{"id":18379,"date":"2014-07-31T10:38:03","date_gmt":"2014-07-31T02:38:03","guid":{"rendered":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/07\/31\/firewall-cmd-%e6%8c%87%e4%bb%a4\/"},"modified":"2021-03-18T17:23:59","modified_gmt":"2021-03-18T09:23:59","slug":"firewall-cmd-%e6%8c%87%e4%bb%a4","status":"publish","type":"post","link":"https:\/\/2blog.ilc.edu.tw\/25793\/2014\/07\/31\/firewall-cmd-%e6%8c%87%e4%bb%a4\/","title":{"rendered":"firewall-cmd \u6307\u4ee4"},"content":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1a
CentOS 7 Firewalld \u9632\u706b\u7246\u8aaa\u660e\u4ecb\u7d39 @ \u9ec3\u660f\u7684\u7518\u8517 :: \u96a8\u610f\u7aa9 Xuite\u65e5\u8a8c<\/a>
\u5c0f\u61f6\u87f2\u7684blog~: [CentOS 7] \u9632\u706b\u7246\u8a2d\u5b9a<\/a>
How to Configure ‘FirewallD’ in RHEL\/CentOS 7 and Fedora 21<\/a>
How To Set Up a Firewall Using FirewallD on CentOS 7 | DigitalOcean<\/a><\/p>\n

\u5728 CentOS 7<\/p>\n

# firewall-cmd –get-zones<\/span>
work drop internal external trusted home dmz public block<\/span><\/p>\n

# firewall-cmd –get-default-zone<\/span>
public<\/span><\/p>\n

# firewall-cmd –get-active-zones<\/span>
public<\/span>
\u00a0 interfaces: ens33 ppp0<\/span><\/p>\n

# firewall-cmd –set-default-zone=internal<\/span>
# firewall-cmd –get-default-zone<\/span>
internal<\/span>
[@more@]# firewall-cmd –list-all-zones<\/span>
work<\/span>
\u00a0 target: default<\/span>
\u00a0 icmp-block-inversion: no<\/span>
\u00a0 interfaces:<\/span>
\u00a0 sources:<\/span>
\u00a0 services: dhcpv6-client ssh<\/span>
\u00a0 ports:<\/span>
\u00a0 protocols:<\/span>
\u00a0 masquerade: no<\/span>
\u00a0 forward-ports:<\/span>
\u00a0 sourceports:<\/span>
\u00a0 icmp-blocks:<\/span>
\u00a0 rich rules:<\/span><\/p>\n

drop<\/span>
\u00a0 target: DROP<\/span>
\u00a0 icmp-block-inversion: no<\/span>
\u00a0 interfaces:<\/span>
\u00a0 sources:<\/span>
\u00a0 services:<\/span>
\u00a0 ports:<\/span>
\u00a0 protocols:<\/span>
\u00a0 masquerade: no<\/span>
\u00a0 forward-ports:<\/span>
\u00a0 sourceports:<\/span>
\u00a0 icmp-blocks:<\/span>
\u00a0 rich rules:<\/span><\/p>\n

internal<\/span>
\u00a0 target: default<\/span>
\u00a0 icmp-block-inversion: no<\/span>
\u00a0 interfaces:<\/span>
\u00a0 sources:<\/span>
\u00a0 services: dhcpv6-client mdns samba-client ssh<\/span>
\u00a0 ports:<\/span>
\u00a0 protocols:<\/span>
\u00a0 masquerade: no<\/span>
\u00a0 forward-ports:<\/span>
\u00a0 sourceports:<\/span>
\u00a0 icmp-blocks:<\/span>
\u00a0 rich rules:<\/span><\/p>\n

external<\/span>
\u00a0 target: default<\/span>
\u00a0 icmp-block-inversion: no<\/span>
\u00a0 interfaces:<\/span>
\u00a0 sources:<\/span>
\u00a0 services: ssh<\/span>
\u00a0 ports:<\/span>
\u00a0 protocols:<\/span>
\u00a0 masquerade: yes<\/span>
\u00a0 forward-ports:<\/span>
\u00a0 sourceports:<\/span>
\u00a0 icmp-blocks:<\/span>
\u00a0 rich rules:<\/span><\/p>\n

trusted (active)<\/span>
\u00a0 target: ACCEPT<\/span>
\u00a0 icmp-block-inversion: no<\/span>
\u00a0 interfaces: ens33<\/span>
\u00a0 sources:<\/span>
\u00a0 services:<\/span>
\u00a0 ports:<\/span>
\u00a0 protocols:<\/span>
\u00a0 masquerade: no<\/span>
\u00a0 forward-ports:<\/span>
\u00a0 sourceports:<\/span>
\u00a0 icmp-blocks:<\/span>
\u00a0 rich rules:<\/span><\/p>\n

