#禁止ICMP timestamp
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p ICMP --icmp-type timestamp-request -m comment --comment "deny ICMP timestamp" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p ICMP --icmp-type timestamp-request -m comment --comment "deny ICMP timestamp" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p ICMP --icmp-type timestamp-reply -m comment --comment "deny ICMP timestamp" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p ICMP --icmp-type timestamp-reply -m comment --comment "deny ICMP timestamp" -j DROP
#禁止traceroute
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p ICMP --icmp-type 0 -m comment --comment "deny traceroute" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p ICMP --icmp-type 3 -m comment --comment "deny traceroute" -j DROP
firewall-cmd --permanent --direct --add-rule ipv4 filter OUTPUT 0 -p ICMP --icmp-type 11 -m comment --comment "deny traceroute" -j DROP
#取消禁止
firewall-cmd --permanent --direct --remove-rule ipv4 filter XXXXXXXXXXXXXXXXXXXXXXXX
#限制只有192.168.1.1可以访问22端口
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.1.1" port protocol="tcp" port="22" accept"
#取消限制限制只有192.168.1.1可以访问22端口
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="192.168.1.1" port protocol="tcp" port="22" accept"
#更新防火墙规则
firewall-cmd --reload
#删除默认ssh（提前确保配置好能访问规则）
firewall-cmd --permanent --remove-service=ssh
#查看设置的规则
firewall-cmd --direct --get-all-rules
#更新防火墙规则
firewall-cmd --reload
#查看所开放端口服务配置信息
firewall-cmd --list-all
