firewall-cmd

firewalld添加的规则用iptables命令都可以查到，也可以删除（firewalld重启后，删除的规则会再次添加上）。
生产上一个规则脚本

cat firewall-cmd.sh 
#!/bin/bash
#开放22端口
firewall-cmd --zone=public --add-port=22/tcp --permanent
#查询22端口是否开放
firewall-cmd --zone=public --query-port=22/tcp
#打开192.168.62.9的80,3306,9200,9300端口访问
firewall-cmd --permanent --add-rich-rule="rule family="ipv4"  port protocol="tcp" port="22" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.62.9" port protocol="tcp" port="80" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.62.9" port protocol="tcp" port="3306" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.62.9" port protocol="tcp" port="9200" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.62.9" port protocol="tcp" port="9300" accept"
#打开175.163.251.161的80,3306,9200,9300端口访问
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="175.163.251.161" port protocol="tcp" port="80" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="175.163.251.161" port protocol="tcp" port="3306" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="175.163.251.161" port protocol="tcp" port="9200" accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="175.163.251.161" port protocol="tcp" port="9300" accept"
#禁止任何ip访问3306,9200,9300端口
firewall-cmd --permanent --add-rich-rule="rule family="ipv4"  port protocol="tcp" port="80" drop"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4"  port protocol="tcp" port="3306" drop"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4"  port protocol="tcp" port="9200" drop"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4"  port protocol="tcp" port="9300" drop"

#firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.140.0/24" port protocol="tcp" port="22" reject"
#禁止任何ip任何端口访问
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4"  port protocol="tcp" port="0-65535" drop"


#Firewall关闭80端口
#firewall-cmd --zone=public--remove-port=80/tcp --permanent

#重载配置使其生效
firewall-cmd --reload
#查看设置的规则
firewall-cmd --zone=public --list-ports
firewall-cmd --zone=public --list-rich-rules

–permanent永久生效，没有此参数当即生效（不用–reload）重启后失效；使用此参数不会当即生效，–reload后才生效。
注意在配置防火墙的时候，如果不重启firewalld不会把自己关外边。

firewall-cmd --zone=public --list-services
ssh dhcpv6-client

由于有这条规则存在，导致iptables规则一直有一条规则，即使删除了，重启firewalld依然存在。

11       0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:22 ctstate NEW