一查看linux当前的所有zone[rootblog ~]$ firewall-cmd --get-zones block dmz drop external home internal nm-shared public trusted work二各个zone的区别1, 一个网络区域zone定义了网络连接的信任级别trusted 区 受信任区。接受所有网络连接。该区绑定的规则如网卡、源网段、服务等不受防火墙阻挡所有流量均可通过。internal 区 用于内部网络。home 区 用于家庭区域。work 区 用于工作区域。internal、home、work 这 3 个区你基本上相信网络上的其他计算机不会损害你的计算机。只接受选定的传入连接。dmz 区 用于在非军事区内可公开访问但对内部网络有限制访问的计算机。只接受选定的传入连接。external 区 用于启用伪装的外部网络特别是路由器。你不相信网络上的其他计算机不会损害你的计算机。只接受选定的传入连接。public 区 在公共场所使用。你不相信网络上的其他计算机不会损害你的计算机。只接受选定的传入连接。block 区 任何传入的网络连接将被拒绝IPv4和IPv6将分别发送icmp-host- forbid消息和icmp6-adm- forbid消息。只有在这个系统内发起的网络连接是可能的。drop 区 任何传入的网络数据包被丢弃没有应答。只可能传出网络连接。2, 查看各个区默认的规则:每个zone就是一组规则的集合如何查看它们默认的规则有哪些?默认规则的保存路径:/usr/lib/firewalld/zones/上面的这个路径可以用rpm查询firewalld安装包得到[rootblog zones]# rpm -ql firewalld | grep zones /etc/firewalld/zones /usr/lib/firewalld/zones/block.xml /usr/lib/firewalld/zones/dmz.xml /usr/lib/firewalld/zones/drop.xml /usr/lib/firewalld/zones/external.xml /usr/lib/firewalld/zones/home.xml /usr/lib/firewalld/zones/internal.xml /usr/lib/firewalld/zones/public.xml /usr/lib/firewalld/zones/trusted.xml /usr/lib/firewalld/zones/work.xml /usr/share/man/man5/firewalld.zones.5.gz进入目录后可以看到默认zone的xml配置文件:[rootblog zones]# cd /usr/lib/firewalld/zones/ [rootblog zones]# ls block.xml dmz.xml drop.xml external.xml home.xml internal.xml nm-shared.xml public.xml trusted.xml work.xml3,查看各个zone规则的不同:drop.xml[rootblog zones]# more drop.xml ?xml version1.0 encodingutf-8? zone targetDROP shortDrop/short descriptionUnsolicited incoming network packets are dropped. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed./description forward/ /zoneblock[rootblog zones]# more block.xml ?xml version1.0 encodingutf-8? zone target%%REJECT%% shortBlock/short descriptionUnsolicited incoming network packets are rejected. Incoming packets that are related to outgoing network connections are accepted. Outgoing network connections are allowed./description forward/ /zonepublic[rootblog zones]# more public.xml ?xml version1.0 encodingutf-8? zone shortPublic/short descriptionFor use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namedhcpv6-client/ service namecockpit/ forward/ /zonetrusted[rootblog zones]# more trusted.xml ?xml version1.0 encodingutf-8? zone targetACCEPT shortTrusted/short descriptionAll network connections are accepted./description forward/ /zonework[rootblog zones]# more work.xml ?xml version1.0 encodingutf-8? zone shortWork/short descriptionFor use in work areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namedhcpv6-client/ service namecockpit/ forward/ /zonehome[rootblog zones]# more home.xml ?xml version1.0 encodingutf-8? zone shortHome/short descriptionFor use in home areas. You mostly trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namemdns/ service namesamba-client/ service namedhcpv6-client/ service namecockpit/ forward/ /zonedmz[rootblog zones]# more dmz.xml ?xml version1.0 encodingutf-8? zone shortDMZ/short descriptionFor computers in your demilitarized zone that are publicly-accessible with limited access to your internal network. Only selected incoming connections are accepted ./description service namessh/ forward/ /zoneexternal[rootblog zones]# more external.xml ?xml version1.0 encodingutf-8? zone shortExternal/short descriptionFor use on external networks. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./descrip tion service namessh/ masquerade/ forward/ /zoneinternal[rootblog zones]# more internal.xml ?xml version1.0 encodingutf-8? zone shortInternal/short descriptionFor use on internal networks. You mostly trust the other computers on the networks to not harm your computer. Only selected incoming connections are accepted./description service namessh/ service namemdns/ service namesamba-client/ service namedhcpv6-client/ service namecockpit/ forward/ /zone三查看九个内置zone的默认target1, 分别查询:说明可以看到:多数zone的target就是default,但有三个不同的zone:trusted: target为ACCEPTdrop: target为DROPblock: target为REJECT所以在生产环境中不会对这三个zone添加复杂的规则只是把它们作为白名单、黑名单使用[rootblog ~]# firewall-cmd --zonetrusted --permanent --get-target ACCEPT [rootblog ~]# firewall-cmd --zonepublic --permanent --get-target default [rootblog ~]# firewall-cmd --zonedrop --permanent --get-target DROP [rootblog ~]# firewall-cmd --zoneblock --permanent --get-target REJECT [rootblog ~]# firewall-cmd --zoneexternal --permanent --get-target default [rootblog ~]# firewall-cmd --zoneinternal --permanent --get-target default [rootblog ~]# firewall-cmd --zonedmz --permanent --get-target default [rootblog ~]# firewall-cmd --zonework --permanent --get-target default [rootblog ~]# firewall-cmd --zonehome --permanent --get-target default2,列出所有zone的规则:[rootblog ~]# firewall-cmd --list-all-zones四比较public/home/external/internal/work/dmz这六个zone的区别这六个zone的target同为default它们的区别在哪里?它们的不同之处在于默认规则的不同1work/publicwork和public两个zone相同都允许ssh/dhcpv6-client/cockpit三种服务的访问ssh不用说了,dhcpv6-client是dhcpv6的客户端所用的端口是:546如果不是动态的ip建议关闭此服务cockpit: 红帽开发的网页版图像化服务管理工具优点是无需中间层且可以管理多种服务它所用的端口是:9090如果不需要从图形界面对服务器管理建议关闭此服务2home/internalhome和internal两个zone相同都允许 ssh/mdns/samba-client/dhcpv6-client/cockpit五种服务的访问ssh/dhcpv6-client/cockpit 上面已讲到samba-client提供samba服务的客户端服务它的端口是:udp协议138mdnsmDNS是一种基于多播的服务发现协议通过它可以使设备在局域网内自动发现彼此的服务,它的端口是:udp协议53533,dmz/externaldmz只提供ssh服务,external则额外打开了masquerade/:它用来开启端口转发或代理上网
