iptables firewalld

yum install iptables-services.x86_64           安装iptables服务

systemctl status iptables.service                查看iptables服务的状态 默认为关闭

 systemctl status firewalld                        查看firealld状态

systemctl stop firewalld                           关闭防火墙
systemctl disable firewalld                       关闭防火墙的开机自动启动功能
systemctl mask firewalld                          冻结防火墙
systemctl start iptables.service                 开启iptables服务
[ sytemctl enable iptables                        打开iptables服务的开机自动启动功能

systemctl status iptables.service              再次查看iptables服务的状态并确认已经启动

ll /etc/sysconfig/iptables                         
cat /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
[root@localhost etc]# iptables -F                                      刷新
[root@localhost etc]# service iptables save                        保存当前策略

iptables: Saving firewall rules to /etc/sysconfig/iptables:[  OK  ]

iptables -t filter -nL

iptables -t nat -nL
iptables -A INPUT -j REJECT                                           添加默认拒绝命令                                       

iptables -I INPUT 1 -i lo -j ACCEPT                                   插入允许命令在第一行

iptables -I INPUT 3 -p tcp --dport 80 -j ACCEPT                插入允许命令在第三行  （端口为80  协议为TCP）
iptables -D INPUT 3                                                      删除第三行的命令
iptables -N WESTOS                                                      创建WESTOS
iptables -E WESTOS redhat                                              将WESTOS 更名为redgat

iptables -X redhat                                                              删除redhat

 

网络转换  来源为172.25.254.212   to 到 172.25.254.112

iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 172.25.254.212

iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-dest 172.25.254.112

 firewalld 

 

systemctl stop iptables.service    关闭iptable服务

systemctl disable iptables.service      关闭iptable开机自动启动功能

[root@localhost Desktop]# systemctl mask iptables.service       冻结iptables服务
ln -s '/dev/null' '/etc/systemd/system/iptables.service'               

[root@localhost Desktop]# systemctl unmask firewalld                 解除冻结firewall
rm '/etc/systemd/system/firewalld.service'                                        
[root@localhost Desktop]# systemctl start firewalld                       启动firwall
[root@localhost Desktop]# systemctl enable firewalld                     开启开机自动启动功能
ln -s '/usr/lib/systemd/system/firewalld.service' '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'          
ln -s '/usr/lib/systemd/system/firewalld.service' '/etc/systemd/system/basic.target.wants/firewalld.service'



firewall-cmd --get-default-zone                                          查看默认域
firewall-cmd --set-default-zone=trusted                              设置默认域为trusted
firewall-cmd --get-default-zone                                          查看

firewall-cmd --list-all                                                          查看当前信息

firewall-cmd --set-default-zone=block                             设置默认域为block
vim /etc/firewalld/zones/public.xml                                  修改publc配置文件 可通过修改配置文件更改内容

firewall-cmd --reload                                                        重新加载
firewall-cmd --permanent --add-port=8080/tcp                     --permanent 永久性  添加端口8080 tcp协议
 systemctl restart firewalld.service                                       端口类的添加与删除 必须重启服务

firewall-cmd --permanent --remove-port=8080/tcp                    删除8080端口 
firewall-cmd --permanent --add-service=ssh                         添加ssh服务
firewall-cmd --permanent --remove-service=ssh                    删除ssh服务

firewall-cmd --permanent --add-source=172.25.254.12                                    添加来源172.25.254.12

firewall-cmd --reload

firewall-cmd --permanent --add-source=172.25.254.12 --zone=trusted                        永久添加172.25.254.12

firewall-cmd --permanent --remove-interface=eth1 --zone=trusted   

                           
firewall-cmd --permanent --add-interface=eth1 --zone=trusted
systemctl restart firewall.service
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 1 -s 172.25.254.12/24 -p tcp --dport 80 -j REJET
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 ! -s 172.25.254.212 -p tcp --dport 22 -j ACCEPT
firewall-cmd --direct --get-all-rules
ipv4 filter INPUT 0 '!' -s 172.25.254.212 -p tcp --dport 22 -j ACCEPT

伪装

firewall-cmd --permanent --add-masquerade

firewall-cmd --permanent --direct --remove-rule ipv4 filter INPUT 0 ! -s 172.25.254.212 -p tcp --dport 22 -j ACCEPT
firewall-cmd --zone=public --add-forward-port=port=22:proto=tcp:toport=22:toaddr=172.25.254.112