目录
6、重启firewalld防火墙(修改配置后需要重启防火墙)
一、firewalld概念
firewalld是一个防火墙服务守护进程,它提供了一个具有D-Bus接口的动态可定制的基于主机的防火墙。它是动态的,允许创建、更改和删除规则,而无需在每次更改规则时重新启动防火墙守护程序。
二、firewalld基础
The configuration for firewalld is stored in various XML files in /usr/lib/firewalld/
and /etc/firewalld/
.
1、系统配置目录
/usr/lib/firewalld/services:存放定义好的网络服务和端口参数,系统参数,不能修改。
2、用户配置目录
/etc/firewalld/:用户可以通过修改配置文件的方式添加端口,也可以通过命令的方式添加端口,修改的内容会在/etc/firewalld/
目录下的配置文件中还体现。
三、firewalld常见命令
1、查看firewalld服务状态
systemctl status firewalld
[root@yang ~]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2021-05-09 00:34:55 EDT; 12h ago
Docs: man:firewalld(1)
Main PID: 672 (firewalld)
CGroup: /system.slice/firewalld.service
└─672 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopid
May 09 00:34:53 yang systemd[1]: Starting firewalld - dynamic firewall daemon...
May 09 00:34:55 yang systemd[1]: Started firewalld - dynamic firewall daemon.
May 09 00:34:57 yang firewalld[672]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. ...ling it now.
May 09 10:16:58 yang firewalld[672]: WARNING: AllowZoneDrifting is enabled. This is considered an insecure configuration option. It will be removed in a future release. ...ling it now.
Hint: Some lines were ellipsized, use -l to show in full.
2、查看firewalld的状态
firewall-cmd --state
[root@yang ~]# firewall-cmd --state
running
3、开启重启关闭firewalld服务
# 开启
service firewalld start
# 重启
service firewalld restart
# 关闭
service firewalld stop
4、查看防火墙规则
firewall-cmd --list-all
[root@yang ~]# firewall-cmd --list-all
public (active)
target: default
icmp-block-inversion: no
interfaces: enp0s3 enp0s8
sources:
services: dhcpv6-client ssh
ports: 8080/tcp
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
5、查询开放关闭firewalld端口
# 查询端口是否开放
firewall-cmd --query-port=8080/tcp
# 开放8080端口
firewall-cmd --permanent --add-port=8080/tcp
# 移除端口
firewall-cmd --permanent --remove-port=8080/tcp
6、重启firewalld防火墙(修改配置后需要重启防火墙)
firewall-cmd --reload
[root@yang ~]# firewall-cmd --permanent --add-port=8080/tcp
success
[root@yang ~]# firewall-cmd --query-port=8080/tcp
no
[root@yang ~]# firewall-cmd --reload
success
[root@yang ~]# firewall-cmd --query-port=8080/tcp
yes
四、限制或开放IP及端口
# 限制访问redis的IP
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="***.***.***.0/24" port protocol="tcp" port="6379" accept"
# 重新载入一下防火墙设置,使设置生效
firewall-cmd --reload
参考文献:
Chapter 5. Using Firewalls Red Hat Enterprise Linux 7 | Red Hat Customer Portal