Centos7最小化安装后 防火墙的配置
(一)firewalld服务启用/停用
启动一个服务:systemctl start firewalld.service
关闭一个服务:systemctl stop firewalld.service
重启一个服务:systemctl restart firewalld.service
显示一个服务的状态:systemctl status firewalld.service
在开机时启用一个服务:systemctl enable firewalld.service
在开机时禁用一个服务:systemctl disable firewalld.service
查看服务是否开机启动:systemctl is-enabled firewalld.service
查看已启动的服务列表:systemctl list-unit-files|grep enabled
查看启动失败的服务列表:systemctl --failed
(二)配置firewalld-cmd
查看版本: firewall-cmd --version
查看帮助: firewall-cmd --help
显示状态: firewall-cmd --state
查看所有打开的端口: firewall-cmd --zone=public --list-ports
更新防火墙规则: firewall-cmd --reload
查看区域信息: firewall-cmd --zone=public --list-ports
get-active-zones
查看指定接口所属区域: firewall-cmd --get-zone-of-interface=eth0
拒绝所有包:firewall-cmd --panic-on
取消拒绝状态: firewall-cmd --panic-off
查看是否拒绝: firewall-cmd --query-panic
(三)端口管理:
添加: firewall-cmd --zone=public --add-port=80/tcp --permanent (--permanent 永久生效,没有此参数重启后失效)
重新载入:firewall-cmd --reload
查看:firewall-cmd --zone=public --query-port=80/tcp
删除:firewall-cmd --zone=public --remove-port=80/tcp --permanent
(四)正式环境下,看需要选择是否使用防火墙,这里为了方便后续配置,就先将其关闭:
关闭防火墙 systemctl stop firewalld
禁止开机自启systemctl disable firewalld
查看防火墙状态systemctl status firewalld
[root@master etc]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2018-04-19 23:07:22 EDT; 50min ago
Docs: man:firewalld(1)
Main PID: 773 (firewalld)
CGroup: /system.slice/firewalld.service
└─773 /usr/bin/python -Es /usr/sbin/firewalld --nofork --nopid
Apr 19 23:57:11 master firewalld[773]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Apr 19 23:57:11 master firewalld[773]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:11 master firewalld[773]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Apr 19 23:57:11 master firewalld[773]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
[root@master etc]#
[root@master etc]# systemctl stop firewalld
[root@master etc]# systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: inactive (dead) since Thu 2018-04-19 23:58:31 EDT; 3s ago
Docs: man:firewalld(1)
Process: 773 ExecStart=/usr/sbin/firewalld --nofork --nopid $FIREWALLD_ARGS (code=exited, status=0/SUCCESS)
Main PID: 773 (code=exited, status=0/SUCCESS)
Apr 19 23:57:11 master firewalld[773]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Apr 19 23:57:11 master firewalld[773]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'beyond-scope' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: beyond-scope: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'failed-policy' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: failed-policy: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:57:31 master firewalld[773]: WARNING: ICMP type 'reject-route' is not supported by the kernel for ipv6.
Apr 19 23:57:31 master firewalld[773]: WARNING: reject-route: INVALID_ICMPTYPE: No supported ICMP type., ignoring for run-time.
Apr 19 23:58:30 master systemd[1]: Stopping firewalld - dynamic firewall daemon...
Apr 19 23:58:31 master systemd[1]: Stopped firewalld - dynamic firewall daemon.
[root@master etc]#
[root@master etc]# systemctl disable firewalld
Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.
Removed symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.
[root@master etc]#
参考: https://www.jianshu.com/p/cbf8e0009bc0