Centos7-firewall（初学转发及访问控制）

不论是service、ports、forward-ports还是rich rules项只要开启了端口，该端口就可以向外提供服务了1、添加永久有效规则 –permanent
1）方式：
允许 firewall-cmd –permanent –add-rich-rule ‘rule family=ipv4 source address=192.168.0.104 port port=9100 protocol=tcp accept’
拒绝 firewall-cmd –permanent –add-rich-rule ‘rule family=ipv4 source address=192.168.0.104 port port=9100 protocol=tcp reject’
删除 firewall-cmd –permanent –remove-rich-rule ‘rule family=ipv4 source address=192.168.0.104 port port=9100 protocol=tcp accept’

注意：端口转发不允许添加accept和reject
firewall-cmd –permanent –add-rich-rule ‘rule family=ipv4 source address=192.168.0.0/24 forward-port port=9900 protocol=tcp to-port=80 to-addr=47.89.33.211 accept’
Error: INVALID_RULE: forward-port and action

2）永久添加后，计算机会把该规则写到/etc/firewalld/zones/*.xml（相关区域）的里面，临时添加的不会写入。
3）该规