欢迎来到starnight_cyber的博客

Firewalld命令行参数中文注释

Firewalld命令行参数中文注释,这鬼东西,太多,看了脑壳疼。

help帮助文档

# firewall-cmd -h

Usage: firewall-cmd [OPTIONS...]

General Options
  -h, --help           Prints a short help text and exists
  -V, --version        Print the version string of firewalld
  -q, --quiet          Do not print status messages

Status Options
  --state              Return and print firewalld state
  --reload             Reload firewall and keep state information
  --complete-reload    Reload firewall and loose state information
  --runtime-to-permanent
                       Create permanent from runtime configuration

Permanent Options
  --permanent          Set an option permanently
                       Usable for options maked with [P]

Zone Options
  --get-default-zone   Print default zone for connections and interfaces
  --set-default-zone=<zone>
                       Set default zone
  --get-active-zones   Print currently active zones
  --get-zones          Print predefined zones [P]
  --get-services       Print predefined services [P]
  --get-icmptypes      Print predefined icmptypes [P]
  --get-zone-of-interface=<interface>
                       Print name of the zone the interface is bound to [P]
  --get-zone-of-source=<source>[/<mask>]
                       Print name of the zone the source[/mask] is bound to [P]
  --list-all-zones     List everything added for or enabled in all zones [P]
  --new-zone=<zone>    Add a new zone [P only]
  --delete-zone=<zone> Delete an existing zone [P only]
  --zone=<zone>        Use this zone to set or query options, else default zone
                       Usable for options maked with [Z]
  --get-target         Get the zone target [P] [Z]
  --set-target=<target>
                       Set the zone target [P] [Z]

IcmpType Options
  --new-icmptype=<icmptype>
                       Add a new icmptype [P only]
  --delete-icmptype=<icmptype>
                       Delete and existing icmptype [P only]

Service Options
  --new-service=<service>
                       Add a new service [P only]
  --delete-service=<service>
                       Delete and existing service [P only]

Options to Adapt and Query Zones
  --list-all           List everything added for or enabled in a zone [P] [Z]
  --list-services      List services added for a zone [P] [Z]
  --timeout=<timeval>  Enable an option for timeval time, where timeval is
                       a number followed by one of letters 's' or 'm' or 'h'
                       Usable for options maked with [T]
  --add-service=<service>
                       Add a service for a zone [P] [Z] [T]
  --remove-service=<service>
                       Remove a service from a zone [P] [Z]
  --query-service=<service>
                       Return whether service has been added for a zone [P] [Z]
  --list-ports         List ports added for a zone [P] [Z]
  --add-port=<portid>[-<portid>]/<protocol>
                       Add the port for a zone [P] [Z] [T]
  --remove-port=<portid>[-<portid>]/<protocol>
                       Remove the port from a zone [P] [Z]
  --query-port=<portid>[-<portid>]/<protocol>
                       Return whether the port has been added for zone [P] [Z]
  --list-icmp-blocks   List Internet ICMP type blocks added for a zone [P] [Z]
  --add-icmp-block=<icmptype>
                       Add an ICMP block for a zone [P] [Z] [T]
  --remove-icmp-block=<icmptype>
                       Remove the ICMP block from a zone [P] [Z]
  --query-icmp-block=<icmptype>
                       Return whether an ICMP block has been added for a zone
                       [P] [Z]
  --list-forward-ports List IPv4 forward ports added for a zone [P] [Z]
  --add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
                       Add the IPv4 forward port for a zone [P] [Z] [T]
  --remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
                       Remove the IPv4 forward port from a zone [P] [Z]


  --query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
                       Return whether the IPv4 forward port has been added for
                       a zone [P] [Z]
  --add-masquerade     Enable IPv4 masquerade for a zone [P] [Z] [T]
  --remove-masquerade  Disable IPv4 masquerade for a zone [P] [Z]
  --query-masquerade   Return whether IPv4 masquerading has been enabled for a
                       zone [P] [Z]
  --list-rich-rules    List rich language rules added for a zone [P] [Z]
  --add-rich-rule=<rule>
                       Add rich language rule 'rule' for a zone [P] [Z] [T]
  --remove-rich-rule=<rule>
                       Remove rich language rule 'rule' from a zone [P] [Z]
  --query-rich-rule=<rule>
                       Return whether a rich language rule 'rule' has been
                       added for a zone [P] [Z]

