Linux防火墙端口开发与关闭（CentOS 7）

1、首先确认防火墙已经启动

[root@node1 ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: active (running) since Thu 2018-02-01 22:21:10 EST; 1s ago
     Docs: man:firewalld(1)
 Main PID: 21826 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─21826 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Feb 01 22:21:10 node1 systemd[1]: Starting firewalld - dynamic firewall daemon...
Feb 01 22:21:10 node1 systemd[1]: Started firewalld - dynamic firewall daemon.
[root@node1 ~]#

如果没有启动，则使用下面命令启动防火墙

[root@node1 ~]# systemctl start firewalld

2、命令方式

2.1 开放端口命令

（1）简单命令

firewall-cmd --zone=public --add-port=xxxx/tcp --permanent

比如node1节点已经启动了Tomcat，需要开发8080,8009,8005等端口

[root@node1 ~]# firewall-cmd --zone=public --add-port=8080/tcp --permanent
success
[root@node1 ~]# firewall-cmd --zone=public --add-port=8009/tcp --permanent
success
[root@node1 ~]# firewall-cmd --zone=public --add-port=8005/tcp --permanent
success
[root@node1 ~]# systemctl restart firewalld
[root@node1 ~]#

注意开放端口后需要重启防火墙。下面通过浏览器打开http://node1:8080网页，
或者通过telnet命令来访问端口

[root@node2 ~]# telnet 192.168.1.161 8080
Trying 192.168.1.161...
Connected to 192.168.1.161.
Escape character is '^]'.

（2）指定网段

 firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=192.168.1.0/24 port port=80 protocol=tcp accept'

2.2 查看所有开放的端口

[root@node1 ~]# firewall-cmd --zone=public --list-ports
8009/tcp 80/tcp 3888/tcp 2181/tcp 8080/tcp 21/tcp 2888/tcp 8005/tcp 8082/tcp
[root@node1 ~]# 

2.3 关闭端口命令

注意关闭端口后需要重启防火墙

[root@node1 ~]# firewall-cmd --zone=public --remove-port=8080/tcp --permanent
success
[root@node1 ~]# systemctl restart firewalld
[root@node1 ~]#

验证8080是否关闭

[root@node2 ~]# telnet node1 8080
Trying 192.168.1.161...
telnet: connect to address 192.168.1.161: No route to host
[root@node2 ~]#

3、编辑配置文件方式

注意，在CentOS7系统下编辑/etc/firewalld/zones目录下的配置文件。

[root@node1 zones]# pwd
/etc/firewalld/zones
[root@node1 zones]# vi public.xml

编辑内容如下

<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="dhcpv6-client"/>
  <service name="ssh"/>
  <rule family="ipv4">
    <source address="192.168.1.0/24"/>
    <port protocol="tcp" port="8080"/>
    <accept/>
  </rule>
  <port protocol="tcp" port="8009"/>
  <port protocol="tcp" port="80"/>
  <port protocol="tcp" port="3888"/>
  <port protocol="tcp" port="2181"/>
  <port protocol="tcp" port="21"/>
  <port protocol="tcp" port="2888"/>
  <port protocol="tcp" port="8005"/>
  <port protocol="tcp" port="8082"/>
</zone>

然后重启防火墙即可。