home<\/span>
\u00a0 target: default<\/span>
\u00a0 icmp-block-inversion: no<\/span>
\u00a0 interfaces:<\/span>
\u00a0 sources:<\/span>
\u00a0 services: dhcpv6-client mdns samba-client ssh<\/span>
\u00a0 ports:<\/span>
\u00a0 protocols:<\/span>
\u00a0 masquerade: no<\/span>
\u00a0 forward-ports:<\/span>
\u00a0 sourceports:<\/span>
\u00a0 icmp-blocks:<\/span>
\u00a0 rich rules:<\/span><\/p>\n

dmz<\/span>
\u00a0 target: default<\/span>
\u00a0 icmp-block-inversion: no<\/span>
\u00a0 interfaces:<\/span>
\u00a0 sources:<\/span>
\u00a0 services: ssh<\/span>
\u00a0 ports:<\/span>
\u00a0 protocols:<\/span>
\u00a0 masquerade: no<\/span>
\u00a0 forward-ports:<\/span>
\u00a0 sourceports:<\/span>
\u00a0 icmp-blocks:<\/span>
\u00a0 rich rules:<\/span><\/p>\n

\u66ab\u6642\u958b\u653e ftp \u670d\u52d9
# firewall-cmd –add-service=ftp<\/span> <\/p>\n

\u6c38\u4e45\u958b\u653e ftp \u670d\u52d9
# firewall-cmd –add-service=ftp –permanent<\/span>
\u6c38\u4e45\u95dc\u9589
# firewall-cmd –remove-service=ftp –permanent<\/span>
success<\/span>
# firewall-cmd –zone=public –add-service=ftp –permanent<\/span>
# firewall-cmd –zone=home –add-service=ftp –permanent<\/span>
# firewall-cmd –zone=public –remove-service=ftp –permanent<\/span><\/p>\n

\u91cd\u65b0\u8f09\u5165
# firewall-cmd –reload<\/span>
# firewall-cmd –complete-reload
<\/span># \u5217\u51fa\u8a2d\u5b9a
# firewall-cmd –zone=public –list-all<\/span>
public (active)<\/span>
\u00a0 target: default<\/span>
\u00a0 icmp-block-inversion: no<\/span>
\u00a0 interfaces: ens33 ppp0<\/span>
\u00a0 sources:<\/span>
\u00a0 services: dhcpv6-client ocserv openvpn<\/span>
\u00a0 ports:<\/span>
\u00a0 protocols:<\/span>
\u00a0 masquerade: no<\/span>
\u00a0 forward-ports:<\/span>
\u00a0 sourceports:<\/span>
\u00a0 icmp-blocks:<\/span>
\u00a0 rich rules:<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 rule family=”ipv4″ source address=”192.168.1.0\/24″ service name=”ssh” accept<\/span>
\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 rule family=”ipv4″ source address=”192.168.1.0\/24″ service name=”http” accept<\/span><\/p>\n

# firewall-cmd –zone=public –list-services<\/span><\/span>
dhcpv6-client ocserv openvpn<\/span><\/p>\n

# firewall-cmd –zone=public –add-port=4990-4999\/udp –permanent<\/span>
# firewall-cmd –zone=public –list-ports<\/span><\/span>
4990-4999\/udp<\/span><\/p>\n

\u9650\u5b9a\u9023\u7dda\u4f86\u6e90 IP \u53ca\u958b\u653e\u7684\u670d\u52d9
# firewall-cmd –add-rich-rule=”rule family=”ipv4″ source address=”192.168.1.0\/24″ service name=”ssh” accept”<\/span> –permanent
<\/span># firewall-cmd –add-rich-rule=”rule family=”ipv4″ source address=”192.168.1.0\/24″ service name=”ssh” limit value=10\/m accept”<\/span> –permanent<\/span>
# firewall-cmd –add-rich-rule=”rule family=”ipv4″ source address=”192.168.1.0\/24″ service name=”http” accept”<\/span> –permanent
<\/span># firewall-cmd –add-rich-rule=”rule family=”ipv4″ source address=”192.168.1.0\/24″ port port=80 accept”<\/span> –permanent<\/span>
# firewall-cmd –remove-rich-rule=”rule family=”ipv4″ source address=”192.168.1.0\/24″ port port=80 accept”<\/span> –permanent<\/span><\/p>\n