Options to Handle Bindings of Interfaces
  --list-interfaces    List interfaces that are bound to a zone [P] [Z]
  --add-interface=<interface>
                       Bind the <interface> to a zone [P] [Z]
  --change-interface=<interface>
                       Change zone the <interface> is bound to [Z]
  --query-interface=<interface>
                       Query whether <interface> is bound to a zone [P] [Z]
  --remove-interface=<interface>
                       Remove binding of <interface> from a zone [P] [Z]

Options to Handle Bindings of Sources
  --list-sources       List sources that are bound to a zone [P] [Z]
  --add-source=<source>[/<mask>]
                       Bind <source>[/<mask>] to a zone [P] [Z]
  --change-source=<source>[/<mask>]
                       Change zone the <source>[/<mask>] is bound to [Z]
  --query-source=<source>[/<mask>]
                       Query whether <source>[/<mask>] is bound to a zone
                       [P] [Z]
  --remove-source=<source>[/<mask>]
                       Remove binding of <source>[/<mask>] from a zone [P] [Z]

Direct Options
  --direct             First option for all direct options
  --get-all-chains
                       Get all chains [P]
  --get-chains {ipv4|ipv6|eb} <table>
                       Get all chains added to the table [P]
  --add-chain {ipv4|ipv6|eb} <table> <chain>
                       Add a new chain to the table [P]
  --remove-chain {ipv4|ipv6|eb} <table> <chain>
                       Remove the chain from the table [P]
  --query-chain {ipv4|ipv6|eb} <table> <chain>
                       Return whether the chain has been added to the table [P]
  --get-all-rules
                       Get all rules [P]
  --get-rules {ipv4|ipv6|eb} <table> <chain>
                       Get all rules added to chain in table [P]
  --add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
                       Add rule to chain in table [P]
  --remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
                       Remove rule with priority from chain in table [P]
  --remove-rules {ipv4|ipv6|eb} <table> <chain>
                       Remove rules from chain in table [P]
  --query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
                       Return whether a rule with priority has been added to
                       chain in table [P]
  --passthrough {ipv4|ipv6|eb} <arg>...
                       Pass a command through (untracked by firewalld)
  --get-all-passthroughs
                       Get all tracked passthrough rules [P]
  --get-passthroughs {ipv4|ipv6|eb} <arg>...
                       Get tracked passthrough rules [P]
  --add-passthrough {ipv4|ipv6|eb} <arg>...
                       Add a new tracked passthrough rule [P]
  --remove-passthrough {ipv4|ipv6|eb} <arg>...
                       Remove a tracked passthrough rule [P]
  --query-passthrough {ipv4|ipv6|eb} <arg>...
                       Return whether the tracked passthrough rule has been
                       added [P]

Lockdown Options
  --lockdown-on        Enable lockdown.
  --lockdown-off       Disable lockdown.
  --query-lockdown     Query whether lockdown is enabled

Lockdown Whitelist Options
  --list-lockdown-whitelist-commands
                       List all command lines that are on the whitelist [P]
  --add-lockdown-whitelist-command=<command>
                       Add the command to the whitelist [P]
  --remove-lockdown-whitelist-command=<command>
                       Remove the command from the whitelist [P]
  --query-lockdown-whitelist-command=<command>
                       Query whether the command is on the whitelist [P]
  --list-lockdown-whitelist-contexts
                       List all contexts that are on the whitelist [P]
  --add-lockdown-whitelist-context=<context>
                       Add the context context to the whitelist [P]
  --remove-lockdown-whitelist-context=<context>
                       Remove the context from the whitelist [P]
  --query-lockdown-whitelist-context=<context>
                       Query whether the context is on the whitelist [P]
  --list-lockdown-whitelist-uids
                       List all user ids that are on the whitelist [P]
  --add-lockdown-whitelist-uid=<uid>
                       Add the user id uid to the whitelist [P]
  --remove-lockdown-whitelist-uid=<uid>
                       Remove the user id uid from the whitelist [P]
  --query-lockdown-whitelist-uid=<uid>
                       Query whether the user id uid is on the whitelist [P]
  --list-lockdown-whitelist-users
                       List all user names that are on the whitelist [P]
  --add-lockdown-whitelist-user=<user>
                       Add the user name user to the whitelist [P]
  --remove-lockdown-whitelist-user=<user>
                       Remove the user name user from the whitelist [P]
  --query-lockdown-whitelist-user=<user>
                       Query whether the user name user is on the whitelist [P]

Panic Options
  --panic-on           Enable panic mode
  --panic-off          Disable panic mode
  --query-panic        Query whether panic mode is enabled
View Code

