firewalld（zone与service）

firewalld

打开firewalld

systemctl disable iptables //关闭iptables
systemctl stop iptables //禁止iptables开机启动
systemctl enable firewalld //开启firewalld
systemctl start firewalld //让firewalld开机启动

[root@shu-test ~]# systemctl disable iptables
Removed symlink /etc/systemd/system/basic.target.wants/iptables.service.
[root@shu-test ~]# systemctl stop iptables
[root@shu-test ~]# systemctl enable firewalld
Created symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.
[root@shu-test ~]# systemctl start firewalld
[root@shu-test ~]#

firewalld的9个zone

firewalld默认有9个zone
默认zone为public

drop（丢弃）：任何接收的网络数据包都被丢弃，没有回复。仅能有发送出去的网络连接；
block（限制）：任何接收的网络连接都会被IPv4的icmp-host-prohibited信息和IPv6的icmp6-adm-prohibited所拒绝；
public（公共）：在公共区域内使用，不能相信网络中的其他计算机不会队你造成危害，只接收经过选取的连接；
external（外部）：为路由器启用伪装功能的外部网络。只接收经过选取的连接；
dmz（非军事区）：用于你的非军事区的电脑，此区域内可以公开访问，可以有限的进入内部网络；只接收经过选取的连接；
work（工作）：用于工作区，基本相信网络内的其它计算机；只接收经过选取的连接；
home（家庭）：用于家庭网络，基本相信网络内的其他计算机；只接收经过选取的连接；
internal（内部）：用于内部网络，基本相信；只接收经过选取的连接；
trusted（信任）：可以接受所有的物理链接；

查询

查看所有zone

firewall-cmd --get-zones

[root@shu-test ~]# firewall-cmd --get-zones
block dmz drop external home internal public trusted work
[root@shu-test ~]#

查询默认的zone

firewall-cmd --get-default-zone
[root@shu-test ~]# firewall-cmd --get-default-zone
public
[root@shu-test ~]#

查询指定网卡是在的zone

firewall-cmd --get-zone-of-interface=ens33
查询ens33网卡所在的zone；

[root@shu-test ~]# firewall-cmd --get-zone-of-interface=ens33
work
[root@shu-test ~]#

查询所有网卡所在zone

firewall-cmd --get-active-zones
将所有网卡所在zone分别列出：

[root@shu-test ~]#
[root@shu-test ~]# firewall-cmd --get-active-zones
dmz
  interfaces: ens37
work
  interfaces: ens33
[root@shu-test ~]#

修改与删除

修改默认的zone

firewall-cmd --set-default-zone=work
将默认的zone改为work；

[root@shu-test ~]# firewall-cmd --set-default-zone=work
success
[root@shu-test ~]# firewall-cmd --get-default-zone
work
[root@shu-test ~]#

修改指定网卡所在zone

firewall-cmd --zone=dmz --add-interface=ens37
将网卡ens37是在zone为dmz；ens33不变；

[root@shu-test ~]# firewall-cmd --zone=dmz --add-interface=ens37
The interface is under control of NetworkManager, setting zone to 'dmz'.
success
[root@shu-test ~]# firewall-cmd --get-zone-of-interface=ens37
dmz
[root@shu-test ~]#
[root@shu-test ~]# firewall-cmd --get-zone-of-interface=ens33
work
[root@shu-test ~]#

针对网卡更改zone

firewall-cmd --zone=dmz --change-interface=lo
针对网卡lo更改zone为dmz；

[root@shu-test ~]# firewall-cmd --get-zone-of-interface=lo
no zone
[root@shu-test ~]# firewall-cmd --zone=dmz --change-interface=lo
success
[root@shu-test ~]# firewall-cmd --get-zone-of-interface=lo
dmz
[root@shu-test ~]#

针对网卡删除zone****

firewall-cmd --zone=dmz --remove-interface=lo
针对网卡lo删除掉zone；

[root@shu-test ~]# firewall-cmd --get-zone-of-interface=lo
dmz
[root@shu-test ~]# firewall-cmd --zone=dmz --remove-interface=lo
success
[root@shu-test ~]# firewall-cmd --get-zone-of-interface=lo
no zone
[root@shu-test ~]#

---

firewalld的service操作

列出当前系统所有的service

firewall-cmd --get-services

[root@shu-test ~]#
[root@shu-test ~]# firewall-cmd --get-services
RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync elasticsearch freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master high-availability http https imap imaps ipp ipp-client ipsec iscsi-target kadmin kerberos kibana klogin kpasswd kshell ldap ldaps libvirt libvirt-tls managesieve mdns mosh mountd ms-wbt mssql mysql nfs nrpe ntp open*** ovirt-imageio ovirt-storageconsole ovirt-vmconsole pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster quassel radius rpc-bind rsh rsyncd samba samba-client sane sip sips smtp smtp-submission smtps snmp snmptrap spideroak-lansync squid ssh synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server
[root@shu-test ~]#

