防火墙状态及规则
查看防火墙状态:firewall-cmd --state
1[root@localhost ~]# firewall-cmd --state
2running
查看防火墙:firewall-cmd --list-all
1[root@localhost ~]# firewall-cmd --list-all
2public (active)
3 target: default
4 icmp-block-inversion: no
5 interfaces: eth0
6 sources:
7 services: dhcpv6-client http
8 ports: 999/tcp
9 protocols:
10 masquerade: no
11 forward-ports:
12 source-ports:
13 icmp-blocks:
14 rich rules:
更新防火墙规则:firewall-cmd --reload
1[root@localhost ~]# firewall-cmd --reload
2success
端口
临时增加(reload之后消失):不需要reload
1[root@localhost ~]# firewall-cmd --add-port=999/tcp
2success
3[root@localhost ~]# firewall-cmd --query-port=999/tcp
4yes
5[root@localhost ~]# firewall-cmd --reload
6success
7[root@localhost ~]# firewall-cmd --query-port=999/tcp
8no
永久增加:reload后生效
1[root@localhost ~]# firewall-cmd --permanent --add-port=999/tcp
2success
3[root@localhost ~]# firewall-cmd --reload
4success
5[root@localhost ~]# firewall-cmd --query-port=999/tcp
6yes
临时删除端口:reload后消失
1[root@localhost ~]# firewall-cmd --remove-port=999/tcp
2success
3[root@localhost ~]# firewall-cmd --query-port=999/tcp
4no
5[root@localhost ~]# firewall-cmd --reload
6success
7[root@localhost ~]# firewall-cmd --query-port=999/tcp
8yes
永久删除端口:reload后生效
1[root@localhost ~]# firewall-cmd --permanent --remove-port=999/tcp
2success
3[root@localhost ~]# firewall-cmd --query-port=999/tcp
4yes
5[root@localhost ~]# firewall-cmd --reload
6success
7[root@localhost ~]# firewall-cmd --query-port=999/tcp
8no
查询端口
1[root@localhost ~]# firewall-cmd --query-port=999/tcp
2yes
查看所有放行的端口
1[root@localhost ~]# firewall-cmd --list-ports
2999/tcp
IP
防火墙添加允许访问的IP
注:添加允许访问的IP后,需要reload才能生效
1[root@localhost logs]# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="10.45.2.35" accept' --permanent
2success
3[root@localhost logs]# firewall-cmd --reload
4success
服务
防火墙服务的状态
1[root@localhost ~]# systemctl status firewalld.service
2● firewalld.service - firewalld - dynamic firewall daemon
3 Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
4 Active: active (running) since 五 2021-10-29 11:09:30 CST; 3 days ago
5 Docs: man:firewalld(1)
6 Main PID: 42215 (firewalld)
7 CGroup: /system.slice/firewalld.service
8 └─42215 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid
9
1010月 29 11:09:30 localhost.localdomain systemd[1]: Starting firewalld - dyna...
1110月 29 11:09:30 localhost.localdomain systemd[1]: Started firewalld - dynam...
1211月 02 10:22:44 localhost.localdomain firewalld[42215]: WARNING: ALREADY_EN...
1311月 02 10:23:29 localhost.localdomain firewalld[42215]: WARNING: ALREADY_EN...
14Hint: Some lines were ellipsized, use -l to show in full.
启动/关闭防火墙
1[root@localhost ~]# systemctl stop firewalld.service
2[root@localhost ~]# systemctl start firewalld.service
获取所有支持的服务
1[root@localhost ~]# firewall-cmd --get-services
2RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry docker-swarm dropbox-lansync elasticsearch freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master git gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target jenkins kadmin kerberos kibana klogin kpasswd kprop kshell ldap ldaps libvirt libvirt-tls managesieve mdns minidlna mongodb mosh mountd ms-wbt mssql murmur mysql nfs nfs3 nmea-0183 nrpe ntp openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster quassel radius redis rpc-bind rsh rsyncd samba samba-client sane sip sips smtp smtp-submission smtps snmp snmptrap spideroak-lansync squid ssh syncthing syncthing-gui synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server
增加服务(临时增加)
1[root@localhost ~]# firewall-cmd --add-service=https
2success
3[root@localhost ~]# firewall-cmd --query-service=https
4yes
5[root@localhost ~]# firewall-cmd --reload
6success
7[root@localhost ~]# firewall-cmd --query-service=https
8no
删除服务(临时删除)
1[root@localhost ~]# firewall-cmd --query-service=https
2yes
3[root@localhost ~]# firewall-cmd --remove-service=https
4success
5[root@localhost ~]# firewall-cmd --query-service=https
6no
7[root@localhost ~]# firewall-cmd --reload
8success
9[root@localhost ~]# firewall-cmd --query-service=https
10no
查询服务
1[root@localhost ~]# firewall-cmd --query-service=https
2yes
增加服务(永久)
1[root@localhost bin]# firewall-cmd --permanent --add-service=http
2success
3[root@localhost bin]# firewall-cmd --reload
4success
5[root@localhost bin]# firewall-cmd --query-service=http
6yes
删除服务(永久)
1[root@localhost bin]# firewall-cmd --permanent --remove-service=ssh
2success
3[root@localhost bin]# firewall-cmd --reload
4success
5[root@localhost bin]# firewall-cmd --query-servicessh
6no