前言
因为我用的是 阿里云 CentOS 7.0, 系统默认使用的是 FirewallD 防火墙,但阿里云默认不开启防火墙。 所以特地在网上搜索 FirewallD 防火墙的使用方法。
下面是我设置防火墙的过程:
需要先启动防火墙服务
systemctl start firewalld.service
使用 ifconfig 查看网卡情况
ifconfig
发现服务器的外网IP所对应网卡是 eth1 (根据IP判断得知)
添加网卡到防火墙控制 --permanent 参数表示永久,重启也可以生效
firewall-cmd --zone=public --permanent --add-interface=eth1
设置默认区域
firewall-cmd --set-default-zone=public
添加防火墙规则 public 区域表示 所添加的规则是允许通过的
firewall-cmd --permanent --zone=public --add-port=80/tcp
添加 8080 22 端口
firewall-cmd --permanent --zone=public --add-port=443/tcp
firewall-cmd --permanent --zone=public --add-port=22/tcp
热重启(不会使已经连接的连接中断),使配置生效
firewall-cmd --reload
测试,已经生效了
以下部分内容来自网络
firewalld安装:
yum install firewalld firewall-config #安装 systemctl start firewalld.service #启动 systemctl enable firewalld.service #启用 systemctl stop firewalld.service #停止 systemctl disable firewalld.service #禁用
区域zone概念:
firewalld系统默认存在以下区域: drop:默认丢弃所有包 block:拒绝所有外部连接,允许内部发起的连接 public:指定外部连接可以进入 external:这个不太明白,功能上和上面相同,允许指定的外部连接 dmz:和硬件防火墙一样,受限制的公共连接可以进入 work:工作区,概念和workgoup一样,也是指定的外部连接允许 home:类似家庭组 internal:信任所有连接
firewall-cmd命令工具:
firewall-cmd --state # 显示状态 firewall-cmd --get-active-zones # 查看区域信息 firewall-cmd --get-zone-of-interface=eth0 #查看指定网卡所属区域 正常为eth0,阿里云ECS为ech1 可用ifconfig查看 ##将网卡添加到区域,默认网卡都在public firewall-cmd --zone=public --permanent --add-interface=eth0 #正常 firewall-cmd --zone=public --permanent --add-interface=eth1 #阿里云ECS服务器 firewall-cmd --set-default-zone=public #设置默认区域 ##开放指定端口 firewall-cmd --zone=public --add-port=80/tcp #开放80端口到public区域 重启生效 firewall-cmd --zone=public --add-port=8080/tcp #开放8080端口到public区域 重启生效 firewall-cmd --zone=public --remove-port=8080/tcp #关闭8080端口到public区域 重启生效 ##使更改生效 firewall-cmd --reload #无需断开已连接的TCP连接 “热重启” firewall-cmd --complete-reload #需要断开连接已连接的TCP连接 “冷重启”
firewall-cmd 帮助
Usage: firewall-cmd [OPTIONS...] General Options -h, --help Prints a short help text and exists -V, --version Print the version string of firewalld -q, --quiet Do not print status messages Status Options --state Return and print firewalld state --reload Reload firewall and keep state information --complete-reload Reload firewall and loose state information Permanent Options --permanent Set an option permanently Usable for options maked with [P] Zone Options --get-default-zone Print default zone for connections and interfaces --set-default-zone=<zone> Set default zone --get-active-zones Print currently active zones --get-zones Print predefined zones [P] --get-services Print predefined services [P] --get-icmptypes Print predefined icmptypes [P] --get-zone-of-interface=<interface> Print name of the zone the interface is bound to [P] --get-zone-of-source=<source>[/<mask>] Print name of the zone the source[/mask] is bound to [P] --list-all-zones List everything added for or enabled in all zones [P] --new-zone=<zone> Add a new zone [P only] --delete-zone=<zone> Delete an existing zone [P only] --zone=<zone> Use this zone to set or query options, else default zone Usable for options maked with [Z] --get-target Get the zone target [P only] --set-target=<target> Set the zone target [P only] IcmpType Options --new-icmptype=<icmptype> Add a new icmptype [P only] --delete-icmptype=<icmptype> Delete and existing icmptype [P only] Service Options --new-service=<service> Add a new service [P only] --delete-service=<service> Delete and existing service [P only] Options to Adapt and Query Zones --list-all List everything added for or enabled in a zone [P] [Z] --list-services List services added for a zone [P] [Z] --timeout=<seconds> Enable an option for seconds only Usable for options maked with [T] --add-service=<service> Add a service for a zone [P] [Z] [T] --remove-service=<service> Remove a service from a zone [P] [Z] --query-service=<service> Return whether service has been added for a zone [P] [Z] --list-ports List ports added for a zone [P] [Z] --add-port=<portid>[-<portid>]/<protocol> Add the port for a zone [P] [Z] [T] --remove-port=<portid>[-<portid>]/<protocol> Remove the port from a zone [P] [Z] --query-port=<portid>[-<portid>]/<protocol> Return whether the port has been added for zone [P] [Z] --list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z] --add-icmp-block=<icmptype> Add an ICMP block for a zone [P] [Z] [T] --remove-icmp-block=<icmptype> Remove the ICMP block from a zone [P] [Z] --query-icmp-block=<icmptype> Return whether an ICMP block has been added for a zone [P] [Z] --list-forward-ports List IPv4 forward ports added for a zone [P] [Z] --add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Add the IPv4 forward port for a zone [P] [Z] [T] --remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Remove the