查看当前zone下有哪些service

firewall-cmd --list-services

[root@shu-test ~]# firewall-cmd --list-services
ssh dhcpv6-client
[root@shu-test ~]#

查看指定zone下有哪些service

firewall-cmd --zone=public --list-services
查看public下有哪些service

[root@shu-test ~]# firewall-cmd --zone=public --list-services
ssh dhcpv6-client
[root@shu-test ~]#

增加service到zone下

（内存中，重启失效）
firewall-cmd --zone=public --add-service=http
将http服务增加到public下；

[root@shu-test ~]# firewall-cmd --zone=public --add-service=http
success
[root@shu-test ~]# firewall-cmd --zone=public --list-services
ssh dhcpv6-client http
[root@shu-test ~]#

删除zone中指定的service

firewall-cmd --zone=public --remove-service=http
将public中的http服务删除掉；

[root@shu-test ~]# firewall-cmd --zone=public --remove-service=http
success
[root@shu-test ~]# firewall-cmd --zone=public --list-services
ssh dhcpv6-client
[root@shu-test ~]#

永久增加service到zone下

（写入配置文档中）

zone的配置文档在/etc/firewalld/zones/目录下
模板在/usr/lib/firewalld/services/下
firewall-cmd --zone=public --add-service=http --perma
将http服务增加到public下，并写入配置文档中；

[root@shu-test ~]# firewall-cmd --zone=public --add-service=http --permanent
success
[root@shu-test ~]#
[root@shu-test ~]# cat /etc/firewalld/zones/public.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Public</short>
  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="ssh"/>
  <service name="dhcpv6-client"/>
  <service name="http"/>
</zone>
[root@shu-test ~]#

查询list-services是没有的，必须重启才有效；

小实验：

需求：ftp服务自定义端口1121，需要在work zone下面放行ftp；
思路：
用模板操作、先将ftp服务模板复制到配置模板下，这样firewall就会套用该模板，记得修改好端口为1121；
在work zone下面放行ftp，也就是将ftp服务添加到work中；但是之前不许讲work模板复制到firewall的zone下，
并在配置中添加ftp就ok；

1、复制ftp模板到/etc/firewalld/services/目录下

cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services/

[root@shu-test ~]# cp /usr/lib/firewalld/services/ftp.xml /etc/firewalld/services/
[root@shu-test ~]# ls /etc/firewalld/services/
ftp.xml
[root@shu-test ~]#

2、修改文件、将ftp端口21给为1121；

vim /etc/firewalld/services/ftp.xml
将port=“21”改成port=“1121”

[root@shu-test ~]# vim /etc/firewalld/services/ftp.xml
[root@shu-test ~]# cat /etc/firewalld/services/ftp.xml
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>FTP</short>
  <description>FTP is a protocol used for remote file transfer. If you plan to make your FTP server publicly available, enable this option. You need the vsftpd package installed for this option to be useful.</description>
  <port protocol="tcp" port="1121"/>
  <module name="nf_conntrack_ftp"/>
</service>
[root@shu-test ~]#

3、将work zone模板文件复制或移动到zone目录下；

cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/

[root@shu-test ~]# cp /usr/lib/firewalld/zones/work.xml /etc/firewalld/zones/
[root@shu-test ~]#
[root@shu-test ~]# ls /etc/firewalld/zones/
public.xml  public.xml.old  work.xml
[root@shu-test ~]#

4、修改zone配置文件work.xml

vim /etc/firewalld/zones/work.xml
在文档中添加一行 <service name="ftp"/>
表示在work zone中增加ftp服务；

[root@shu-test ~]# vim /etc/firewalld/zones/work.xml
[root@shu-test ~]# cat /etc/firewalld/zones/work.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
  <short>Work</short>
  <description>For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>
  <service name="ssh"/>
  <service name="dhcpv6-client"/>
  <service name="ftp"/>
</zone>
[root@shu-test ~]#

5、重新加载firewall

firewall-cmd --reload

[root@shu-test ~]# firewall-cmd --reload
success
[root@shu-test ~]#

测试：

验证下work zone里面的service是否有FTP

[root@shu-test ~]# firewall-cmd --zone=work --list-services
ssh dhcpv6-client ftp
[root@shu-test ~]#

转载于:https://blog.51cto.com/shuzonglu/2065615