linux7防火墙

左手的ㄟ右手 2023-10-06 17:55 19阅读 0赞

在Centos7系统中 firewalld 服务取代了 iptables 服务。

## 防火墙状态 ##

\#防火墙是否开启，running表示运行中，not running表示关闭  
firewall-cmd --state

## 启动/关闭防火墙 ##

\#开启防火墙  
systemctl start firewalld.service  
\#关闭防火墙  
systemctl stop firewalld.service  
\#重启防火墙  
systemctl restart firewalld.service

## 开启/关闭端口 ##

\#开启端口  
firewall-cmd --permanent --add-port=80/tcp  
\#开启端口段  
firewall-cmd --permanent --add-port=6000-7000/tcp

\#删除端口  
firewall-cmd --permanent --remove-port=80/tcp  
\#删除端口段  
firewall-cmd --permanent --remove-port=6000-7000/tcp

\#重新加载防火墙，修改防护墙后需要重新加载生效  
firewall-cmd --reload

\#查询有哪些端口是开启的  
firewall-cmd --list-port

## 开启/关闭IP ##

\#放通某个IP访问，默认允许  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.111.201 accept'  
\#放通某个IP访问某个端口  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.111.202 port protocol=tcp port=6379 accept'  
\#放通某个IP段访问，分别代表：允许192.\*.\*.\*访问，允许192.168.\*.\*访问，允许192.168.111.\*访问  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.0.0.0/8 accept'  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.0.0/16 accept'  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.111.0/24 accept'

\#移除以上规则  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.168.111.201 accept'  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.168.111.202 port protocol=tcp port=6379 accept'  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.0.0.0/8 accept'  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.168.0.0/16 accept'  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.168.111.0/24 accept'

\#禁止某个IP访问  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.111.203 drop'  
\#禁止某个IP访问某个端口  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.111.204 port protocol=tcp port=22 drop'  
\#禁止某个IP段访问，分别代表：禁止192.\*.\*.\*访问，禁止192.168.\*.\*访问，禁止192.168.111.\*访问  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.0.0.0/8 drop'  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.0.0/16 drop'  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.111.0/24 drop'

\#移除以上规则  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.168.111.203 drop'  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.168.111.204 port protocol=tcp port=22 drop'  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.0.0.0/8 drop'  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.168.0.0/16 drop'  
firewall-cmd --permanent --remove-rich-rule='rule family=ipv4 source address=192.168.111.0/24 drop'

\#重新加载防火墙，修改防护墙后需要重新加载生效  
firewall-cmd --reload

\#查询有哪些IP是开放和禁止的  
firewall-cmd --list-rich

## **白名单** ##

假如服务器只允许 192.168.111.201 访问8081端口。  
1、删除8081端口  
firewall-cmd --permanent --remove-port=8081/tcp  
2、放通某个IP访问某个端口  
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.111.201 port protocol=tcp port=8081'  
\#重新加载防火墙  
firewall-cmd --reload  
\#查询防火墙所有规则  
firewall-cmd --list-all

允许指定的ip登陆ssh

# 允许登陆ssh的ip
    vi /etc/hosts.allow
    sshd:192.168.111.201:allow
    
    # 除了上面允许的，其他的ip都拒绝登陆ssh
    vi /etc/hosts.deny
    sshd:ALL

#开启端口3307
    firewall-cmd --permanent --add-port=3307/tcp
    #删除端口3307
    firewall-cmd --permanent --remove-port=3307/tcp
    #重启防火墙使修改生效
    firewall-cmd --reload
    #查询有哪些端口是开启的
    firewall-cmd --list-port

–zone=public：表示作用域为公共，可省略，默认就是这个

–permanent：表示永久生效 ，没有此参数重启后失效

查询当前默认的zone，可以看见–zone默认就是public可以省略

[root@centos00 ~]# firewall-cmd --get-default-zone
    public

[防火墙的 zone 详解][zone]

[zone]: https://blog.csdn.net/Jackliu200911/article/details/115559496