\u4e5f\u53ef\u4ee5\u76f4\u63a5\u53bb\u7de8\u4fee \/etc\/firewalld\/zones\/public.xml<\/span>
# cat \/etc\/firewalld\/zones\/public.xml<\/span>
<?xml version=”1.0″ encoding=”utf-8″?><\/span>
<zone><\/span>
\u00a0 <short>Public<\/short><\/span>
\u00a0 <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.<\/description><\/span>
\u00a0 <service name=”dhcpv6-client”\/><\/span>
\u00a0 <service name=”openvpn”\/><\/span>
\u00a0 <rule family=”ipv4″><\/span>
\u00a0\u00a0\u00a0 <source address=”192.168.1.0\/24″\/><\/span>
\u00a0\u00a0\u00a0 <service name=”ssh”\/><\/span>
\u00a0\u00a0\u00a0 <accept\/><\/span>
\u00a0 <\/rule><\/span>
\u00a0 <rule family=”ipv4″><\/span>
\u00a0\u00a0\u00a0 <source address=”192.168.1.0\/24″\/><\/span>
\u00a0\u00a0\u00a0 <service name=”http”\/><\/span>
\u00a0\u00a0\u00a0 <accept\/><\/span>
\u00a0 <\/rule><\/span>
<\/zone><\/span><\/p>\n

\u91cd\u65b0\u8f09\u5165
# firewall-cmd –reload<\/span>
# firewall-cmd –complete-reload<\/span>
\u6216
\u8b93\u8a2d\u5b9a\u751f\u6548
# systemctl restart firewalld<\/span> <\/p>\n

\u6aa2\u8996\u8a2d\u5b9a\u662f\u5426\u751f\u6548
# iptables -L -n | grep 21<\/span>
ACCEPT\u00a0\u00a0\u00a0\u00a0 tcp\u00a0 —\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 0.0.0.0\/0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 tcp dpt:21 ctstate NEW<\/span>
\u6aa2\u67e5\u9632\u706b\u7246\u72c0\u614b
# firewall-cmd –state<\/span>
running<\/span> <\/p>\n

# systemctl stop firewalld<\/span>
# firewall-cmd –state<\/span>
not running<\/span> <\/p>\n

# firewall-cmd –list-all<\/span>
public (default) <\/span>
\u00a0 interfaces: <\/span>
\u00a0 sources: <\/span>
\u00a0 services: dhcpv6-client ftp ssh <\/span>
\u00a0 ports: <\/span>
\u00a0 masquerade: no <\/span>
\u00a0 forward-ports: <\/span>
\u00a0 icmp-blocks: <\/span>
\u00a0 rich rules:<\/span> <\/p>\n

\u5728 FirewallD \u7684\u670d\u52d9\u540d\u7a31
# firewall-cmd –get-service<\/span>
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https<\/span> <\/p>\n

\u67e5\u8a62\u670d\u52d9\u7684\u555f\u7528\u72c0\u614b
# firewall-cmd –query-service ftp<\/span>
yes<\/span>
# firewall-cmd –query-service ssh<\/span>
yes<\/span>
# firewall-cmd –query-service samba<\/span>
no<\/span>
# firewall-cmd –query-service http<\/span>
no<\/span> <\/p>\n

\u4fee\u6539 firewalld \u7cfb\u7d71\u5167\u5b9a\u7684\u670d\u52d9
\u5c07\u6a94\u6848\u8907\u88fd\u5230 \/etc\/firewalld\/services<\/span> \u76ee\u9304\u4e4b\u4e0b
# cp \/usr\/lib\/firewalld\/services\/openvpn.xml \/etc\/firewalld\/services<\/span>
\u5c07\u5167\u5b9a\u4f7f\u7528\u7684 udp<\/span> \u6539\u6210 tcp
# sed -i ‘s\/udp\/tcp\/’ \/etc\/firewalld\/services\/openvpn.xml<\/span><\/p>\n

\u81ea\u884c\u52a0\u5165\u8981\u958b\u653e\u7684 Port
# firewall-cmd –add-port=3128\/tcp <\/span>–permanent<\/span>
# firewall-cmd –list-all<\/span>
public (default) <\/span>
\u00a0 interfaces: <\/span>
\u00a0 sources: <\/span>
\u00a0 services: dhcpv6-client ftp ssh <\/span>
\u00a0 ports: 3128\/tcp <\/span><\/span>
\u00a0 masquerade: no <\/span>
\u00a0 forward-ports: <\/span>
\u00a0 icmp-blocks: <\/span>
\u00a0 rich rules:<\/span> <\/p>\n

