作业1、iptables:开启防火墙,可以正常使用ssh服务,dns服务,httpd服务,chrony服务,nfs服务
安装iptables服务:
yum install iptables-services -y
关闭防火墙,开启iptables服务:
systemctl stop firewalld.service
systemctl start iptables.service
添加规则:ssh服务端口22,dns服务端口53,httpd服务80,chrony服务端口123,nfs服务端口111
[root@chensiru ~]# iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT
[root@chensiru ~]# iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT
[root@chensiru ~]# iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
[root@chensiru ~]# iptables -t filter -A INPUT -p udp --dport 123 -j ACCEPT
[root@chensiru ~]# iptables -t filter -A INPUT -p udp --dport 111 -j ACCEPT
查看规则表
iptables -vnL--line-numbers
作业2、firewalld:开启防火墙,可以正常使用ssh服务,dns服务,httpd服务,chrony服务,nfs服务。且实现访问第一台机器web服务的9090端口,转发到第二台机器的80端口(永久生效)
关闭iptables,打开firewalld
[root@chensiru ~]# systemctl stop iptables.service
[root@chensiru ~]# systemctl restart firewalld.service
增加相应服务
[root@chensiru ~]# firewall-cmd --add-service=ssh
Warning: ALREADY_ENABLED: 'ssh' already in'public'
success
[root@chensiru ~]# firewall-cmd --add-service=http
success
[root@chensiru ~]# firewall-cmd --add-service=dns
success
[root@chensiru ~]# firewall-cmd --add-port=123/udp
success
[root@chensiru ~]# firewall-cmd --add-service=nfs
success
查看服务
[root@chensiru ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens33
sources:
services: dhcpv6-client dns http nfs ssh
ports: 123/udp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
访问第一台机器web服务的9090端口,转发到第二台机器的80端口(永久生效)
[root@chensiru ~]# firewall-cmd --add-rich-rule 'rule family="iort to-addr="192.168.247.133" to-port="80" protocol="tcp" port=anent
success
[root@chensiru ~]# firewall-cmd --reload
success
[root@chensiru ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens33
sources:
services: dhcpv6-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" forward-port port="9090"protocol="t0"to-addr="192.168.247.133"