centos6,7 防火墙管理

刺骨的言语ヽ痛彻心扉 2021-10-20 00:42 823阅读 0赞

### 文章目录 ###

*  1, centos7防火墙
 *   *  a, firewalld管理service
     *  b, firewalld管理port
 *  2, centos6防火墙
 *   *  1, 查看规则
     *  2, 修改防火墙默认规则
     *  3, 添加规则：开放端口
     *  4, 删除规则
 *  3, iptables 内外网互通

参考博文：  
[https://www.cnblogs.com/pangguoming/p/5956151.html][https_www.cnblogs.com_pangguoming_p_5956151.html]  
[http://www.zsythink.net/archives/1517/][http_www.zsythink.net_archives_1517]  
[http://www.zsythink.net/archives/1199][http_www.zsythink.net_archives_1199]

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70]

# 1, centos7防火墙 #

## a, firewalld管理service ##

#1, 查看现有的service
    [root@docker ~]# ls /etc/firewalld/services/
    [root@docker ~]# ls /usr/lib/firewalld/services/
    amanda-client.xml        elasticsearch.xml        jenkins.xml      mysql.xml            ssh.xml  .....
    [root@docker ~]# cat /usr/lib/firewalld/services/ssh.xml 
    <?xml version="1.0" encoding="utf-8"?>
    <service>
      <short>SSH</short>
      <description>....</description>
      <port protocol="tcp" port="22"/>
    </service>
    
    #2,创建一个自定义的service: 统一管理相同类型的port
    [root@docker ~]# firewall-cmd --new-service=test --permanent
    success
    [root@docker ~]# firewall-cmd --set-description="new test service" --service=test --permanent
    success
    [root@docker ~]# firewall-cmd --service=test --add-port=8080/tcp --permanent
    success
    [root@docker ~]# cat /etc/firewalld/services/test.xml
    <?xml version="1.0" encoding="utf-8"?>
    <service>
      <description>new test service</description>
      <port protocol="tcp" port="8080"/>
    </service>
    
    #3，开放test service的所有端口
    [root@docker ~]# firewall-cmd --add-service=test --permanent
    success
    [root@docker ~]# firewall-cmd --reload
    success
    
    #4, 查看（test service）新增的规则
    [root@docker ~]# iptables -nL
    ....
    Chain IN_public_allow (1 references)
    target     prot opt source               destination         
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctstate NEW
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:8080 ctstate NEW

## b, firewalld管理port ##

*  批量添加多个端口： firewall-cmd --permanent --zone=public --add-port=100-500/tcp

#1, 查看已开放的端口
    [root@docker ~]# firewall-cmd --list-ports
    [root@docker ~]# iptables -nL
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination         
    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination         
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination        
    
    #2, 开放1521,3306端口
    [root@docker ~]# firewall-cmd --add-port=1521/tcp --zone=public --permanent
    success
    [root@docker ~]# firewall-cmd --add-port=3306/tcp --zone=public --permanent
    success
    
    #3, 重新加载配置：使得permanent配置的端口生效
    [root@docker ~]# firewall-cmd --reload
    success
    [root@docker ~]# firewall-cmd --list-all
    public (active)
      target: default
      icmp-block-inversion: no
      interfaces: enp0s3 enp0s8
      sources: 
      services: ssh dhcpv6-client
      ports: 1521/tcp 3306/tcp
      protocols: 
      masquerade: no
      forward-ports: 
      source-ports: 
      icmp-blocks: 
      rich rules: 
    
    #4, 查看防火墙配置文件
    [root@docker ~]# cat /etc/firewalld/zones/public.xml
    <?xml version="1.0" encoding="utf-8"?>
    <zone>
      <short>Public</short>
      <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
      <service name="ssh"/>
      <service name="dhcpv6-client"/>
      <port protocol="tcp" port="1521"/>
      <port protocol="tcp" port="3306"/>
    </zone>
    
    #5, 关闭已开放的端口
    [root@docker ~]# firewall-cmd --remove-port=3306/tcp
    success
    [root@docker ~]# firewall-cmd --list-port
    1521/tcp 
    [root@docker ~]# iptables -nL |tail -20
    target     prot opt source               destination         
    IN_public_log  all  --  0.0.0.0/0            0.0.0.0/0           
    IN_public_deny  all  --  0.0.0.0/0            0.0.0.0/0           
    IN_public_allow  all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
    
    Chain IN_public_allow (1 references)
    target     prot opt source               destination         
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctstate NEW
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            tcp dpt:1521 ctstate NEW

# 2, centos6防火墙 #

## 1, 查看规则 ##

### a,通过命令查看
    #默认只开放22端口
    [root@s111 sysconfig]# iptables -nL    #或者service iptables status
    Chain INPUT (policy ACCEPT)
    target     prot opt source               destination         
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 
    
    Chain FORWARD (policy ACCEPT)
    target     prot opt source               destination         
    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 
    
    Chain OUTPUT (policy ACCEPT)
    target     prot opt source               destination        
    
