Centos7最小化安装后 防火墙的配置

Centos7最小化安装后 防火墙的配置

（一）firewalld服务启用/停用

启动一个服务：systemctl start firewalld.service

关闭一个服务：systemctl stop firewalld.service

重启一个服务：systemctl restart firewalld.service

显示一个服务的状态：systemctl status firewalld.service

在开机时启用一个服务：systemctl enable firewalld.service

在开机时禁用一个服务：systemctl disable firewalld.service

查看服务是否开机启动：systemctl is-enabled firewalld.service

查看已启动的服务列表：systemctl list-unit-files|grep enabled

查看启动失败的服务列表：systemctl --failed

（二）配置firewalld-cmd

查看版本： firewall-cmd --version

查看帮助： firewall-cmd --help

显示状态： firewall-cmd --state

查看所有打开的端口： firewall-cmd --zone=public --list-ports

更新防火墙规则： firewall-cmd --reload

查看区域信息: firewall-cmd --zone=public --list-ports
get-active-zones

查看指定接口所属区域： firewall-cmd --get-zone-of-interface=eth0

拒绝所有包：firewall-cmd --panic-on

取消拒绝状态： firewall-cmd --panic-off

查看是否拒绝： firewall-cmd --query-panic

（三）端口管理：

添加： firewall-cmd --zone=public --add-port=80/tcp --permanent （--permanent 永久生效，没有此参数重启后失效）

重新载入：firewall-cmd --reload

查看：firewall-cmd --zone=public --query-port=80/tcp

删除：firewall-cmd --zone=public --remove-port=80/tcp --permanent

（四）正式环境下，看需要选择是否使用防火墙，这里为了方便后续配置，就先将其关闭：

关闭防火墙 systemctl stop firewalld
禁止开机自启systemctl disable firewalld
查看防火墙状态systemctl status firewalld

[root@master etc]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: active (running) since Thu 2018-04-19 23:07:22 EDT; 50min ago
     Docs: man:firewalld(1)
 Main PID: 773 (firewalld)
   CGroup: /system.slice/firewalld.service
           └─773 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid

Apr 19 23:57:11 master firewalld[773]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Apr 19 23:57:11 master firewalld[773]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:11 master firewalld[773]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Apr 19 23:57:11 master firewalld[773]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
[root@master etc]# 
[root@master etc]# systemctl stop firewalld
[root@master etc]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
   Active: inactive (dead) since Thu 2018-04-19 23:58:31 EDT; 3s ago
     Docs: man:firewalld(1)
  Process: 773 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=exited, status=0/SUCCESS)
 Main PID: 773 (code=exited, status=0/SUCCESS)

Apr 19 23:57:11 master firewalld[773]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Apr 19 23:57:11 master firewalld[773]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:58:30 master systemd[1]: Stopping firewalld - dynamic firewall daemon...
Apr 19 23:58:31 master systemd[1]: Stopped firewalld - dynamic firewall daemon.
[root@master etc]# 
[root@master etc]# systemctl disable firewalld
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@master etc]# 

参考： https://www.jianshu.com/p/cbf8e0009bc0