CentOS 8防火墙配置

概述

CentOS的防火墙通常是打开的，如果想从外部访问CentOS 内部的端口，首先需要在linux系统上开放对应的端口。

防火墙配置

• 查看防火墙状态

systemctl  status  firewalld

• 关闭防火墙

systemclt  stop  firewalld

• 打开防火墙

systemctl  start  firewalld

• 示例

[root@localhost]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Wed 2021-04-21 10:14:41 CST; 24h ago
     Docs: man:firewalld(1)
 Main PID: 1048 (firewalld)
    Tasks: 3 (limit: 11332)
   Memory: 35.8M
   CGroup: /system.slice/firewalld.service
           └─1048 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid

Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->
Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->
Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->
Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->
Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->
Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->
Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->
Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->
Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->
Apr 22 10:25:00 localhost.localdomain firewalld[1048]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -w -->

[root@localhost ]# systemctl stop firewalld
[root@localhost ]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Thu 2021-04-22 10:38:14 CST; 3s ago
     Docs: man:firewalld(1)
  Process: 9260 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=exited, status=0/SUCCESS)
 Main PID: 9260 (code=exited, status=0/SUCCESS)

[root@localhost ]# systemctl start firewalld
[root@localhost ]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2021-04-22 10:38:55 CST; 2s ago
     Docs: man:firewalld(1)
 Main PID: 9753 (firewalld)
    Tasks: 3 (limit: 11332)
   Memory: 23.7M
   CGroup: /system.slice/firewalld.service
           ├─ 9753 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid
           └─10126 /usr/sbin/iptables -w10 -w --table filter --insert INPUT --in-interface virbr0 --protocol t>

单个端口配置

• 查看防护墙某个端口是否开放

firewall-cmd   --query-port=xxx/tcp

• 开放防火墙端口xxx

firewall-cmd  --zone=public  --add-port=xxx/tcp  --permanent

• 关闭xxx端口

firewall-cmd  --zone=public  --remove-port=xxx/tcp  --perment

• 配置立即生效

配置端口后，如果想生效必须要设置立即生效命令

firewall-cmd  --reload

• 示例

[root@localhost]# firewall-cmd --query-port=27017/tcp
no
[root@localhost]# firewall-cmd  --zone=public  --add-port=27017/tcp  --permanent
success
[root@localhost]# firewall-cmd --query-port=27017/tcp
no
[root@localhost]# firewall-cmd  --zone=public  --add-port=80/tcp  --permanent
success
[root@localhost]# firewall-cmd --query-port=80/tcp
no
[root@localhost]# firewall-cmd  --reload
success
[root@localhost]# firewall-cmd --query-port=80/tcp
yes
[root@localhost]# firewall-cmd --query-port=27017/tcp
yes

区间端口配置

• 开放一段端口

firewall-cmd  --zone=public  --add-port=8121-8124/tcp  --permanent

• 查看开放的端口列表

firewall-cmd  --zone=public  --list-ports

• 示例

[root@localhost]# firewall-cmd --zone=public  --list-ports
27017/tcp 80/tcp
[root@localhost]# firewall-cmd --zone=public  --add-port=8121-8124/tcp  --permanent
success
[root@localhost]# firewall-cmd --zone=public  --list-ports
27017/tcp 80/tcp
[root@localhost]# firewall-cmd  --reload
success
[root@localhost]# firewall-cmd --zone=public  --list-ports
27017/tcp 80/tcp 8121-8124/tcp