\u76f4\u63a5\u5c07\u539f\u672c\u00a0 iptables \u4f7f\u7528\u7684\u898f\u5247\u79fb\u690d\u5230 firewalld
# firewall-cmd –permanent –direct –add-rule ipv4 filter INPUT 0 -p udp -s “140.111.74.0\/24” –dport 161 -j ACCEPT<\/span>
success<\/span>
\u6216\u8005\u76f4\u63a5\u4fee\u6539 \/etc\/firewalld\/direct.xml<\/span>
# cat \/etc\/firewalld\/direct.xml<\/span>
<?xml version=”1.0″ encoding=”utf-8″?><\/span>
<direct><\/span>
\u00a0\u00a0 <rule priority=”0″ table=”nat” ipv=”ipv4″ chain=”POSTROUTING”> -s 192.168.18.0\/24 -j MASQUERADE<\/rule><\/span>
\u00a0\u00a0 <rule priority=”0″ table=”filter” ipv=”ipv4″ chain=”INPUT”>-p tcp -s 192.168.1.0\/24 –dport 22 -j ACCEPT<\/rule><\/span>
\u00a0\u00a0 <rule priority=”0″ table=”filter” ipv=”ipv4″ chain=”INPUT”>-p udp -s 140.111.74.0\/24 –dport 161 -j ACCEPT<\/rule><\/span>
<\/direct><\/span><\/p>\n

\u67e5\u770b\u76ee\u524d\u7684 Direct \u898f\u5247
# firewall-cmd –direct –get-all-rules<\/span>
ipv4 nat POSTROUTING 0 -s 192.168.18.0\/24 -j MASQUERADE<\/span>
ipv4 filter INPUT 0 -p tcp -s 192.168.1.0\/24 –dport 22 -j ACCEPT<\/span>
ipv4 filter INPUT 0 -p udp -s 140.111.74.0\/24 –dport 161 -j ACCEPT<\/span><\/p>\n

NAT
# firewall-cmd –permanent –direct –passthrough ipv4 -t nat -A POSTROUTING -s\u00a0 10.8.0.0\/24 -o ppp0 -j MASQUERADE<\/span>
# firewall-cmd –reload<\/span><\/p>\n

# firewall-cmd –permanent –add-rich-rule ‘rule family=ipv4 source address=192.168.1.10\/24 forward-port port=8080 protocol=tcp to-port=80’<\/span><\/p>\n

\u5982\u679c\u771f\u7684\u4e0d\u7fd2\u6163\u4f7f\u7528 firewalld
\u5b89\u88dd iptables-services \u5957\u4ef6
# yum install iptables-services<\/span>
\u8a2d\u5b9a\u958b\u6a5f\u6642\u555f\u52d5 iptables \u670d\u52d9
# systemctl enable iptables.service<\/span>
Created symlink from \/etc\/systemd\/system\/basic.target.wants\/iptables.service to \/usr\/lib\/systemd\/system\/iptables.service.<\/span>
\u555f\u52d5 iptables \u670d\u52d9
# systemctl start iptables.service<\/span><\/p>\n

\u8a2d\u5b9a\u958b\u6a5f\u6642\u4e0d\u555f\u52d5 firewalld \u670d\u52d9
# systemctl disable firewalld.service<\/span>
Removed symlink \/etc\/systemd\/system\/dbus-org.fedoraproject.FirewallD1.service.<\/span>
Removed symlink \/etc\/systemd\/system\/basic.target.wants\/firewalld.service.<\/span>
\u8a2d\u5b9a\u53d6\u6d88\u4f7f\u7528 firewalld \u670d\u52d9
# systemctl mask firewalld.service<\/span>
Created symlink from \/etc\/systemd\/system\/firewalld.service to \/dev\/null.<\/span>
\u8a2d\u5b9a\u4e0d\u53d6\u6d88\u4f7f\u7528 firewalld \u670d\u52d9
# systemctl unmask firewalld.service<\/span>
Removed symlink \/etc\/systemd\/system\/firewalld.service.<\/span><\/p>\n

\u66f4\u591a\u7684 FirewallD \u8acb\u53c3\u8003\uff1ahttps:\/\/fedoraproject.org\/wiki\/FirewallD<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

\u53c3\u8003\u7db2\u7ad9\uff1aCentOS 7 Firewalld \u9632\u706b\u7246\u8aaa\u660e\u4ecb\u7d39 @ \u9ec3\u660f\u7684\u7518\u8517 :: \u96a8\u610f\u7aa9 Xuite\u65e5\u8a8c\u5c0f … <\/p>\n

\u95b1\u8b80\u5168\u6587\u3008firewall-cmd \u6307\u4ee4\u3009<\/span><\/a><\/p>\n","protected":false},"author":55,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[117,138],"tags":[],"class_list":["post-18379","post","type-post","status-publish","format-standard","hentry","category-c-78462","category-c-78483"],"meta_key":{"_pingme":["1"],"_encloseme":["1"],"lt_post_id":["512887"]},"_links":{"self":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18379"}],"collection":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/users\/55"}],"replies":[{"embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/comments?post=18379"}],"version-history":[{"count":1,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18379\/revisions"}],"predecessor-version":[{"id":20025,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/posts\/18379\/revisions\/20025"}],"wp:attachment":[{"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/media?parent=18379"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/categories?post=18379"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/2blog.ilc.edu.tw\/25793\/wp-json\/wp\/v2\/tags?post=18379"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}