中文注释

常规选项

General Options     # 常规选项
  -h, --help           Prints a short help text and exists         # 打印帮助信息
  -V, --version        Print the version string of firewalld        # 打印firewalld的版本信息
  -q, --quiet          Do not print status messages             # 不打印状态信息

状态选项

Status Options        # 状态选项
  --state              Return and print firewalld state            # 返回firewalld的状态,running or not running
  --reload             Reload firewall and keep state information      # 重载firewall,保留状态信息
  --complete-reload    Reload firewall and loose state information      # 重载firewall,丢失状态信息
  --runtime-to-permanent
                       Create permanent from runtime configuration         # 通过运行时配置创建永久文件

永久选项

Permanent Options     # 永久选项,永久生效
  --permanent          Set an option permanently        # 设置某个选项永久生效
                       Usable for options maked with [P]     # 标记为[P]的可以使用该选项

zone选项

Zone Options
  --get-default-zone   Print default zone for connections and interfaces            # 打印连接和接口的默认zone
  --set-default-zone=<zone>                                  # 设置默认zone
                       Set default zone
  --get-active-zones   Print currently active zones                    # 打印当前活跃的zones
  --get-zones          Print predefined zones [P]                     # 打印预定义zones(即默认zones)
  --get-services       Print predefined services [P]                   # 打印预定义的服务(即默认services)
  --get-icmptypes      Print predefined icmptypes [P]                   # 打印预定义的icmptypes(即默认icmptypes)
  --get-zone-of-interface=<interface>
                       Print name of the zone the interface is bound to [P]      # 打印接口所绑定的zone
  --get-zone-of-source=<source>[/<mask>]
                       Print name of the zone the source[/mask] is bound to [P]   # 打印源/mask所绑定的zone
  --list-all-zones     List everything added for or enabled in all zones [P]     # 列出所有的zones,包括添加或启用的所有内容
  --new-zone=<zone>    Add a new zone [P only]                       # 增加一个新的zone 
  --delete-zone=<zone> Delete an existing zone [P only]                  # 删除一个已有的zone 
  --zone=<zone>        Use this zone to set or query options, else default zone     # 使用某个zone以设置或查询选项,否则使用默认,public zone
                       Usable for options maked with [Z]                 # 标记为[Z]的可使用该选项
  --get-target         Get the zone target [P] [Z]                     # 获取zone的目标
  --set-target=<target>                                     # 设置zone的目标
                       Set the zone target [P] [Z]      

IcmpType选项

IcmpType Options    # icmptype选项
  --new-icmptype=<icmptype>      # 添加一个新的icmptype类型
                       Add a new icmptype [P only]
  --delete-icmptype=<icmptype>     # 删除一个已有的icmptype类型
                       Delete and existing icmptype [P only]

服务选项

Service Options            # 服务选项
  --new-service=<service>       # 增加一个新的服务
                       Add a new service [P only]
  --delete-service=<service>    # 删除一个已有的服务
                       Delete and existing service [P only]

适应和查询区域的选项

Options to Adapt and Query Zones    # 适应和查询区域的选项
  --list-all           List everything added for or enabled in a zone [P] [Z]      # 列出一个zone里所有添加或者启用的信息
  --list-services      List services added for a zone [P] [Z]                # 列出一个zone里所有添加的服务
  --timeout=<timeval>  Enable an option for timeval time, where timeval is        # 启用时间间隔选项(超时时间),时间间隔是由's'、'm'、'h'跟一个数字  
                       a number followed by one of letters 's' or 'm' or 'h'
                       Usable for options maked with [T]
  --add-service=<service>                                      # 添加一个服务到zone
                       Add a service for a zone [P] [Z] [T]
  --remove-service=<service>                                    # 从zone中移除服务
                       Remove a service from a zone [P] [Z]
  --query-service=<service>                                    # 查询zone 是否添加了某个服务
                       Return whether service has been added for a zone [P] [Z]
  --list-ports         List ports added for a zone [P] [Z]                  # 列出zone添加的所有端口
  --add-port=<portid>[-<portid>]/<protocol>
                       Add the port for a zone [P] [Z] [T]                  # 添加一个端口到zone
  --remove-port=<portid>[-<portid>]/<protocol>
                       Remove the port from a zone [P] [Z]                  # 从zone移除一个端口
  --query-port=<portid>[-<portid>]/<protocol>                          # 查询zone是否添加了某个服务
                       Return whether the port has been added for zone [P] [Z]
  --list-icmp-blocks   List Internet ICMP type blocks added for a zone [P] [Z]      # 列出zone禁用的所有的icmp类型
  --add-icmp-block=<icmptype>                                   # 添加zone禁用的icmp类型
                       Add an ICMP block for a zone [P] [Z] [T]
  --remove-icmp-block=<icmptype>                                  # 移除zone禁用的icmp类型
                       Remove the ICMP block from a zone [P] [Z]
  --query-icmp-block=<icmptype>                                  # 查询zone里某个icmp类型是否被禁用
                       Return whether an ICMP block has been added for a zone
                       [P] [Z]
  --list-forward-ports List IPv4 forward ports added for a zone [P] [Z]          # 列出zone所有ipv4的转发端口
  --add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
                       Add the IPv4 forward port for a zone [P] [Z] [T]          # 为zone添加一个ipv4的转发端口
  --remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
                       Remove the IPv4 forward port from a zone [P] [Z]          # 从zone众删除一个ipv4转发端口


