linux下内部防火墙,Linux系统管理初步（五）Linux系统的防火墙-firewalld 编辑中

最新推荐文章于 2022-08-29 21:38:35 发布

姜一某

最新推荐文章于 2022-08-29 21:38:35 发布

阅读量113

点赞数

文章标签： linux下内部防火墙

一、firewalld中的9个zone

firewalld中有9个zone，各个zone的说明如下

drop

Any incoming network packets are dropped; there is no reply. Only outgoing network connections are possible.

block

Any incoming network connections are rejected with an icmp-host-prohibited message for IPv4 and icmp6-adm-prohibited for IPv6. Only network connections initiated from within the system are possible.

public

For use in public areas. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

external

For use on external networks with masquerading enabled, especially for routers. You do not trust the other computers on the network to not harm your computer. Only selected incoming connections are accepted.

dmz

For computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted.

work

For use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

home

For use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.

internal

For use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted.

trusted

All network connections are accepted.

译文：

由firewalld 提供的区域按照从不信任到信任的顺序排序。

丢弃 drop

任何流入网络的包都被丢弃，不作出任何响应。只允许流出的网络连接。

阻塞 block

任何进入的网络连接都被拒绝，并返回 IPv4 的 icmp-host-prohibited 报文或者 IPv6 的 icmp6-adm-prohibited 报文。只允许由该系统初始化的网络连接。

公开 public

用以可以公开的部分。你认为网络中其他的计算机不可信并且可能伤害你的计算机。只允许选中的连接接入。

外部 external

用在路由器等启用伪装的外部网络。你认为网络中其他的计算机不可信并且可能伤害你的计算机。只允许选中的连接接入。