Ubuntu中防火墙的常用命令

1. 防火墙状态及规则
   1.1 查看防火墙状态：firewall-cmd --state

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --state
   running
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

   1.2 查看防火墙：firewall-cmd --list-all

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --list-all
   public (default, active)
   	interfaces: ens33
   	sources: 
       services: dhcpv6-client ssh
       ports: 80/tcp 8080/tcp 3306/tcp
   	protocols: 
   	masquerade: no
   	forward-ports: 
   	icmp-blocks: 
   	rich rules: 
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

   1.3 更新防火墙规则：firewall-cmd --reload

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --reload
   success
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

2. 端口
   2.1. 临时增加(reload之后消失)：不需要reload

   usr/local/mysql-5.7.18/bin# firewall-cmd --add-port=999/tcp
   success
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

   2.2 永久增加：reload后生效

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --permanent --add-port=999/tcp
   success
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

   2.3 临时删除端口：reload后消失

   root@dzh:/usr/local/mysql-5.7.18/bin#  firewall-cmd --remove-port=999/tcp
   success
   root@dzh:/usr/local/mysql-5.7.18/bin#
   

   2.4 永久删除端口：reload后生效

   root@dzh:/usr/local/mysql-5.7.18/bin#  firewall-cmd --permanent --remove-port=999/tcp
   success
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

   2.5 查询端口

   root@dzh:/usr/local/mysql-5.7.18/bin#  firewall-cmd --query-port=999/tcp
   no
   root@dzh:/usr/local/mysql-5.7.18/bin#
   

   2.6 查看所有放行的端口：

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --zone=public --list-ports
   80/tcp 8080/tcp 3306/tcp
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

3. IP
   3.1 防火墙添加允许访问的IP（需要reload才能生效）

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --zone=public --add-rich-rule 'rule 	family="ipv4" source address="10.12.17.50" accept' --permanent
   success
   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd  --reload
   success
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

4. 服务
   4.1 防火墙服务的状态

   root@dzh:/usr/local/mysql-5.7.18/bin# systemctl status firewalld.service
   ● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/lib/systemd/system/firewalld.service; enabled; vendor preset
   Active: active (running) since 四 2023-03-23 16:13:26 CST; 28min ago
   Main PID: 923 (firewalld)
   CGroup: /system.slice/firewalld.service
          └─923 /usr/bin/python3 -Es /usr/sbin/firewalld --nofork --nopid
   
   3月 23 16:13:24 dzh systemd[1]: Starting firewalld - dynamic firewall daemon...
   3月 23 16:13:26 dzh systemd[1]: Started firewalld - dynamic firewall daemon.
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

   4.2 启动/关闭防火墙

   root@dzh:/usr/local/mysql-5.7.18/bin# systemctl stop firewalld.service
   root@dzh:/usr/local/mysql-5.7.18/bin# systemctl start firewalld.service
   root@dzh:/usr/local/mysql-5.7.18/bin# 
   

   4.3 获取所有支持的服务
   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --get-services

   4.4 增加服务（临时增加）

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --add-service=https
   success
   

   4.5 删除服务（临时删除）

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --query-service=https
   yes
   

   4.6 查询服务

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --query-service=https
   yes
   

   4.7 增加服务（永久）

   root@dzh:/usr/local/mysql-5.7.18/bin#  firewall-cmd --permanent --add-service=http
   success
   

   4.8 删除服务（永久）

   root@dzh:/usr/local/mysql-5.7.18/bin# firewall-cmd --permanent --remove-service=ssh
   success
   

参考：https://blog.csdn.net/weixin_44256848/article/details/121094904