一、介绍
防火墙守护 firewalld 服务引入了一个信任级别的概念来管理与之相关联的连接与接口。它支持 ipv4 与 ipv6,并支持网桥,采用 firewall-cmd (command) 或 firewall-config (gui) 来动态的管理 kernel netfilter 的临时或永久的接口规则,并实时生效而无需重启服务。
Firewall 能将不同的网络连接归类到不同的信任级别,Zone 提供了以下几个级别
drop: 丢弃所有进入的包,而不给出任何响应
block: 拒绝所有外部发起的连接,允许内部发起的连接
public: 允许指定的进入连接
external: 同上,对伪装的进入连接,一般用于路由转发
dmz: 允许受限制的进入连接
work: 允许受信任的计算机被限制的进入连接,类似 workgroup
home: 同上,类似 homegroup
internal: 同上,范围针对所有互联网用户
trusted: 信任所有连接
二、安装
# yum install firewalld
如果需要图形界面的话,则再安装
# yum install firewall-config
三、使用方法
# 开启防火墙
systemctl start firewalld.service
# 防火墙开机启动
systemctl enable firewalld.service
# 关闭防火墙
systemctl stop firewalld.service
# 查看防火墙状态
firewall-cmd –state
# 查看现有的规则
iptables -nL
# 重载防火墙配置
firewall-cmd –reload
# 添加单个单端口
firewall-cmd –permanent –zone=public –add-port=81/tcp
# 添加多个端口
firewall-cmd –permanent –zone=public –add-port=8080-8083/tcp
# 删除某个端口
firewall-cmd –permanent –zone=public –remove-port=81/tcp
# 针对某个 IP开放端口
firewall-cmd –permanent –add-rich-rule=”rule family=”ipv4″ source address=”192.168.142.166″ port protocol=”tcp” port=”6379″ accept”
firewall-cmd –permanent –add-rich-rule=”rule family=”ipv4″ source address=”192.168.0.233″ accept”
# 删除某个IP
firewall-cmd –permanent –remove-rich-rule=”rule family=”ipv4″ source address=”192.168.1.51″ accept”
# 针对一个ip段访问
firewall-cmd –permanent –add-rich-rule=”rule family=”ipv4″ source address=”192.168.0.0/16″ accept”
firewall-cmd –permanent –add-rich-rule=”rule family=”ipv4″ source address=”192.168.1.0/24″ port protocol=”tcp” port=”9200″ accept”
# 添加操作后别忘了执行重载
firewall-cmd –reload
查看指定级别的所有信息,譬如 public
#firewall-cmd –zone=public –list-all
public (default, active)
interfaces: eth0
sources:
services: dhcpv6-client http ssh
ports:
masquerade: no
forward-ports:
icmp-blocks:
rich rules: