1.firewall基础
systemctl start firewalld
firewall-cmd --get-default-zone #查看所在区域
firewall-cmd --list-all #查看public规则明细
#默认eth0 eth1都走public,那么我们可以将public的所有规则给清空
firewall-cmd --remove-service=ssh
firewall-cmd --remove-service=dhcpv6-client
#将来源IP是10.0.0.0/24 走trusted区域。放行了所有
firewall-cmd --add-source=10.0.0.0/24 --zone=tursted #将该网段加入白名单
firewall-cmd --list-all -zone=tursted #查看白名单
#重载会清空所有配置的规则
firewall-cmd --reload
firewall-cmd --add-port=8080/tcp #临时添加
firewall-cmd --add-port=80/tcp --permanent #永久添加
firewall-cmd --add-port={8080,8081}/tcp
firewall-cmd --remove-port=8081/tcp #移除
#使用firewalld放行服务和移除端口( http-->80 https-->443 ssh-->22 )
firewall-cmd --add-service=http
firewall-cmd --add-service=https
firewall-cmd --add-service=nfs
#复制一份修改服务名称和端口即可
vim /usr/lib/firewalld/services/http.xml
-------------------------端口转发规则------------------------------
firewall-cmd --permanent --zone=<区域> --add-forward-port=port=<源端口号>:proto=<协议>:toport=<目标端口号>:toaddr=<目标IP地址>
--------------------------端口转发规则-----------------------------
firewall-cmd --add-forward-port=port=5555:proto=tcp:toport=22:toaddr=172.16.1.8
man firewalld.richlanguage #获取富规则手册
-------------------------富规则手册------------------------------
rule
[source]
[destination]
service|port|protocol|icmp-block|masquerade|forward-port
[log]
[audit]
[accept|reject|drop]
rule [family="ipv4|ipv6"]
source address="address[/mask]" [invert="True"]
service name="service name"
port port="port value" protocol="tcp|udp"
forward-port port="port value" protocol="tcp|udp" to-port="port value" to-addr="address"
accept | reject [type="reject type"] | drop
-------------------------富规则手册------------------------------
#允许10.0.0.1主机能够访问80端口或http服务,允许172.16.1.0/24能访问8080端口
firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.0.0.1/32 service name=http accept'
firewall-cmd --add-rich-rule='rule family=ipv4 source address=172.16.1.0/24 port port="8080" protocol="tcp" accept'
#默认public区域对外开放所有人能通过ssh服务连接,但拒绝172.16.1.0/24网段通过ssh连接服务器
firewall-cmd --add-rich-rule='rule family=ipv4 source address="172.16.1.0/24" service name="ssh" drop'
#使用firewalld,允许所有人能访问http,https服务,但只有10.0.0.1主机可以访问ssh服务
firewall-cmd --add-service={http,https}
firewall-cmd --remove-service=ssh
firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.1/32" service name=ssh accept'
#当用户来源IP地址是10.0.0.1主机,则将用户请求的5555端口转发至后端172.16.1.8的22端口
firewall-cmd --add-rich-rule='rule family=ipv4 source address="10.0.0.1/32" forward-port port="5555" protocol="tcp" to-port="22" to-addr=172.16.1.8'
firewall-cmd --add-masquerade
#内网同过一台服务器上网
web01(10.0.0.7):
firewall-cmd --add-masquerade --permanent
firewall-cmd --add-masquerade
web02(10.0.0.8):
ifdown eth0
vim /etc/sysconfig/network-scripts/ifcfg-eth1
------------/etc/sysconfig/network-scripts/ifcfg-eth1------------
TYPE=Ethernet
BOOTPROTO=none
DEFROUTE=yes
NAME=eth1
DEVICE=eth1
ONBOOT=yes
IPADDR=172.16.1.8
PREFIX=24
GATEWAY=172.16.1.7
DNS1=223.5.5.5
-----------/etc/sysconfig/network-scripts/ifcfg-eth1结束----------
ifdown eth1 && ifup eth1
ping baidu.com #实验