Linuxfirewalld防火墙

Linuxfirewalld防火墙

• 根据所在的网络场所区分，预设区域

  • public：仅允许访问本机的ssh、dhcp、ping服务

  • trusted：允许任何访问

  • block：拒绝任何来访请求

  • drop：丢弃任何来访的数据包，不给任何回应

查看虚拟机nsd2210防火墙默认区域

[root@server ~]# firewall-cmd --get-default-zone
public

虚拟机B访问请求nsd2210

[root@pc2 ~]# curl 192.168.88.240 #失败
curl: (7) Failed connect to 192.168.88.240:80; 没有到主机的路由
[root@pc2 ~]# curl ftp://192.168.88.240 #失败
curl: (7) Failed connect to 192.168.88.240:21; 没有到主机的路由
[root@pc2 ~]# ping -c 1 192.168.88.240 #成功
PING 192.168.88.240 (192.168.88.240) 56(84) bytes of data.
64 bytes from 192.168.88.240: icmp_seq=1 ttl=64 time=0.319 ms
​
--- 192.168.88.240 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.319/0.319/0.319/0.000 ms

虚拟机A修改默认区域

[root@server ~]# firewall-cmd --set-default-zone=trusted
success
[root@server ~]# firewall-cmd --get-default-zone
trusted

虚拟机B再次访问请求nsd2210

[root@pc2 ~]# curl ftp://192.168.88.240 #成功
-rw-r--r--    1 0        0               0 Aug 20 14:52 a.txt
drwxr-xr-x    2 0        0               6 Oct 13  2020 pub
[root@pc2 ~]# curl 192.168.88.240 #成功
aaaa
[root@pc2 ~]# ping -c 1 192.168.88.240 #成功
PING 192.168.88.240 (192.168.88.240) 56(84) bytes of data.
64 bytes from 192.168.88.240: icmp_seq=1 ttl=64 time=0.346 ms
​
--- 192.168.88.240 ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 0.346/0.346/0.346/0.000 ms

查看public区域支持的协议

[root@server ~]# firewall-cmd --set-default-zone=public #把默认区域修改为public
success
[root@server ]# firewall-cmd --zone=public --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client ssh  #dhcp、ssh协议，支持ping协议，没显示
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
增加个http协议
[root@server ~]# firewall-cmd --zone=public --add-service=http #增加http协议
success
[root@server ~]# firewall-cmd --zone=public --list-all #查看支持的协议
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client http ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
​

此时用虚拟机B访问nsd2210的web服务和ftp服务

[root@pc2 ~]# curl 192.168.88.240 #成功
aaaa
[root@pc2 ~]# curl ftp://192.168.88.240 #失败
curl: (7) Failed connect to 192.168.88.240:21; 没有到主机的路由
​

再增加个ftp协议，尝试访问

[root@server ~]# firewall-cmd --add-service=ftp --zone=public #增加ftp协议
success
[root@pc2 ~]# curl ftp://192.168.88.240 #访问成功
-rw-r--r--    1 0        0               0 Aug 20 14:52 a.txt
drwxr-xr-x    2 0        0               6 Oct 13  2020 pub
​

删除http协议，尝试访问

[root@server ~]# firewall-cmd --remove-service=http --zone=public #删除http协议
success
[root@server ~]# firewall-cmd --zone=public  --list-all #查看public区域的协议
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client ftp ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
[root@pc2 ~]# curl 192.168.88.240 #访问失败
curl: (7) Failed connect to 192.168.88.240:80; 没有到主机的路由
​

上面添加的协议都是临时的，使用reload参数重新加载，会恢复默认规则

[root@server ~]# firewall-cmd --reload #重新加载
success
[root@server ~]# firewall-cmd --list-all --zone=public
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
​

防火墙public区域永久添加规则 --permanent

[root@server ~]# firewall-cmd --permanent --add-service=http --zone=public #永久添加协议
success
[root@server ~]# firewall-cmd --list-all --zone=public #查看协议，发现没有显示http协议，这是因为永久添加需要重新加载才生效
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
​
[root@server ~]# firewall-cmd --reload #重新加载
success
[root@server ~]# firewall-cmd --list-all --zone=public #查看支持协议
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client http ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
#删除http协议
[root@server ~]# firewall-cmd --permanent --remove-service=http --zone=public #永久删除
success
[root@server ~]# firewall-cmd --reload      #重新加载
success
[root@server ~]# firewall-cmd --list-all --zone=public #查看协议
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:
​

防火墙单独拒绝pc2的所有访问

[root@server ~]# firewall-cmd --zone=block --add-source=192.168.88.2
success
[root@pc2 ~]# curl 192.168.88.240
curl: (7) Failed connect to 192.168.88.240:80; 没有到主机的路由
[root@pc2 ~]# curl ftp://192.168.88.240
curl: (7) Failed connect to 192.168.88.240:21; 没有到主机的路由

删除策略

[root@server ~]# firewall-cmd --zone=block --remove-source=192.168.88.2
success
​