防火墙分为硬件防火墙和软件防火墙
系统服务:firewalld,CentOS7系统默认使用的防火墙,CentOS6系统默认使用的防火强iptables
防火墙:匹配即停止
管理工具:firewalld-cmd
防火墙预设安全区域
- public:仅允许访问本机的sshd、DHCP、ping等少量服务
- trusted:允许任何访问
- block:拒绝任何来访请求,有明确回应
- drop:丢弃任何来访的数据包,没有任何回应
#开启防火墙
[root@localhost ~]# systemctl start firewalld
#查看默认区域
[root@localhost ~]# firewall-cmd --get-default-zone
public
#修改默认区域
firewall-cmd --set-default-zone=区域名
#将默认区域修改为block
[root@localhost ~]# firewall-cmd --set-default-zone=block
success
[root@localhost ~]# firewall-cmd --get-default-zone
block
#将默认区域修改为dorp
[root@localhost ~]# firewall-cmd --set-default-zone=drop
success
[root@localhost ~]# firewall-cmd --get-default-zone
drop
#将默认区域修改为public
[root@localhost ~]# firewall-cmd --set-default-zone=public
success
[root@localhost ~]# firewall-cmd --get-default-zone
public
#查看区域规则
firewall-cmd --zone=区域名 --list-all
#查看public所有规则
[root@localhost ~]# firewall-cmd --zone=public --list-all
public (active)
target: default #默认区域
icmp-block-inversion: no
interfaces: ens32
sources:
services: ssh dhcpv6-client #允许访问的服务
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
#为public区域添加http协议,使用 --add-service=服务名
[root@localhost ~]# firewall-cmd --zone=public --add-service=http
success
[root@localhost ~]# firewall-cmd --zone=public --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens32
sources:
services: ssh dhcpv6-client http #添加http协议
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
#为public添加ftp协议
[root@localhost ~]# firewall-cmd --zone=public --add-service=ftp
success
[root@localhost ~]# firewall-cmd --zone=public --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens32
sources:
services: ssh dhcpv6-client http ftp #添加ftp协议
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
- 封网段开服务
#若针对永久配置需添加 --permanent
#使用 -- add-source=网段地址
#为public区域永久添加http协议
[root@localhost ~]# firewall-cmd --permanent --zone=public --add-service=http
success
[root@localhost ~]# firewall-cmd --zone=public --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens32
sources:
services: ssh dhcpv6-client http ftp
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
#为public区域永久添加ftp协议
[root@localhost ~]# firewall-cmd --permanent --zone=public --add-service=ftp
success
[root@localhost ~]# firewall-cmd --zone=public --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens32
sources:
services: ssh dhcpv6-client http ftp
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
#永久修改需重新加载防火墙配置
firewall-cmd --reload
[root@localhost ~]# firewall-cmd --reload
success
#单独拒绝某一个IP
[root@localhost ~]# firewall-cmd --zone=block --add-source=192.168.0.24
success
[root@localhost ~]# firewall-cmd --zone=block --list-all
block (active)
target: %%REJECT%%
icmp-block-inversion: no
interfaces:
sources: 192.168.0.24
services:
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
#删除规则:--remove-source
#删除block区域的指定IP
[root@localhost ~]# firewall-cmd --zone=block --remove-source=192.168.0.24
success
[root@localhost ~]# firewall-cmd --zone=block --list-all
block
#删除public区域的ftp协议
[root@localhost ~]# firewall-cmd --zone=public --remove-service=ftp
success
[root@localhost ~]# firewall-cmd --zone=public --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens32
sources:
services: ssh dhcpv6-client http
- 防火墙端口映射
- 本地应用的端口重定向(端口1 > 端口2)从客户机访问 端口1 的请求,自动映射到本机端口2
#当有人访问5432端口时,映射到本机的80端口
[root@localhost ~]# firewall-cmd --zone=public --add-forward-port=port=5432:proto=tcp:toport=80
success
#命令解释:
--add--forward #添加转发端口
port=port=5432 #指定转发的端口
proto=tcp #指定tcp协议
toport=80 #指定目标端口
[root@localhost ~]# firewall-cmd --zone=public --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: ens32
sources:
services: ssh dhcpv6-client http
ports:
protocols:
masquerade: no
forward-ports: port=5432:proto=tcp:toport=80:toaddr=
source-ports:
icmp-blocks:
rich rules: