前言

因为我用的是 阿里云 CentOS 7.0, 系统默认使用的是 FirewallD 防火墙,但阿里云默认不开启防火墙。 所以特地在网上搜索 FirewallD 防火墙的使用方法。
下面是我设置防火墙的过程:

需要先启动防火墙服务
systemctl start firewalld.service
使用 ifconfig 查看网卡情况
ifconfig
发现服务器的外网IP所对应网卡是 eth1 (根据IP判断得知)
添加网卡到防火墙控制 --permanent 参数表示永久,重启也可以生效
firewall-cmd --zone=public --permanent --add-interface=eth1
设置默认区域
firewall-cmd --set-default-zone=public
添加防火墙规则 public 区域表示 所添加的规则是允许通过的
firewall-cmd --permanent --zone=public --add-port=80/tcp
添加 8080 22 端口
firewall-cmd --permanent --zone=public --add-port=443/tcp
firewall-cmd --permanent --zone=public --add-port=22/tcp
热重启(不会使已经连接的连接中断),使配置生效
firewall-cmd --reload

测试,已经生效了

以下部分内容来自网络

 

firewalld安装:

yum install firewalld firewall-config #安装
systemctl start firewalld.service     #启动
systemctl enable firewalld.service    #启用
systemctl stop firewalld.service      #停止
systemctl disable firewalld.service   #禁用

区域zone概念:

firewalld系统默认存在以下区域:
drop:默认丢弃所有包
block:拒绝所有外部连接,允许内部发起的连接
public:指定外部连接可以进入
external:这个不太明白,功能上和上面相同,允许指定的外部连接
dmz:和硬件防火墙一样,受限制的公共连接可以进入
work:工作区,概念和workgoup一样,也是指定的外部连接允许
home:类似家庭组
internal:信任所有连接

firewall-cmd命令工具:

firewall-cmd --state  # 显示状态
firewall-cmd --get-active-zones   # 查看区域信息
firewall-cmd --get-zone-of-interface=eth0 #查看指定网卡所属区域 正常为eth0,阿里云ECS为ech1 可用ifconfig查看

##将网卡添加到区域,默认网卡都在public
firewall-cmd --zone=public --permanent --add-interface=eth0  #正常
firewall-cmd --zone=public --permanent --add-interface=eth1 #阿里云ECS服务器

firewall-cmd --set-default-zone=public  #设置默认区域
##开放指定端口
firewall-cmd --zone=public --add-port=80/tcp #开放80端口到public区域 重启生效
firewall-cmd --zone=public --add-port=8080/tcp #开放8080端口到public区域 重启生效
firewall-cmd --zone=public --remove-port=8080/tcp #关闭8080端口到public区域 重启生效

##使更改生效
firewall-cmd --reload   #无需断开已连接的TCP连接 “热重启”
firewall-cmd --complete-reload  #需要断开连接已连接的TCP连接 “冷重启”

firewall-cmd 帮助

Usage: firewall-cmd [OPTIONS...]

General Options
  -h, --help           Prints a short help text and exists
  -V, --version        Print the version string of firewalld
  -q, --quiet          Do not print status messages

Status Options
  --state              Return and print firewalld state
  --reload             Reload firewall and keep state information
  --complete-reload    Reload firewall and loose state information

Permanent Options
  --permanent          Set an option permanently
                       Usable for options maked with [P]

Zone Options
  --get-default-zone   Print default zone for connections and interfaces
  --set-default-zone=<zone>
                       Set default zone
  --get-active-zones   Print currently active zones
  --get-zones          Print predefined zones [P]
  --get-services       Print predefined services [P]
  --get-icmptypes      Print predefined icmptypes [P]
  --get-zone-of-interface=<interface>
                       Print name of the zone the interface is bound to [P]
  --get-zone-of-source=<source>[/<mask>]
                       Print name of the zone the source[/mask] is bound to [P]
  --list-all-zones     List everything added for or enabled in all zones [P]
  --new-zone=<zone>    Add a new zone [P only]
  --delete-zone=<zone> Delete an existing zone [P only]
  --zone=<zone>        Use this zone to set or query options, else default zone
                       Usable for options maked with [Z]
  --get-target         Get the zone target [P only]
  --set-target=<target>
                       Set the zone target [P only]

IcmpType Options
  --new-icmptype=<icmptype>
                       Add a new icmptype [P only]
  --delete-icmptype=<icmptype>
                       Delete and existing icmptype [P only]

Service Options
  --new-service=<service>
                       Add a new service [P only]
  --delete-service=<service>
                       Delete and existing service [P only]

Options to Adapt and Query Zones
  --list-all           List everything added for or enabled in a zone [P] [Z]
  --list-services      List services added for a zone [P] [Z]
  --timeout=<seconds>  Enable an option for seconds only
                       Usable for options maked with [T]
  --add-service=<service>
                       Add a service for a zone [P] [Z] [T]
  --remove-service=<service>
                       Remove a service from a zone [P] [Z]
  --query-service=<service>
                       Return whether service has been added for a zone [P] [Z]
  --list-ports         List ports added for a zone [P] [Z]
  --add-port=<portid>[-<portid>]/<protocol>
                       Add the port for a zone [P] [Z] [T]
  --remove-port=<portid>[-<portid>]/<protocol>
                       Remove the port from a zone [P] [Z]
  --query-port=<portid>[-<portid>]/<protocol>
                       Return whether the port has been added for zone [P] [Z]
  --list-icmp-blocks   List Internet ICMP type blocks added for a zone [P] [Z]
  --add-icmp-block=<icmptype>
                       Add an ICMP block for a zone [P] [Z] [T]
  --remove-icmp-block=<icmptype>
                       Remove the ICMP block from a zone [P] [Z]
  --query-icmp-block=<icmptype>
                       Return whether an ICMP block has been added for a zone
                       [P] [Z]
  --list-forward-ports List IPv4 forward ports added for a zone [P] [Z]
  --add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
                       Add the IPv4 forward port for a zone [P] [Z] [T]
  --remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
                       Remove the IPv4 forward port from a zone [P] [Z]


