10.19-10.27linux防火墙

最新推荐文章于 2022-11-09 21:17:50 发布

qq_42720896

最新推荐文章于 2022-11-09 21:17:50 发布

阅读量430

点赞数

本文链接：https://blog.csdn.net/qq_42720896/article/details/82191578

版权

本文详细介绍了CentOS Linux的防火墙管理，包括firewall的9个zone及其配置，如何查看和设置zone规则，以及服务(service)在不同运行级别(init)的应用。还涉及到服务的启动、停止和状态检查，以及chkconfig在CentOS 7的兼容性。同时讲解了systemd的unit类型和服务管理，特别是target的概念和作用。

摘要由CSDN通过智能技术生成

保存

恢复

重新打开 firewall

[root@linux-01 ~]# systemctl disable iptables
Removed symlink /etc/systemd/system/basic.target.wants/iptables.service.
[root@linux-01 ~]# systemctl stop iptables

[root@linux-01 ~]# systemctl enable firewalld
Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.

[root@linux-01 ~]# systemctl start firewalld

firewall 9个zone 自带的规则集

# 查看firewalld 9个规则集
[root@linux-01 ~]# firewall-cmd --get-zones
block dmz drop external home internal public trusted work

#查看默认规则集
[root@linux-01 ~]#  firewall-cmd --get-default-zone
public

各个zones 的区别

怎么查看zone 的规则？

设置更改zone

[root@linux-01 network-scripts]# firewall-cmd --set-default-zone=work
success
[root@linux-01 network-scripts]# firewall-cmd --get-default-zone
work

查看网卡使用的是哪个zone

[root@linux-01 network-scripts]# firewall-cmd --get-zone-of-interface=ens33
work
[root@linux-01 network-scripts]# firewall-cmd --get-zone-of-interface=ens37
work
[root@linux-01 network-scripts]# firewall-cmd --get-zone-of-interface=lo
no zone

如果新添加的网卡是no zone 复制ens33 网卡配置文件并重启网络服务然后重新加载firewalld

给指定的网卡设置 zone

[root@linux-01 network-scripts]# firewall-cmd --zone=public --add-interface=lo
success
[root@linux-01 network-scripts]# firewall-cmd --get-zone-of-interface=lo
public

针对网卡更改zone

[root@linux-01 network-scripts]# firewall-cmd --zone=block --change-interface=ens37
The interface is under control of NetworkManager, setting zone to 'block'.
success
[root@linux-01 network-scripts]# firewall-cmd --get-zone-of-interface=ens37
block
[root@linux-01 network-scripts]#

针对网卡删除zone

[root@linux-01 network-scripts]# firewall-cmd --zone=block --remove-interface=ens37
The interface is under control of NetworkManager, setting zone to default.
success
[root@linux-01 network-scripts]# firewall-cmd --get-zone-of-interface=ens37
work                               # 变回默认zone
[root@linux-01 network-scripts]#

查看系统网卡所在的zone

[root@linux-01 network-scripts]# firewall-cmd --get-active-zones
work
  interfaces: ens33 ens37
public
  interfaces: lo
[root@linux-01 network-scripts]#

service

service 就是zone下面的子单元可以理解成指定的一个端口，因为防火墙不外乎就是针对某个端口做一些限制。不如http它操作的是80端口、http是它操作的是43端口、ssh它操作是22端口

列出系统所有 service

#当前所有得service

[root@linux-01 ~]# firewall-cmd --get-service
RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync elasticsearch freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master high-availability http https imap imaps ipp ipp-client ipsec iscsi-target kadmin kerberos kibana klogin kpasswd kshell ldap ldaps libvirt libvirt-tls managesieve mdns mosh mountd ms-wbt mssql mysql nfs nfs3 nrpe ntp openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster quassel radius rpc-bind rsh rsyncd samba samba-client sane sip sips smtp smtp-submission smtps snmp snmptrap spideroak-lansync squid ssh synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server

#现在使用的zone有哪些service

[root@linux-01 network-scripts]# firewall-cmd --list-service
ssh dhcpv6-client


#查看指定zone 有哪些service
[root@linux-01 ~]# firewall-cmd --zone=public --list-service
ssh dhcpv6-client
[root@linux-01 ~]# 


[root@linux-01 ~]# firewall-cmd --zone=trusted --list-service

[root@linux-01 ~]#
# trusted 没有service

把http 加到public

[root@linux-01 ~]# firewall-cmd --zone=public --add-service=http
success
[root@linux-01 ~]# firewall-cmd --zone=public --list-service
ssh dhcpv6-client http       # 已经添加
[root@linux-01 ~]#
[root@linux-01 ~]# firewall-cmd --zone=public --add-service=ftp
success
[root@linux-01 ~]# firewall-cmd --zone=public