查看当前访问清单
firewall-cmd --list-all
添加对应的规则
#firewall-cmd --add-port=3306-9092/tcp --permanent
#firewall-cmd --add-rich-rule "rule family="ipv4" source address="10.13.224.90" accept" --permanent
#firewall-cmd --remove-rich-rule "rule family="ipv4" source address="10.233.0.144" accept" --permanent
全部执行完成后reload生效
firewall-cmd --reload
移除多余的端口,开启防火墙策略,防止扫描出漏洞(绿盟)
281 firewall-cmd --list-all
282 firewall-cmd --remove-port=22/udp --permanent
283 firewall-cmd --remove-port=36000/tcp --permanent
284 firewall-cmd --remove-port=36000/udp --permanent
285 firewall-cmd --remove-port=8888/tcp --permanent
286 firewall-cmd --remove-port=8095/tcp --permanent
287 firewall-cmd --remove-port=8096/tcp --permanent
288 firewall-cmd --remove-port=8099/tcp --permanent
289 firewall-cmd --remove-port=8081/tcp --permanent
290 firewall-cmd --remove-port=3306-9092/tcp --permanent
291 firewall-cmd --reload
292 firewall-cmd --list-all
1.查询当前放通的规则:
firewall-cmd --list-all
2.在机器,执行下面的命令对外只暴露这几个端口22,80,8080,443,514-550;
firewall-cmd --add-port=22/tcp --permanent
firewall-cmd --add-port=80/tcp --permanent
firewall-cmd --add-port=8080/tcp --permanent
firewall-cmd --add-port=443/tcp --permanent
firewall-cmd --add-port=514-550/tcp --permanent
firewall-cmd --add-port=514-550/udp --permanent
3.其他不需要的端口,全部干掉;
firewall-cmd --remove-port=xx/tdp --permanent
firewall-cmd --remove-port=xx/udp --permanent
ntp server如果已经通过IP地址加白了,那端口这里不放开也是可以的;
如果ntp server的IP地址没有加白,然后ntp 123没有漏洞,放UDP/123端口也没有影响;