firewalld允许所有IP访问所有端口，但限制某个端口只允许指定IP访问

修改配置文件/etc/firewalld/direct.xml，如不存在则新建

[root@app-server ~]# cat /etc/firewalld/direct.xml
<?xml version="1.0" encoding="utf-8"?>
<direct>
  <rule priority="0" table="filter" ipv="ipv4" chain="INPUT">-p tcp -s 123.118.157.0/24 -m multiport --dport 22 -j ACCEPT</rule>    ##仅允许123.118.157.0/24网段访问22端口
  <rule priority="0" table="filter" ipv="ipv4" chain="INPUT">-p tcp -s 172.17.0.0/16 -m multiport --dport 22,9100 -j ACCEPT</rule>    ##仅允许172.17.0.0/16网段访问22和9100端口
  <rule priority="0" table="filter" ipv="ipv4" chain="INPUT">-p tcp -s 172.26.100.1 -m multiport --dport 10001 -j ACCEPT</rule>    ##仅允许172.26.100.1访问10001端口
  <rule priority="1" table="filter" ipv="ipv4" chain="INPUT">-p tcp -s 0.0.0.0/0 -m multiport --dports 10001,22,9100 -j DROP</rule>    ##拒绝其他IP访问10001、22、9100端口
  <rule priority="2" table="filter" ipv="ipv4" chain="INPUT">-p tcp -s 0.0.0.0/0 -j ACCEPT</rule>    ##允许所有IP访问本机所有端口
</direct>

注：顺序不能错，匹配规则是先匹配priority="0"  --> priority="1" --> priority="2"