    
    ### b,通过配置文件查看
    #防火墙规则的配置文件是：/etc/sysconfig/iptables
    [root@s111 sysconfig]# cat /etc/sysconfig/iptables
    # Generated by iptables-save v1.4.7 on Tue Aug 20 16:52:51 2019　　#每次重新保存配置的时间
    *filter
    :INPUT ACCEPT [0:0]
    :FORWARD ACCEPT [0:0]
    :OUTPUT ACCEPT [160:16916]
    -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT 
    -A INPUT -p icmp -j ACCEPT 
    -A INPUT -i lo -j ACCEPT 
    -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT 
    -A INPUT -j REJECT --reject-with icmp-host-prohibited 
    -A FORWARD -j REJECT --reject-with icmp-host-prohibited 
    COMMIT

## 2, 修改防火墙默认规则 ##

#允许常用连接操作: ssh登录, ping主机
    iptables -I INPUT -p tcp --dport 22 -j ACCEPT
    iptables -I OUTPUT -p tcp --sport 22 -j ACCEPT
    iptables -A INPUT -p icmp --icmp 8 -j ACCEPT
    iptables -A OUTPUT -p icmp --icmp 0 -j ACCEPT
    iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
    
    #设置默认规则为DROP
    iptables -P INPUT DROP
    iptables -P OUTPUT DROP
    iptables -P FORWARD DROP
    
    #保存规则
    iptables-save
    
    [root@s111 vagrant]# iptables -nL
    Chain INPUT (policy DROP)
    target     prot opt source               destination         
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp dpt:22 
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 8 
    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    
    Chain FORWARD (policy DROP)
    target     prot opt source               destination         
    
    Chain OUTPUT (policy DROP)
    target     prot opt source               destination         
    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           tcp spt:22 
    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           icmp type 0

## 3, 添加规则：开放端口 ##

*  批量添加多个端口： iptables -I INPUT -p tcp --dport=100:300 -j ACCEPT

添加方式有：append, insert两种，  
区别是：　　insert 插入的位置是第一个,id为１; 而append插入的位置是最后一个，id为n+1

# 开放80，8080端口
    iptables -I INPUT -p tcp --dport 80 -j ACCEPT
    iptables -I INPUT -p tcp --dport 8080 -j ACCEPT
    service iptables save #保存iptables,防止下次重启失效
    
    #上面的操作等价于：直接修改配置文件，然后重启服务
    #sed -i '5a -A INPUT -p tcp  --dport 80 -j ACCEP' iptable
    #sed -i '5a -A INPUT -p tcp  --dport 8080 -j ACCEP' iptable
    #service iptables restart

## 4, 删除规则 ##

#1,查看现有的防火墙规则
    [root@s111 ~]# iptables -L -n --line-numbers
    Chain INPUT (policy DROP)
    num  target     prot opt source               destination         
    1    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           state RELATED,ESTABLISHED 
    2    ACCEPT     icmp --  0.0.0.0/0            0.0.0.0/0           
    3    ACCEPT     all  --  0.0.0.0/0            0.0.0.0/0           
    4    ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0           state NEW tcp dpt:22 
    5    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 
    6    ACCEPT     tcp  --  192.168.0.0/16       192.168.56.13       tcp dpt:80 
    
    Chain FORWARD (policy DROP)
    num  target     prot opt source               destination         
    1    REJECT     all  --  0.0.0.0/0            0.0.0.0/0           reject-with icmp-host-prohibited 
    
    Chain OUTPUT (policy ACCEPT)
    num  target     prot opt source               destination         
    1    ACCEPT     tcp  --  192.168.56.13        192.168.0.0/16      tcp dpt:80 
    
    #2,删除某个链(INPUT)的某个规则(6)
    [root@s111 ~]# iptables -D INPUT 6

# 3, iptables 内外网互通 #

1,  路由机 r1 (linux 开启路由转发 ) ： eth1 (外网 192.168.1.114 ) , eth2 (内网 192.168.56.7 )
    	修改/etc/sysctl.conf文件，net.ipv4.ip_forward = 1;  sysctl -p
    	iptables -t nat -A POSTROUTING -s 192.168.56.0/24                        -j SNAT --to 192.168.1.114
    	iptables -t nat -R POSTROUTING 1 -s 192.168.56.0/24 ! -d 192.168.1.0/24  -j SNAT --to 192.168.1.114
    
    2, 内网机：eth2 (内网 192.168.56.100 ) 
    	route add default gw 192.168.56.1  # 路由到 r1
    	测试： ping 外网机, baidu.com
    
    3, 外网机： eth1 (外网 192.168.1.113 ) 
    	route add default gw 192.168.1.114 # 路由到 r1
    	测试： ping 内网机

[https_www.cnblogs.com_pangguoming_p_5956151.html]: https://www.cnblogs.com/pangguoming/p/5956151.html
[http_www.zsythink.net_archives_1517]: http://www.zsythink.net/archives/1517/
[http_www.zsythink.net_archives_1199]: http://www.zsythink.net/archives/1199
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70]: /images/20211019/8c3994cba9e4422abb7d0354f4413afb.png