firewalld是Centos7系统默认的防火墙管理工具,取代了之前的iptables防火墙
1.启动命令
关闭:systemctl stop firewalld.service
启动:systemctl start firewalld.service
重启:systemctl restart firewalld.service
禁止开机启动:systemctl disable firewalld.service
开机启用:systemctl enable firewalld.service
查看防火墙状态:systemctl status firewalld.service 或 firewall-cmd --state
查看防火墙所有信息:firewall-cmd --list-all
2.添加白名单
#查看开放的端口信息:
firewall-cmd --list-ports
#添加端口例外:
firewall-cmd --zone=public --add-port=11112/udp --permanent
#添加IP例外:
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.0.251/24" accept"
#添加指定IP指定端口例外:
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.0.251/24" port protocol="tcp" port="5432" accept"
#重启配置,重新加载后才会修改才会生效:
firewall-cmd --reload
3. 添加黑名单
#禁止IP访问:
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.0.0.42 drop'
#禁止某个IP访问某个端口
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=192.168.1.169 port protocol=tcp port=6379 accept'
#重建加载配置,重新加载后才会修改才会生效:
firewall-cmd --reload
4.删除黑白名单规则
#删除例外:
firewall-cmd --zone=public --remove-port=80/tcp --permanent
#添加指定ip例外:firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="192.168.0.251/24" accept"
#删除指定ip端口例外:
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="192.168.0.251/24" port protocol="tcp" port="5432" accept"
#参数说明
–zone #作用域
–add-port=8080/tcp #添加端口,格式为:端口/通讯协议
–permanent #永久生效,没有此参数重启后失效