问了 。以后添加了开放端口，更改了防火墙规则，需要重载参数更新规则才能生效。并且更新之后检验是否生效
[root@mcw2 ~]# curl -I 10.0.0.131:80
HTTP/1.1 200 OK
Server: nginx/1.20.1
Date: Fri, 12 Nov 2021 00:43:03 GMT
Content-Type: text/html
Content-Length: 4833
Last-Modified: Fri, 16 May 2014 15:12:48 GMT
Connection: keep-alive
ETag: "53762af0-12e1"
Accept-Ranges: bytes

mcw1上现在查看所有打开的端口，能看到80端口
[root@mcw1 ~]# firewall-cmd --zone=public --list-ports
80/tcp

查询指定端口状态
[root@mcw1 ~]# firewall-cmd --zone=public --query-port=80/tcp
yes

[root@mcw1 ~]# firewall-cmd --zone=public --remove-port=80/tcp --permanent #永久删除指定端口(关闭指定端口开放)
success
[root@mcw1 ~]# firewall-cmd --zone=public --query-port=80/tcp #移除未生效
yes
[root@mcw1 ~]# firewall-cmd --reload #重载规则
success
[root@mcw1 ~]# firewall-cmd --zone=public --query-port=80/tcp #重载之后移除端口已生效
no
[root@mcw1 ~]# firewall-cmd --zone=public --list-ports #查看所有开放端口，已经没有显示它的端口了。

[root@mcw1 ~]#

 

 

 

 

 

 

 

 

参考：https://www.cnblogs.com/leoxuan/p/8275343.html

 https://blog.51cto.com/andyxu/2137046

posted @ 2021-11-12 00:07  马昌伟  阅读(2062)  评论(0)  编辑  收藏  举报
博主链接地址：https://www.cnblogs.com/machangwei-8/