-
防火墙状态及规则
1.1 查看防火墙状态:firewall-cmd --state
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --state running root@dzh:/usr/local/mysql-5.7.18/bin#
1.2 查看防火墙:
firewall-cmd --list-all
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --list-all public (default, active) interfaces: ens33 sources: services: dhcpv6-client ssh ports: 80/tcp 8080/tcp 3306/tcp protocols: masquerade: no forward-ports: icmp-blocks: rich rules: root@dzh:/usr/local/mysql-5.7.18/bin#
1.3 更新防火墙规则:
firewall-cmd --reload
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --reload success root@dzh:/usr/local/mysql-5.7.18/bin#
-
端口
2.1. 临时增加(reload之后消失):不需要reloadusr/local/mysql-5.7.18/bin# firewall-cmd --add-port=999/tcp success root@dzh:/usr/local/mysql-5.7.18/bin#
2.2 永久增加:reload后生效
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --permanent --add-port=999/tcp success root@dzh:/usr/local/mysql-5.7.18/bin#
2.3 临时删除端口:reload后消失
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --remove-port=999/tcp success root@dzh:/usr/local/mysql-5.7.18/bin#
2.4 永久删除端口:reload后生效
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --permanent --remove-port=999/tcp success root@dzh:/usr/local/mysql-5.7.18/bin#
2.5 查询端口
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --query-port=999/tcp no root@dzh:/usr/local/mysql-5.7.18/bin#
2.6 查看所有放行的端口:
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --zone=public --list-ports 80/tcp 8080/tcp 3306/tcp root@dzh:/usr/local/mysql-5.7.18/bin#
-
IP
3.1 防火墙添加允许访问的IP(需要reload才能生效)root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --zone=public --add-rich-rule 'rule family="ipv4" source address="10.12.17.50" accept' --permanent success root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --reload success root@dzh:/usr/local/mysql-5.7.18/bin#
-
服务
4.1 防火墙服务的状态root@dzh:/usr/local/mysql-5.7.18/bin# systemctl status firewalld.service ● firewalld.service - firewalld - dynamic firewall daemon Loaded: loaded (/lib/systemd/system/firewalld.service; enabled; vendor preset Active: active (running) since 四 2023-03-23 16:13:26 CST; 28min ago Main PID: 923 (firewalld) CGroup: /system.slice/firewalld.service └─923 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid 3月 23 16:13:24 dzh systemd[1]: Starting firewalld - dynamic firewall daemon... 3月 23 16:13:26 dzh systemd[1]: Started firewalld - dynamic firewall daemon. root@dzh:/usr/local/mysql-5.7.18/bin#
4.2 启动/关闭防火墙
root@dzh:/usr/local/mysql-5.7.18/bin# systemctl stop firewalld.service root@dzh:/usr/local/mysql-5.7.18/bin# systemctl start firewalld.service root@dzh:/usr/local/mysql-5.7.18/bin#
4.3 获取所有支持的服务
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --get-services
4.4 增加服务(临时增加)
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --add-service=https success
4.5 删除服务(临时删除)
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --query-service=https yes
4.6 查询服务
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --query-service=https yes
4.7 增加服务(永久)
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --permanent --add-service=http success
4.8 删除服务(永久)
root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --permanent --remove-service=ssh success
参考:https://blog.csdn.net/weixin_44256848/article/details/121094904