  --query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
                       Return whether the IPv4 forward port has been added for      
                       a zone [P] [Z]                              # 查询某个ipv4端口是否添加到zone中
  --add-masquerade     Enable IPv4 masquerade for a zone [P] [Z] [T]            # 启用zone伪装  
  --remove-masquerade  Disable IPv4 masquerade for a zone [P] [Z]              # 禁用zone伪装 
  --query-masquerade   Return whether IPv4 masquerading has been enabled for a      # 查询zone是否启用伪装 
                       zone [P] [Z]
  --list-rich-rules    List rich language rules added for a zone [P] [Z]          # 列出zone的所有富规则
  --add-rich-rule=<rule>                                      # 添加富规则到zone
                       Add rich language rule 'rule' for a zone [P] [Z] [T]
  --remove-rich-rule=<rule>                                    # 从zone移除一条富规则
                       Remove rich language rule 'rule' from a zone [P] [Z]    
  --query-rich-rule=<rule>                                     # 查询zone里是否存在某富规则
                       Return whether a rich language rule 'rule' has been
                       added for a zone [P] [Z]

处理绑定接口的选项

Options to Handle Bindings of Interfaces    # 处理绑定接口的选项
  --list-interfaces    List interfaces that are bound to a zone [P] [Z]    # 列出绑定到某个zone的所有接口
  --add-interface=<interface>                             # 绑定某个接口到zone
                       Bind the <interface> to a zone [P] [Z]      
  --change-interface=<interface>                            # 改变接口绑定的zone
                       Change zone the <interface> is bound to [Z]
  --query-interface=<interface>                             # 查询某个接口是否绑定到zone
                       Query whether <interface> is bound to a zone [P] [Z]
  --remove-interface=<interface>                            # 从zone移除绑定的接口
                       Remove binding of <interface> from a zone [P] [Z]

处理绑定源的选项

Options to Handle Bindings of Sources  # 处理绑定源的选项
  --list-sources       List sources that are bound to a zone [P] [Z]          # 列出绑定到zone的所有源 
  --add-source=<source>[/<mask>]                                 # 绑定某个源到zone
                       Bind <source>[/<mask>] to a zone [P] [Z]
  --change-source=<source>[/<mask>]                              # 改变源绑定的zone
                       Change zone the <source>[/<mask>] is bound to [Z]  
  --query-source=<source>[/<mask>]                               # 查询某个源是否绑定到zone
                       Query whether <source>[/<mask>] is bound to a zone
                       [P] [Z]
  --remove-source=<source>[/<mask>]                              # 从zone移除某个绑定的源
                       Remove binding of <source>[/<mask>] from a zone [P] [Z]

