firewall

【firewall】

1.命令配置

accept 开放

drop  禁止

 

#开放ip

firewall-cmd --zone=public --permanent --add-source=124.6.131.234/24

#关闭ip

firewall-cmd --zone=public --permanent --remove-source=180.178.62.36/24

 

#开放端口

firewall-cmd --zone=public --permanent --add-port=33888/tcp

firewall-cmd --add-port=33888/tcp --permanent

firewall-cmd --permanent --zone=public --add-port=100-500/tcp   （端口范围）

#删除端口，禁止外网访问

firewall-cmd  --zone=public  --permanent --remove-port=8080/tcp

 

#开放指定端口指定ip

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.142.166" port protocol="tcp" port="5432" accept"

firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="124.6.131.234/24" port protocol="tcp" port="0-65535" accept"   单ip 所有端口

#删除指定端口指定ip

firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="10.21.10.220" port protocol="tcp" port="53681" accept"

 

需要重启加载

 

重新加载配置

firewall-cmd --reload

systemctl reload firewalld

 

重启防火墙

systemctl restart firewalld

 

查看一下防火墙现在开启了哪些服务和端口

firewall-cmd --list-all

 

 

2.配置文件配置

配置文件：

cat /etc/firewalld/zones/public.xml

 

<?xml version="1.0" encoding="utf-8"?>

<zone>

  <short>Public</short>

  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>

  <service name="dhcpv6-client"/>

  <source address="180.232.84.51/32"/>         <?开放ip>    

  <port protocol="tcp" port="11223"/>       <?开放端口>

  <service name="ssh"/>

  <rule family="ipv4">                      <?开放对应ip的对应端口>

    <source address="180.232.84.51"/>              

    <port protocol="tcp" port="11223"/>

    <accept/>

  </rule>

  </rule>                               <?该所有端口>

  <rule family="ipv4">

    <source address="154.222.142.85/25"/>

    <port protocol="tcp" port="0-65535"/>

    <accept/>

  </rule>   

 

 

</zone>

 

 

 

A:关闭firewalld

 systemctl stop firewalld

systemctl mask firewalld

B:yum install iptables-services

  systemctl enable iptables.service

systemctl [stop|start|restart] iptables.service

 service iptables [stop|start|restart]

 

 

【防火墙7换6】

 

1、关闭firewall

systemctl stop firewalld.service #停止firewall

systemctl disable firewalld.service #禁止firewall开机启动

2、安装iptables防火墙

yum install iptables-services #安装