IPv4 forward port from a zone [P] [Z] --query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]] Return whether the IPv4 forward port has been added for a zone [P] [Z] --add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T] --remove-masquerade Disable IPv4 masquerade for a zone [P] [Z] --query-masquerade Return whether IPv4 masquerading has been enabled for a zone [P] [Z] --list-rich-rules List rich language rules added for a zone [P] [Z] --add-rich-rule=<rule> Add rich language rule 'rule' for a zone [P] [Z] [T] --remove-rich-rule=<rule> Remove rich language rule 'rule' from a zone [P] [Z] --query-rich-rule=<rule> Return whether a rich language rule 'rule' has been added for a zone [P] [Z] Options to Handle Bindings of Interfaces --list-interfaces List interfaces that are bound to a zone [P] [Z] --add-interface=<interface> Bind the <interface> to a zone [P] [Z] --change-interface=<interface> Change zone the <interface> is bound to [Z] --query-interface=<interface> Query whether <interface> is bound to a zone [P] [Z] --remove-interface=<interface> Remove binding of <interface> from a zone [P] [Z] Options to Handle Bindings of Sources --list-sources List sources that are bound to a zone [P] [Z] --add-source=<source>[/<mask>] Bind <source>[/<mask>] to a zone [P] [Z] --change-source=<source>[/<mask>] Change zone the <source>[/<mask>] is bound to [Z] --query-source=<source>[/<mask>] Query whether <source>[/<mask>] is bound to a zone [P] [Z] --remove-source=<source>[/<mask>] Remove binding of <source>[/<mask>] from a zone [P] [Z] Direct Options --direct First option for all direct options --get-all-chains Get all chains [P] --get-chains {ipv4|ipv6|eb} <table> Get all chains added to the table [P] --add-chain {ipv4|ipv6|eb} <table> <chain> Add a new chain to the table [P] --remove-chain {ipv4|ipv6|eb} <table> <chain> Remove the chain from the table [P] --query-chain {ipv4|ipv6|eb} <table> <chain> Return whether the chain has been added to the table [P] --get-all-rules Get all rules [P] --get-rules {ipv4|ipv6|eb} <table> <chain> Get all rules added to chain in table [P] --add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Add rule to chain in table [P] --remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Remove rule with priority from chain in table [P] --remove-rules {ipv4|ipv6|eb} <table> <chain> Remove rules from chain in table [P] --query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>... Return whether a rule with priority has been added to chain in table [P] --passthrough {ipv4|ipv6|eb} <arg>... Pass a command through --get-all-passthroughs Get all passthrough rules [P only] --get-passthroughs {ipv4|ipv6|eb} <arg>... Get passthrough rules [P only] --add-passthrough {ipv4|ipv6|eb} <arg>... Add a new passthrough rule [P only] --remove-passthrough {ipv4|ipv6|eb} <arg>... Remove a passthrough rule [P only] --query-passthrough {ipv4|ipv6|eb} <arg>... Return whether the passthrough rule has been added [P only] Lockdown Options --lockdown-on Enable lockdown. --lockdown-off Disable lockdown. --query-lockdown Query whether lockdown is enabled Lockdown Whitelist Options --list-lockdown-whitelist-commands List all command lines that are on the whitelist [P] --add-lockdown-whitelist-command=<command> Add the command to the whitelist [P] --remove-lockdown-whitelist-command=<command> Remove the command from the whitelist [P] --query-lockdown-whitelist-command=<command> Query whether the command is on the whitelist [P] --list-lockdown-whitelist-contexts List all contexts that are on the whitelist [P] --add-lockdown-whitelist-context=<context> Add the context context to the whitelist [P] --remove-lockdown-whitelist-context=<context> Remove the context from the whitelist [P] --query-lockdown-whitelist-context=<context> Query whether the context is on the whitelist [P] --list-lockdown-whitelist-uids List all user ids that are on the whitelist [P] --add-lockdown-whitelist-uid=<uid> Add the user id uid to the whitelist [P] --remove-lockdown-whitelist-uid=<uid> Remove the user id uid from the whitelist [P] --query-lockdown-whitelist-uid=<uid> Query whether the user id uid is on the whitelist [P] --list-lockdown-whitelist-users List all user names that are on the whitelist [P] --add-lockdown-whitelist-user=<user> Add the user name user to the whitelist [P] --remove-lockdown-whitelist-user=<user> Remove the user name user from the whitelist [P] --query-lockdown-whitelist-user=<user> Query whether the user name user is on the whitelist [P] Panic Options --panic-on Enable panic mode --panic-off Disable panic mode --query-panic Query whether panic mode is enabled
评论区
回复