CentOS7的firewall和安装iptables

前言：CentOS7 的防火墙默认使用是firewall，而我们通常使用iptables；

本文记录了firewall基础的命令和iptables的安装和使用。

 

firewall部分：

part1 : 服务命令

systemctl start firewalld#启动

systemctl status firewalld #查看运行状态

systemctl stop firewalld.service #停止firewall

systemctl disable firewalld.service #禁用：禁止firewall开机启动

firewall-cmd --state #查看默认防火墙状态（关闭后显示notrunning，开启后显示running）

firewall-cmd--reload 重启

part2 : 端口命令：

添加

firewall-cmd --zone=public --add-port=80/tcp --permanent   （--permanent永久生效，没有此参数重启后失效）

重新载入

firewall-cmd --reload

查看

firewall-cmd --zone= public --query-port=80/tcp

删除

firewall-cmd --zone= public --remove-port=80/tcp --permanent

part3:示例

示例：firewall端口操作完之后需要重启服务生效

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
no
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3307/tcp --permanent
success
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
no
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload
success
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
yes

示例：mysql开放远程端口

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3306/tcp --permanent
success
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload
success
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --state
running
[root@iZ2zeczh9tfpmxmijw5qppZ ~]#
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3306/tcp
yes
[root@iZ2zeczh9tfpmxmijw5qppZ ~]#

iptables部分

part1 : 服务命令

systemctl start iptables #启动

systemctl status iptables #查看运行状态

systemctl restart iptables.service #停止iptables

systemctl stop iptables.service #停止iptables

systemctl disable iptables.service #禁用：禁止iptables开机启动

systemctl enable iptables.service #启用：设置iptables开机启动

part2 : 安装

step1 ： 查看是否安装

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
Unit iptables.service could not be found.
[root@iZ2zeczh9tfpmxmijw5qppZ ~]#

没有相关服务

step2 : yum install

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# yum install iptables-services
Loaded plugins: fastestmirror
base                                                                                                             | 3.6 kB  00:00:00     
epel                                                                                                             | 4.3 kB  00:00:00     
extras                                                                                                           | 3.4 kB  00:00:00     
mysql-connectors-community                                                                                       | 2.5 kB  00:00:00     
mysql-tools-community                                                                                            | 2.5 kB  00:00:00     
mysql56-community                                                                                                | 2.5 kB  00:00:00     
updates                                                                                                          | 3.4 kB  00:00:00     
updates/7/x86_64/primary_db                                                                                      | 6.4 MB  00:00:06     
Loading mirror speeds from cached hostfile
 * base: mirrors.aliyuncs.com
 * epel: mirrors.aliyuncs.com
 * extras: mirrors.aliyuncs.com
 * updates: mirrors.aliyuncs.com
Resolving Dependencies
--> Running transaction check
---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed
--> Finished Dependency Resolution

Dependencies Resolved

========================================================================================================================================
 Package                                Arch                        Version                             Repository                 Size
========================================================================================================================================
Installing:
 iptables-services                      x86_64                      1.4.21-17.el7                       base                       50 k

Transaction Summary
========================================================================================================================================
Install  1 Package

Total download size: 50 k
Installed size: 24 k
Is this ok [y/d/N]: Y
Downloading packages:
iptables-services-1.4.21-17.el7.x86_64.rpm                                                                       |  50 kB  00:00:00     
Running transaction check
Running transaction test
Transaction test succeeded
Running transaction
  Installing : iptables-services-1.4.21-17.el7.x86_64                                                                               1/1 
warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew
  Verifying  : iptables-services-1.4.21-17.el7.x86_64                                                                               1/1 

Installed:
  iptables-services.x86_64 0:1.4.21-17.el7                                                                                              

Complete!
[root@iZ2zeczh9tfpmxmijw5qppZ ~]#       

安装成功！

step3 : check

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
   iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
   Active: inactive (dead)
[root@iZ2zeczh9tfpmxmijw5qppZ ~]#   

step4 : start

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl start iptables
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl enable iptables.service
Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# 

[root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
   iptables.service - IPv4 firewall with iptables
   Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
   Active: active (exited) since Wed 2017-06-21 15:44:41 CST; 1min 17s ago
 Main PID: 506 (code=exited, status=0/SUCCESS)

Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Starting IPv4 firewall with iptables...
Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ iptables.init[506]: iptables: Applying firewall rules: [  OK  ]
Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Started IPv4 firewall with iptables.
[root@iZ2zeczh9tfpmxmijw5qppZ ~]# 

step5 : 修改配置文件

vi /etc/sysconfig/iptables 

systemctl restart iptables.service #重启防火墙使配置生效

step6 ： 关闭SELINUX

vi/etc/selinux/config

#SELINUX=enforcing #注释掉

#SELINUXTYPE=targeted #注释掉

SELINUX=disabled #增加

:wq! #保存退出 

setenforce 0 #使配置立即生效

备注：

SELINUX不关闭时，iptables不读取配置文件，一般采取关闭SELINUX的方式避免这种冲突