-
Notifications
You must be signed in to change notification settings - Fork 3
/
Copy pathfirewalld.html
52 lines (52 loc) · 2.66 KB
/
firewalld.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta http-equiv=Content-Type content="text/html; charset=utf-8">
<meta http-equiv=pragma content=no-cache>
<link href="css/bootstrap.min.css" rel="stylesheet">
<link rel="shortcut icon" href="favicon.ico">
<link rel="bookmark" href="favicon.ico">
<title>Linux防火墙firewalld安装使用简明手册</title>
</head>
<body>
<div class="container">
<p><a href="index.html">返回首页</a></p>
<h2 align=center>Linux防火墙firewalld安装使用简明手册</h2>
<p>firewalld是CentOS7默认防火墙软件，取代了原来的iptables，官方网站：<a href="https://fedoraproject.org/wiki/FirewallD/zh-cn" target="_blank">https://fedoraproject.org/wiki/FirewallD/zh-cn</a></p>
<p><b>一、安装</b></p>
<pre>yum install firewalld -y</pre>
<p><b>二、常用操作</b></p>
<p><b>1、启动/停止/重启防火墙</b></p>
<pre>systemctl start/stop/restart firewalld</pre>
<p><b>2、修改规则后重新载入</b></p>
<pre>firewall-cmd --reload</pre>
<p><b>3、显示所有规则</b></p>
<pre>firewall-cmd --list-all</pre>
<p><b>4、添加/删除服务</b></p>
<pre>firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --remove-service=ssh</pre>
注：添加为add，删除为remove，以下相同。
<p><b>5、添加端口</b></p>
<pre>firewall-cmd --permanent --add-port=22/tcp</pre>
<p><b>6、封禁IP/IP段</b></p>
<pre>firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.6.1 reject"
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.6.0/24 reject"
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.0.0/16 reject"
firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.0.0.0/8 reject"</pre>
注：reject为拒绝，drop为抛弃，accept为允许，以下相同。
<p><b>7、添加特定IP访问特定端口</b></p>
<pre>firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.1.1 port port=81 protocol=tcp accept"</pre>
<p><b>8、添加特定IP访问特定服务</b></p>
<pre>firewall-cmd --permanent --add-rich-rule="rule family=ipv4 source address=192.168.1.1 service name=http reject"</pre>
<p><b>9、端口转发</b></p>
<pre>firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toport=8080:toaddr=192.168.1.1</pre>
<p>以上设置成功还需要注意（设置系统转发和IP伪装）：</p>
<pre>
echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf
sysctl -p
firewall-cmd --add-masquerade --zone=public --permanent</pre>
<p><a href="index.html">返回首页</a></p>
<p align="center">© 2016-2025 清风的个人笔记</p>
</div>
</body>
</html>