直接选项direct

Direct Options      # direct选项
  --direct             First option for all direct options              # --direct指定
  --get-all-chains                                      # 获取所有chains
                       Get all chains [P]
  --get-chains {ipv4|ipv6|eb} <table>                           # 获取某个table中所有的chains 
                       Get all chains added to the table [P]
  --add-chain {ipv4|ipv6|eb} <table> <chain>                       # 添加一个新chain到table
                       Add a new chain to the table [P]
  --remove-chain {ipv4|ipv6|eb} <table> <chain>                     # 从table中移除一个chain
                       Remove the chain from the table [P]
  --query-chain {ipv4|ipv6|eb} <table> <chain>                      # 查询table中是否包含chain
                       Return whether the chain has been added to the table [P]
  --get-all-rules                                       # 获取所有的规则 
                       Get all rules [P]
  --get-rules {ipv4|ipv6|eb} <table> <chain>                       # 获取某table某链中的所有规则
                       Get all rules added to chain in table [P]
  --add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...            # 填加rule到某table某chain中
                       Add rule to chain in table [P]
  --remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...          # 从某table某chain中删除规则
                       Remove rule with priority from chain in table [P]
  --remove-rules {ipv4|ipv6|eb} <table> <chain>                      # 删除table中的所有chain
                       Remove rules from chain in table [P]
  --query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...           # 查询某条带优先级的规则是否添加到table:chain中
                       Return whether a rule with priority has been added to
                       chain in table [P]
  --passthrough {ipv4|ipv6|eb} <arg>...
                       Pass a command through (untracked by firewalld)        # 传递命令(不受firewalld跟踪)
  --get-all-passthroughs
                       Get all tracked passthrough rules [P]              # 获取所有跟踪的通过规则
  --get-passthroughs {ipv4|ipv6|eb} <arg>...
                       Get tracked passthrough rules [P]                 # 获取跟踪的通过规则
  --add-passthrough {ipv4|ipv6|eb} <arg>...                         # 增加一条跟踪通过规则
                       Add a new tracked passthrough rule [P]
  --remove-passthrough {ipv4|ipv6|eb} <arg>...                       # 移除一条跟踪通过规则
                       Remove a tracked passthrough rule [P]
  --query-passthrough {ipv4|ipv6|eb} <arg>...                       # 查询跟踪的通过规则是否已添加
                       Return whether the tracked passthrough rule has been
                       added [P]

锁定选项

Lockdown Options    # 锁定选项
  --lockdown-on        Enable lockdown.             # 启用锁定
  --lockdown-off       Disable lockdown.            # 禁用锁定
  --query-lockdown     Query whether lockdown is enabled  # 查询锁定是否启用

锁定白名单选项

Lockdown Whitelist Options                # 锁定白名单选项
  --list-lockdown-whitelist-commands          # 列出白名单里所有的命令行
                       List all command lines that are on the whitelist [P]
  --add-lockdown-whitelist-command=<command>      # 往白名单列表中添加命令
                       Add the command to the whitelist [P]
  --remove-lockdown-whitelist-command=<command>    # 从白名单列表移除命令
                       Remove the command from the whitelist [P]
  --query-lockdown-whitelist-command=<command>    # 查询白名单列表中是否有某命令
                       Query whether the command is on the whitelist [P]
  --list-lockdown-whitelist-contexts          # 列出白名单上的所有上下文
                       List all contexts that are on the whitelist [P]
  --add-lockdown-whitelist-context=<context>     # 将上下文内容添加到白名单
                       Add the context context to the whitelist [P]
  --remove-lockdown-whitelist-context=<context>   # 从白名单中删除上下文
                       Remove the context from the whitelist [P]
  --query-lockdown-whitelist-context=<context>   # 查询上下文是否在白名单上 
                       Query whether the context is on the whitelist [P]
  --list-lockdown-whitelist-uids            # 列出白名单上的所有用户ID
                       List all user ids that are on the whitelist [P]
  --add-lockdown-whitelist-uid=<uid>          # 将用户ID uid添加到白名单
                       Add the user id uid to the whitelist [P]
  --remove-lockdown-whitelist-uid=<uid>        # 从白名单中删除用户ID uid
                       Remove the user id uid from the whitelist [P]
  --query-lockdown-whitelist-uid=<uid>        # 查询用户id uid是否在白名单中
                       Query whether the user id uid is on the whitelist [P]
  --list-lockdown-whitelist-users           # 列出白名单上的所有用户名 
                       List all user names that are on the whitelist [P]
  --add-lockdown-whitelist-user=<user>        # 将用户名user添加到白名单
                       Add the user name user to the whitelist [P]
  --remove-lockdown-whitelist-user=<user>      # 从白名单中删除用户名user
                       Remove the user name user from the whitelist [P]
  --query-lockdown-whitelist-user=<user>       # 查询用户名“ user”是否在白名单中
                       Query whether the user name user is on the whitelist [P]

紧急选项

Panic Options      # 紧急选项
  --panic-on           Enable panic mode              # 启用panic模式
  --panic-off          Disable panic mode             # 禁用panic
  --query-panic        Query whether panic mode is enabled   # 查询panic模式是否启用

 

posted @ 2020-03-20 17:07  starnight_cyber  阅读(...)  评论(...编辑  收藏