一、常用命令
#查看防火墙状态
systemctl status firewalld
#关闭防火墙
systemctl stop firewalld
#3、开启防火墙
systemctl start firewalld
#4、禁止防火墙开机自启动
systemctl disable firewalld
#5、设置防火墙开机自启动
systemctl enable firewalld
使用firewall-cmd命令管理防火墙
# 查看防火墙状态：
firewall-cmd --state
#查看防火墙，添加的端口也可以看到：
firewall-cmd --list-all
#列出所有区域的设置:
firewall-cmd --list-all-zones
#查看防火墙已开放的端口列表(默认不开放任何端口)
firewall-cmd --list-ports
# 查看获取的区域
[root@localhost ~] firewall-cmd --get-active-zones
docker
interfaces: docker0
注意：所有操作之前都需附带 --zone=public --permanent（指定区域和永久生效）。操作之后需要执行firewall-cmd --reload刷新配置。
# 添加规则 开启80端口（允许80端口通过防火墙）
firewall-cmd --permanent --zone=public --add-port=80/tcp # --permanent (永久生效)
#更新防火墙规则
firewall-cmd --reload
# 删除开放的端口
firewall-cmd --permanent --zone=public --remove-port=80/tcp
# 查看80端口状态：
firewall-cmd --zone=public --query-port=80/tcp
-------------- ip白名单设置 ----------------
#关闭某个端口
#开启某个端口（指定IP可访问） 只允许服务器192.168.1.1/24网段的3306端口能访问
firewall-cmd --permanent --zone=public --add-rich-rule="rule family="ipv4" source address="192.168.1.1/24" port protocol="tcp" port="3306" accept"
#禁止ping数据包：
firewall-cmd --permanent --add-rich-rule='rule protocol value=icmp drop'
# 关闭某个端口（删除策略）
firewall-cmd --permanent --zone=public --remove-rich-rule="rule family="ipv4" source address="10.1.1.14/32" port protocol="tcp" port="80" accept"
# 拒绝所有包：
firewall-cmd --panic-on
# 取消拒绝状态：
firewall-cmd --panic-off
# 查看是否拒绝：
firewall-cmd --query-panic
#显示服务列表：
firewall-cmd --get-services
#允许SSH服务通过：
firewall-cmd --add-service=ssh
#禁止SSH服务通过：
firewall-cmd --remove-service=ssh
#显示当前服务：
firewall-cmd --list-services
#临时允许Samba服务通过600秒：
firewall-cmd --enable service=samba --timeout=600
#查看指定接口所属区域：
firewall-cmd --get-zone-of-interface=eth0
#完全重新载入规则（会中断已连接的连接，类似于重启）：
firewall-cmd --complete-reload
注意：打开防火墙后一定要先添加ssh端口到规则中，并重新载入
firewall-cmd --permanent --zone=public --add-port=22/tcp
firewall-cmd --reload
二、配置docker0服务到受信任连接
#配置docker0服务到受信任连接
nmcli connection modify docker0 connection.zone trusted
#停止NetworkManager（检测网络、自动连接网络的程序）服务
systemctl stop NetworkManager.service
#修改docker网络接口为内部区域（永久）
firewall-cmd --permanent --zone=trusted --change-interface=docker0
#启动NetworkManager（检测网络、自动连接网络的程序）服务
systemctl start NetworkManager.service
#配置docker0服务到受信任连接
nmcli connection modify docker0 connection.zone trusted
#重启docker服务
systemctl restart docker.service
三、help 帮助详解
[root@localhost ~]# firewall-cmd --help
Usage: firewall-cmd [OPTIONS...]
