firewalld关于service的操作

firewalld关于service的操作（zone下面的一个子单元）可以理解成指定的一个端口

• 查看系统所有的service

[root@localhost ~]# firewall-cmd --get-service
RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client ceph ceph-mon dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imap imaps ipp ipp-client ipsec iscsi-target kadmin kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp smtps snmp snmptrap squid ssh synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server

---

• 查看当前zone下的service

[root@localhost ~]# firewall-cmd --list-service
ssh dhcpv6-client

---

• 查看指定zone下的service

[root@localhost ~]# firewall-cmd --zone=public --list-services
dhcpv6-client ssh

---

添加一个service到某个zone下

• 临时添加（配置文件中不存在，重启会恢复原配置）

[root@localhost ~]# firewall-cmd --zone=public --add-service=http
success
[root@localhost ~]# firewall-cmd --zone=public --list-services
dhcpv6-client ssh http

• 永久添加（更改配置文件）
  [root@localhost ~]# firewall-cmd –zone=public –add-service=http –permanent
  success

---

删除zone下某service

• 临时删除

[root@localhost ~]# firewall-cmd --zone=public --list-service
dhcpv6-client ssh http
[root@localhost ~]# firewall-cmd --zone=public --remove-service=http
success
[root@localhost ~]# firewall-cmd --zone=public --list-service
dhcpv6-client ssh

• 永久删除

[root@localhost ~]# firewall-cmd --zone=public --list-service
dhcpv6-client ssh
[root@localhost ~]# firewall-cmd --zone=public --remove-service=http --permanet
[root@localhost ~]# firewall-cmd --reload
success
[root@localhost ~]# firewall-cmd --zone=public --list-service
dhcpv6-client http ssh

---

• zone的系统配置文件

[root@localhost ~]# ls /etc/firewalld/zones/
public.xml  public.xml.old
[root@localhost ~]# cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="dhcpv6-client"/>
  <service name="http"/>
  <service name="ssh"/>
</zone>

说明： public.xml.old相当于一个备份文件，每次编辑public.xml时，系统会自动将原public.xml内容备份到public.xml.old。

---

• zone配置文件模板

[root@localhost ~]# ls /usr/lib/firewalld/zones
block.xml  drop.xml      home.xml      public.xml   work.xml
dmz.xml    external.xml  internal.xml  trusted.xml

---

• firewalld内各项服务的配置文件模板

[root@localhost ~]# ls /usr/lib/firewalld
icmptypes  ipsets  services  xmlschema  zones

说明： 每次编辑配置文件后需要重新加载（reload）firewall-cmd才生效。