  --query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
                       Return whether the IPv4 forward port has been added for
                       a zone [P] [Z]
  --add-masquerade     Enable IPv4 masquerade for a zone [P] [Z] [T]
  --remove-masquerade  Disable IPv4 masquerade for a zone [P] [Z]
  --query-masquerade   Return whether IPv4 masquerading has been enabled for a
                       zone [P] [Z]
  --list-rich-rules    List rich language rules added for a zone [P] [Z]
  --add-rich-rule=<rule>
                       Add rich language rule 'rule' for a zone [P] [Z] [T]
  --remove-rich-rule=<rule>
                       Remove rich language rule 'rule' from a zone [P] [Z]
  --query-rich-rule=<rule>
                       Return whether a rich language rule 'rule' has been
                       added for a zone [P] [Z]

Options to Handle Bindings of Interfaces
  --list-interfaces    List interfaces that are bound to a zone [P] [Z]
  --add-interface=<interface>
                       Bind the <interface> to a zone [P] [Z]
  --change-interface=<interface>
                       Change zone the <interface> is bound to [Z]
  --query-interface=<interface>
                       Query whether <interface> is bound to a zone [P] [Z]
  --remove-interface=<interface>
                       Remove binding of <interface> from a zone [P] [Z]

Options to Handle Bindings of Sources
  --list-sources       List sources that are bound to a zone [P] [Z]
  --add-source=<source>[/<mask>]
                       Bind <source>[/<mask>] to a zone [P] [Z]
  --change-source=<source>[/<mask>]
                       Change zone the <source>[/<mask>] is bound to [Z]
  --query-source=<source>[/<mask>]
                       Query whether <source>[/<mask>] is bound to a zone
                       [P] [Z]
  --remove-source=<source>[/<mask>]
                       Remove binding of <source>[/<mask>] from a zone [P] [Z]

Direct Options
  --direct             First option for all direct options
  --get-all-chains
                       Get all chains [P]
  --get-chains {ipv4|ipv6|eb} <table>
                       Get all chains added to the table [P]
  --add-chain {ipv4|ipv6|eb} <table> <chain>
                       Add a new chain to the table [P]
  --remove-chain {ipv4|ipv6|eb} <table> <chain>
                       Remove the chain from the table [P]
  --query-chain {ipv4|ipv6|eb} <table> <chain>
                       Return whether the chain has been added to the table [P]
  --get-all-rules
                       Get all rules [P]
  --get-rules {ipv4|ipv6|eb} <table> <chain>
                       Get all rules added to chain in table [P]
  --add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
                       Add rule to chain in table [P]
  --remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
                       Remove rule with priority from chain in table [P]
  --remove-rules {ipv4|ipv6|eb} <table> <chain>
                       Remove rules from chain in table [P]
  --query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
                       Return whether a rule with priority has been added to
                       chain in table [P]
  --passthrough {ipv4|ipv6|eb} <arg>...
                       Pass a command through
  --get-all-passthroughs
                       Get all passthrough rules [P only]
  --get-passthroughs {ipv4|ipv6|eb} <arg>...
                       Get passthrough rules [P only]
  --add-passthrough {ipv4|ipv6|eb} <arg>...
                       Add a new passthrough rule [P only]
  --remove-passthrough {ipv4|ipv6|eb} <arg>...
                       Remove a passthrough rule [P only]
  --query-passthrough {ipv4|ipv6|eb} <arg>...
                       Return whether the passthrough rule has been added
                       [P only]

Lockdown Options
  --lockdown-on        Enable lockdown.
  --lockdown-off       Disable lockdown.
  --query-lockdown     Query whether lockdown is enabled

Lockdown Whitelist Options
  --list-lockdown-whitelist-commands
                       List all command lines that are on the whitelist [P]
  --add-lockdown-whitelist-command=<command>
                       Add the command to the whitelist [P]
  --remove-lockdown-whitelist-command=<command>
                       Remove the command from the whitelist [P]
  --query-lockdown-whitelist-command=<command>
                       Query whether the command is on the whitelist [P]
  --list-lockdown-whitelist-contexts
                       List all contexts that are on the whitelist [P]
  --add-lockdown-whitelist-context=<context>
                       Add the context context to the whitelist [P]
  --remove-lockdown-whitelist-context=<context>
                       Remove the context from the whitelist [P]
  --query-lockdown-whitelist-context=<context>
                       Query whether the context is on the whitelist [P]
  --list-lockdown-whitelist-uids
                       List all user ids that are on the whitelist [P]
  --add-lockdown-whitelist-uid=<uid>
                       Add the user id uid to the whitelist [P]
  --remove-lockdown-whitelist-uid=<uid>
                       Remove the user id uid from the whitelist [P]
  --query-lockdown-whitelist-uid=<uid>
                       Query whether the user id uid is on the whitelist [P]
  --list-lockdown-whitelist-users
                       List all user names that are on the whitelist [P]
  --add-lockdown-whitelist-user=<user>
                       Add the user name user to the whitelist [P]
  --remove-lockdown-whitelist-user=<user>
                       Remove the user name user from the whitelist [P]
  --query-lockdown-whitelist-user=<user>
                       Query whether the user name user is on the whitelist [P]

Panic Options
  --panic-on           Enable panic mode
  --panic-off          Disable panic mode
  --query-panic        Query whether panic mode is enabled

评论区
回复