General Options
-h, --help Prints a short help text and exists
-V, --version Print the version string of firewalld
-q, --quiet Do not print status messages
Status Options 状态选择
--state Return and print firewalld state 返回并打印防火墙状态
--reload Reload firewall and keep state information 重新加载防火墙并保留状态信息
--complete-reload Reload firewall and lose state information 重新加载防火墙并丢失状态信息
--runtime-to-permanent
Create permanent from runtime configuration
--check-config Check permanent configuration for errors
Log Denied Options 日志拒绝选项
--get-log-denied Print the log denied value 打印日志拒绝值
--set-log-denied=
Set log denied value
Automatic Helpers Options
--get-automatic-helpers
Print the automatic helpers value
--set-automatic-helpers=
Set automatic helpers value
Permanent Options
--permanent Set an option permanently
Usable for options marked with [P]
Zone Options 区域选项
Zone Options
--get-default-zone Print default zone for connections and interfaces 打印连接和接口的默认区域
--set-default-zone=
Set default zone 设置默认区域
--get-active-zones Print currently active zones 打印当前活动区域
--get-zones Print predefined zones [P] 打印预定义区域
--get-services Print predefined services [P] 打印预定义服务
--get-icmptypes Print predefined icmptypes [P]
--get-zone-of-interface=
Print name of the zone the interface is bound to [P]
--get-zone-of-source=[/]||ipset:
Print name of the zone the source is bound to [P]
--list-all-zones List everything added for or enabled in all zones [P]
--new-zone= Add a new zone [P only]
--new-zone-from-file= [--name=]
Add a new zone from file with optional name [P only]
--delete-zone= Delete an existing zone [P only]
--load-zone-defaults=
Load zone default settings [P only] [Z]
--zone= Use this zone to set or query options, else default zone
Usable for options marked with [Z]
--get-target Get the zone target [P only] [Z]
--set-target=
Set the zone target [P only] [Z]
--info-zone= Print information about a zone
--path-zone= Print file path of a zone [P only]
IPSet Options
IPSet Options
--get-ipset-types Print the supported ipset types 打印支持的ipset类型
--new-ipset= --type= [--option=[=]]..
Add a new ipset [P only]
--new-ipset-from-file= [--name=]
Add a new ipset from file with optional name [P only]
--delete-ipset=
Delete an existing ipset [P only]
--load-ipset-defaults=
Load ipset default settings [P only]
--info-ipset= Print information about an ipset
--path-ipset= Print file path of an ipset [P only]
--get-ipsets Print predefined ipsets
--ipset= --set-description=
Set new description to ipset [P only]
--ipset= --get-description
Print description for ipset [P only]
--ipset= --set-short=
Set new short description to ipset [P only]
--ipset= --get-short
Print short description for ipset [P only]
--ipset= --add-entry=
Add a new entry to an ipset [P]
--ipset= --remove-entry=
Remove an entry from an ipset [P]
--ipset= --query-entry=
Return whether ipset has an entry [P]
--ipset= --get-entries
List entries of an ipset [P]
--ipset= --add-entries-from-file=
Add a new entries to an ipset [P]
--ipset= --remove-entries-from-file=
Remove entries from an ipset [P]
IcmpType Options
IcmpType Options
--new-icmptype=
Add a new icmptype [P only]
--new-icmptype-from-file= [--name=]
Add a new icmptype from file with optional name [P only]
--delete-icmptype=
Delete an existing icmptype [P only]
--load-icmptype-defaults=
Load icmptype default settings [P only]
--info-icmptype=
Print information about an icmptype
--path-icmptype=
Print file path of an icmptype [P only]
--icmptype= --set-description=
Set new description to icmptype [P only]
--icmptype= --get-description
Print description for icmptype [P only]
--icmptype= --set-short=
Set new short description to icmptype [P only]
--icmptype= --get-short
Print short description for icmptype [P only]
--icmptype= --add-destination=
Enable destination for ipv in icmptype [P only]
--icmptype= --remove-destination=
Disable destination for ipv in icmptype [P only]
--icmptype= --query-destination=
Return whether destination ipv is enabled in icmptype [P only]
--icmptype= --get-destinations
List destinations in icmptype [P only]
Service Options
Service Options
--new-service=
Add a new service [P only]
--new-service-from-file= [--name=]
