文章目录一、防火墙查看状态二、防火墙启动关闭命令三、防火墙配置防火墙配置命令添加规则移除规则防火墙配置文件一、防火墙查看状态防火墙重新载入(必须重新载入后才能生效)firewall-cmd--reload防火墙查看基础状态systemctl status firewalld#查看状态查看 防火墙所有规则firewall-cmd --list-all查看rich-rules富规则)firewall-cmd --list-rich-rules查看防火墙服务规则firewall-cmd --list-services查看防火墙所有区域的配置规则firewall-cmd --list-all-zones查看默认区域firewall-cmd --get-default-zone查看网络接口使用区域firewall-cmd --get-active-zones查看默认的可用服务firewall-cmd --get-services二、防火墙启动关闭命令启动systemctl start firewalld#启动停止systemctl stop firewalld#停止重启firewall-cmd –reload#重启开机禁用systemctl disable firewalld#开机禁用开机启动systemctlenablefirewalld#开机启动三、防火墙配置防火墙配置命令添加规则在public中永久开放10022端口firewall-cmd--zonepublic --add-port10022/tcp--permanent--zone 网络区域 --permanent永久生效没有此参数重启后失效设置开放80端口开放firewall-cmd --add-servicehttp –permanent#添加一个服务permanentfirewall-cmd --add-port80/tcp –permanent# permanent上开放一个80端口允许192.168.1.10所有访问所有端口firewall-cmd--zonepublic --add-rich-rulerule familyipv4 source address192.168.1.10 accept--permanent允许192.168.2.0/24(0-255网段)所有访问所有端口firewall-cmd--zonepublic --add-rich-rulerule familyipv4 source address192.168.2.0/24 accept--permanent允许192.168.1.10所有访问TCP协议的22端口firewall-cmd--zonepublic --add-rich-rulerule familyipv4 source address192.168.1.10 port port22 protocoltcp accept--permanent移除规则移除permanent服务firewall-cmd --remove-servicehttp –permanent移除permanent服务上开放的80端口firewall-cmd --remove-port80/tcp –permanent移除192.168.1.10所有访问所有端口firewall-cmd--zonepublic --remove-rich-rulerule familyipv4 source address192.168.1.10 accept--permanent防火墙配置文件路径地址/etc/firewalld/zones/public.xml作者只用zones的空间作为举例?xml version1.0 encodingutf-8?zoneshortPublic/shortdescriptionFor use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted./descriptionservicenamessh/servicenamedhcpv6-client/servicenamecockpit/portprotocoltcpport22/rulefamilyipv4sourceaddress196.168.1.1/accept//rulerulefamilyipv4sourceaddress192.168.1.10/portport22protocoltcp/accept//rule/zone向所有ip开放端口22portprotocoltcpport10022向ip196.168.1.1开放所有端口rulefamilyipv4sourceaddress196.168.1.1/accept//rule允许ip192.168.1.10 访问 22端口rulefamilyipv4sourceaddress192.168.1.10/portport22protocoltcp/accept//rule
