firewall

1.firewall基础

systemctl start firewalld	
firewall-cmd --get-default-zone	#查看所在区域
firewall-cmd --list-all	#查看public规则明细
#默认eth0 eth1都走public，那么我们可以将public的所有规则给清空
firewall-cmd --remove-service=ssh
firewall-cmd --remove-service=dhcpv6-client
#将来源IP是10.0.0.0/24 走trusted区域。放行了所有
firewall-cmd --add-source=10.0.0.0/24 --zone=tursted	#将该网段加入白名单
firewall-cmd --list-all -zone=tursted	#查看白名单
#重载会清空所有配置的规则
firewall-cmd --reload
firewall-cmd --add-port=8080/tcp	#临时添加
firewall-cmd --add-port=80/tcp --permanent #永久添加
firewall-cmd --add-port={8080,8081}/tcp
firewall-cmd --remove-port=8081/tcp	#移除
#使用firewalld放行服务和移除端口（ http-->80 https-->443 ssh-->22 ）
firewall-cmd --add-service=http
firewall-cmd --add-service=https
firewall-cmd --add-service=nfs
#复制一份修改服务名称和端口即可
vim /usr/lib/firewalld/services/http.xml
-------------------------端口转发规则------------------------------
firewall-cmd --permanent --zone=<区域> --add-forward-port=port=<源端口号>:proto=<协议>:toport=<目标端口号>:toaddr=<目标IP地址>
--------------------------端口转发规则-----------------------------
firewall-cmd --add-forward-port=port=5555:proto=tcp:toport=22:toaddr=172.16.1.8
man firewalld.richlanguage	#获取富规则手册
-------------------------富规则手册------------------------------
rule
        [source]
        [destination]
        service|port|protocol|icmp-block|masquerade|forward-port
        [log]
        [audit]
        [accept|reject|drop]

rule [family="ipv4|ipv6"]
source address="address[/mask]" [invert="True"]
service name="service name"
port port="port value" protocol="tcp|udp"
forward-port port="port value" protocol="tcp|udp" to-port="port value" to-addr="address"
accept | reject [type="reject type"] | drop
-------------------------富规则手册------------------------------
#允许10.0.0.1主机能够访问80端口或http服务，允许172.16.1.0/24能访问8080端口
firewall-cmd --add-rich-rule='rule family=ipv4 source address=10.0.0.1/32 service name=http accept'
firewall-cmd --add-rich-rule='rule family=ipv4 source address=172.16.1.0/24 port port="8080" protocol="tcp" accept'
#默认public区域对外开放所有人能通过ssh服务连接，但拒绝172.16.1.0/24网段通过ssh连接服务器
firewall-cmd --add-rich-rule='rule family=ipv4 source address="172.16.1.0/24" service name="ssh" drop'
#使用firewalld，允许所有人能访问http,https服务，但只有10.0.0.1主机可以访问ssh服务
firewall-cmd --add-service={http,https}
firewall-cmd --remove-service=ssh
firewall-cmd --add-rich-rule='rule family="ipv4" source address="10.0.0.1/32" service name=ssh accept'
#当用户来源IP地址是10.0.0.1主机，则将用户请求的5555端口转发至后端172.16.1.8的22端口
firewall-cmd --add-rich-rule='rule family=ipv4 source address="10.0.0.1/32" forward-port port="5555" protocol="tcp" to-port="22" to-addr=172.16.1.8'
firewall-cmd --add-masquerade

#内网同过一台服务器上网
web01(10.0.0.7):

firewall-cmd --add-masquerade --permanent
firewall-cmd --add-masquerade

web02(10.0.0.8):

ifdown eth0
vim /etc/sysconfig/network-scripts/ifcfg-eth1
------------/etc/sysconfig/network-scripts/ifcfg-eth1------------
TYPE=Ethernet
BOOTPROTO=none
DEFROUTE=yes
NAME=eth1
DEVICE=eth1
ONBOOT=yes
IPADDR=172.16.1.8
PREFIX=24
GATEWAY=172.16.1.7
DNS1=223.5.5.5
-----------/etc/sysconfig/network-scripts/ifcfg-eth1结束----------
ifdown eth1 && ifup eth1
ping baidu.com	#实验