Add a new service from file with optional name [P only]
--delete-service=
Delete an existing service [P only]
--load-service-defaults=
Load icmptype default settings [P only]
--info-service=
Print information about a service
--path-service=
Print file path of a service [P only]
--service= --set-description=
Set new description to service [P only]
--service= --get-description
Print description for service [P only]
--service= --set-short=
Set new short description to service [P only]
--service= --get-short
Print short description for service [P only]
--service= --add-port=[-]/
Add a new port to service [P only]
--service= --remove-port=[-]/
Remove a port from service [P only]
--service= --query-port=[-]/
Return whether the port has been added for service [P only]
--service= --get-ports
List ports of service [P only]
--service= --add-protocol=
Add a new protocol to service [P only]
--service= --remove-protocol=
Remove a protocol from service [P only]
--service= --query-protocol=
Return whether the protocol has been added for service [P only]
--service= --get-protocols
List protocols of service [P only]
--service= --add-source-port=[-]/
Add a new source port to service [P only]
--service= --remove-source-port=[-]/
Remove a source port from service [P only]
--service= --query-source-port=[-]/
Return whether the source port has been added for service [P only]
--service= --get-source-ports
List source ports of service [P only]
--service= --add-module=
Add a new module to service [P only]
--service= --remove-module=
Remove a module from service [P only]
--service= --query-module=
Return whether the module has been added for service [P only]
--service= --get-modules
List modules of service [P only]
--service= --set-destination=:[/]
Set destination for ipv to address in service [P only]
--service= --remove-destination=
Disable destination for ipv i service [P only]
--service= --query-destination=:[/]
Return whether destination ipv is set for service [P only]
--service= --get-destinations
List destinations in service [P only]
Options to Adapt and Query Zones 适应和查询区域的选项
Options to Adapt and Query Zones
--list-all List everything added for or enabled in a zone [P] [Z]
--list-services List services added for a zone [P] [Z]
--timeout= Enable an option for timeval time, where timeval is
a number followed by one of letters 's' or 'm' or 'h'
Usable for options marked with [T]
--set-description=
Set new description to zone [P only] [Z]
--get-description Print description for zone [P only] [Z]
--set-short=
Set new short description to zone [P only] [Z]
--get-short Print short description for zone [P only] [Z]
--add-service=
Add a service for a zone [P] [Z] [T]
--remove-service=
Remove a service from a zone [P] [Z]
--query-service=
Return whether service has been added for a zone [P] [Z]
--list-ports List ports added for a zone [P] [Z]
--add-port=[-]/
Add the port for a zone [P] [Z] [T]
--remove-port=[-]/
Remove the port from a zone [P] [Z]
--query-port=[-]/
Return whether the port has been added for zone [P] [Z]
--list-protocols List protocols added for a zone [P] [Z]
--add-protocol=
Add the protocol for a zone [P] [Z] [T]
--remove-protocol=
Remove the protocol from a zone [P] [Z]
--query-protocol=
Return whether the protocol has been added for zone [P] [Z]
--list-source-ports List source ports added for a zone [P] [Z]
--add-source-port=[-]/
Add the source port for a zone [P] [Z] [T]
--remove-source-port=[-]/
Remove the source port from a zone [P] [Z]
--query-source-port=[-]/
Return whether the source port has been added for zone [P] [Z]
--list-icmp-blocks List Internet ICMP type blocks added for a zone [P] [Z]
--add-icmp-block=
Add an ICMP block for a zone [P] [Z] [T]
--remove-icmp-block=
Remove the ICMP block from a zone [P] [Z]
--query-icmp-block=
Return whether an ICMP block has been added for a zone
[P] [Z]
--add-icmp-block-inversion
Enable inversion of icmp blocks for a zone [P] [Z]
--remove-icmp-block-inversion
Disable inversion of icmp blocks for a zone [P] [Z]
--query-icmp-block-inversion
Return whether inversion of icmp blocks has been enabled
for a zone [P] [Z]
--list-forward-ports List IPv4 forward ports added for a zone [P] [Z]
--add-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=[/]]
Add the IPv4 forward port for a zone [P] [Z] [T]
--remove-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=[/]]
Remove the IPv4 forward port from a zone [P] [Z]
--query-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=[/]]
Return whether the IPv4 forward port has been added for
a zone [P] [Z]
--add-masquerade Enable IPv4 masquerade for a zone [P] [Z] [T]
--remove-masquerade Disable IPv4 masquerade for a zone [P] [Z]
--query-masquerade Return whether IPv4 masquerading has been enabled for a
zone [P] [Z]
--list-rich-rules List rich language rules added for a zone [P] [Z]
--add-rich-rule=
Add rich language rule 'rule' for a zone [P] [Z] [T]
--remove-rich-rule=
Remove rich language rule 'rule' from a zone [P] [Z]
--query-rich-rule=
Return whether a rich language rule 'rule' has been
added for a zone [P] [Z]
Options to Handle Bindings of Interfaces 处理接口绑定的选项
Options to Handle Bindings of Interfaces
--list-interfaces List interfaces that are bound to a zone [P] [Z]
--add-interface=
Bind the to a zone [P] [Z]
--change-interface=
Change zone the is bound to [P] [Z]
--query-interface=
Query whether is bound to a zone [P] [Z]
--remove-interface=
Remove binding of from a zone [P] [Z]
Options to Handle Bindings of Sources
--list-sources List sources that are bound to a zone [P] [Z]
--add-source=[/]||ipset:
Bind the source to a zone [P] [Z]
--change-source=[/]||ipset:
Change zone the source is bound to [Z]
--query-source=[/]||ipset:
Query whether the source is bound to a zone [P] [Z]
--remove-source=[/]||ipset:
Remove binding of the source from a zone [P] [Z]
Helper Options 助手选项
Helper Options
--new-helper= --module= [--family=]
Add a new helper [P only]
--new-helper-from-file= [--name=]
Add a new helper from file with optional name [P only]
--delete-helper=
Delete an existing helper [P only]
--load-helper-defaults=
Load helper default settings [P only]
--info-helper= Print information about an helper
--path-helper= Print file path of an helper [P only]
--get-helpers Print predefined helpers
--helper= --set-description=
Set new description to helper [P only]
--helper= --get-description
Print description for helper [P only]
--helper= --set-short=
Set new short description to helper [P only]
--helper= --get-short
Print short description for helper [P only]
--helper= --add-port=[-]/
Add a new port to helper [P only]
--helper= --remove-port=[-]/
Remove a port from helper [P only]
--helper= --query-port=[-]/
Return whether the port has been added for helper [P only]
--helper= --get-ports
List ports of helper [P only]
--helper= --set-module=
Set module to helper [P only]
--helper= --get-module
Get module from helper [P only]
--helper= --set-family={ipv4|ipv6|}
Set family for helper [P only]
--helper= --get-family
Get module from helper [P only]
Direct Options 直接选项
Direct Options
--direct First option for all direct options 所有直接选项的第一个选项
--get-all-chains
Get all chains [P] 获得所有链条
--get-chains {ipv4|ipv6|eb}
Get all chains added to the table [P]
–add-chain {ipv4|ipv6|eb}
Add a new chain to the table [P]
–remove-chain {ipv4|ipv6|eb}
Remove the chain from the table [P]
–query-chain {ipv4|ipv6|eb}
Return whether the chain has been added to the table [P]
–get-all-rules
Get all rules [P]
–get-rules {ipv4|ipv6|eb}
Get all rules added to chain in table [P]
–add-rule {ipv4|ipv6|eb}
…
Add rule to chain in table [P]
–remove-rule {ipv4|ipv6|eb}
…
Remove rule with priority from chain in table [P]
–remove-rules {ipv4|ipv6|eb}
Remove rules from chain in table [P]
–query-rule {ipv4|ipv6|eb}
…
Return whether a rule with priority has been added to
chain in table [P]
–passthrough {ipv4|ipv6|eb} …
Pass a command through (untracked by firewalld)
–get-all-passthroughs
Get all tracked passthrough rules [P]
–get-passthroughs {ipv4|ipv6|eb} …
Get tracked passthrough rules [P]
–add-passthrough {ipv4|ipv6|eb} …
Add a new tracked passthrough rule [P]
–remove-passthrough {ipv4|ipv6|eb} …
Remove a tracked passthrough rule [P]
–query-passthrough {ipv4|ipv6|eb} …
Return whether the tracked passthrough rule has been
added [P]
Lockdown Options
Lockdown Options
--lockdown-on Enable lockdown.
--lockdown-off Disable lockdown.
--query-lockdown Query whether lockdown is enabled
Lockdown Whitelist Options
Lockdown Whitelist Options
--list-lockdown-whitelist-commands
List all command lines that are on the whitelist [P]
--add-lockdown-whitelist-command=
Add the command to the whitelist [P]
--remove-lockdown-whitelist-command=
Remove the command from the whitelist [P]
--query-lockdown-whitelist-command=
Query whether the command is on the whitelist [P]
--list-lockdown-whitelist-contexts
List all contexts that are on the whitelist [P]
--add-lockdown-whitelist-context=
Add the context context to the whitelist [P]
--remove-lockdown-whitelist-context=
Remove the context from the whitelist [P]
--query-lockdown-whitelist-context=
Query whether the context is on the whitelist [P]
--list-lockdown-whitelist-uids
List all user ids that are on the whitelist [P]
--add-lockdown-whitelist-uid=
Add the user id uid to the whitelist [P]
--remove-lockdown-whitelist-uid=
Remove the user id uid from the whitelist [P]
--query-lockdown-whitelist-uid=
Query whether the user id uid is on the whitelist [P]
--list-lockdown-whitelist-users
List all user names that are on the whitelist [P]
--add-lockdown-whitelist-user=
Add the user name user to the whitelist [P]
--remove-lockdown-whitelist-user=
Remove the user name user from the whitelist [P]
--query-lockdown-whitelist-user=
Query whether the user name user is on the whitelist [P]
Panic Options
Panic Options
--panic-on Enable panic mode
--panic-off Disable panic mode
--query-panic Query whether panic mode is enabled
总结
以上为个人经验，希望能给大家一个参考，也希望大家多多支持IT俱乐部。
相关文章
-
-
-
-
Apache 认证总结
经常上网的读者会遇到这种情况：访问一些网站的某些资源时，浏览器弹出一个对话框，要求输入用户名和密码来获取对资源的访问。
2009-05-05
-
-
linux如何无损调整分区大小
本篇文章主要介绍了linux如何无损调整分区大小，小编觉得挺不错的，现在分享给大家，也给大家做个参考。一起跟随小编过来看看吧
2017-05-05
-
Linux curl表单登录或提交与cookie使用详解
这篇文章主要给大家介绍了关于Linux curl表单登录或提交与cookie使用的相关资料，文中通过示例代码介绍的非常详细，对大家学习或者使用Linux系统具有一定的参考学习价值，需要的朋友们下面来一起学习学习吧
2019-08-08
-
-
Linux查看文件夹大小以及删除大量文件方法
有时候Linux主机磁盘占用过多,需要进行手动清理,一方面是查看文件夹占用大小,另一方面是进行文件的高效删除,所以本文介绍了Linux查看文件夹大小以及删除大量文件方法,需要的朋友可以参考下
2024-09-09
-
var ourl = “104.116.116.112.115.58.47.47.98.108.111.103.46.99.115.100.110.46.110.101.116.47.113.113.95.51.51.56.48.53.56.54.50.47.97.114.116.105.99.108.101.47.100.101.116.97.105.108.115.47.49.51.53.53.50.50.55.51.56.”;
var viewer = new Viewer(getid(‘content’));
var __sinfo=’pyzi9J572XlrIdqs4vs4d9ttw6_WehJuw3vvUnEcNHFDHbQAeaFrGlqVAVMr0Sad76zJJrg77GzynJfWOHsNXAAUHcTRAuJ72Y8Me0Myj6J1FtCPx3PGL7F7NtiiCL2N’,__st=’ff70014ba458ed1b26faf0a81c5eb7123c8998306a8fb4c8e999e91803d69b7d’;
{
“@context”: “https://ziyuan.baidu.com/contexts/cambrian.jsonld”,
“@id”: “https://www.2it.club/server/334108etm.htm”,
“appid”: “1549322409310619”,
“title”: “linux之防火墙firewall解读”,
“description”: “本文介绍了如何使用`firewall-cmd`命令管理防火墙,配置Docker0服务到受信任连接,并详细解释了防火墙区域选项、IP集选项、ICMP类型选项、服务选项等”,
“pubDate”: “2025-01-13T09:36:31”,
“upDate”: “2025-01-13T09:36:31”
}
最新评论