项目6,项目7
可以看到配置的IP地址和网关已经生效（注意一定勾选“自动连接”选项）
按照同样的方法配置另一台设备Client的网络参数：IP地址为192.168.10.20/24，默认网关为192.168.10.254
nmcli connection show --active 显示所有活动的连接状态、
nmcli connection show "ens160" 显示网络连接配置
nmcli connection status 显示设备状态
nmcli connection ens160 显示网络接口属性
nmcli connection add help 查看帮助
nmcli connection reload 重新加载配置
nmcli connection down test2 禁用test2配置，注意，一个网卡可以有多个配置（test2连接要提前创建）
nmcli connection up test2 启用test2的配置
nmcli device disconnect ens160 禁用ens160网卡
nmcli device connect ens160 启用ens160网卡
3、查看/etc/sysconfig/network-scripts/目录
多出一个文件/etc/sysconfig/network-scripts/ifcfg-test2，说明添加确实生效了
再进行查看命令，可以看到原来name为ens32的配置变为了name为test2的配置，配置成功
[root@localhost ~]# nmcli connection modify test2 connection.autoconnect yes
[root@localhost ~]# nmcli connection modify test2 ipv4.dns 192.168.10.1
[root@localhost ~]# nmcli connection modify test2 +ipv4.dns 114.114.114.114
[root@localhost ~]# cat /etc/sysconfig/network-scripts/ifcfg-test2
IPV6_ADDR_GEN_MODE=stable-privacy
UUID=fa900c7b-b491-446a-b461-f61272ecf9cd
[root@localhost ~]# nmcli connection modify test2 -ipv4.dns 114.114.114.114
ot@localhost ~]# nmcli connection modify test2 ipv4.addresses 192.168.10.200/24 gw4 192.168.10.254
[root@localhost ~]# nmcli connection modify test2 +ipv4.addresses 192.168.10.250/24
[root@localhost ~]# nmcli connection show "test2"
connection.uuid: fa900c7b-b491-446a-b461-f61272ecf9cd
connection.type: 802-3-ethernet
connection.interface-name: ens33
connection.autoconnect-priority: 0
connection.autoconnect-retries: -1 (default)
connection.multi-connect: 0（default）
connection.timestamp: 1731905902
connection.autoconnect-slaves: -1（default）
connection.gateway-ping-timeout: 0
802-3-ethernet.auto-negotiate: 否
802-3-ethernet.mac-address: --
802-3-ethernet.cloned-mac-address: --
802-3-ethernet.generate-mac-address-mask:--
802-3-ethernet.mac-address-blacklist: --
802-3-ethernet.s390-subchannels: --
802-3-ethernet.s390-nettype: --
802-3-ethernet.s390-options: --
802-3-ethernet.wake-on-lan: default
802-3-ethernet.wake-on-lan-password: --
ipv4.addresses: 192.168.10.200/24, 192.168.10.250/24
ipv4.dhcp-timeout: 0 (default)
ipv4.dad-timeout: -1 (default)
802-3-ethernet.auto-negotiate: 否
802-3-ethernet.mac-address: --
802-3-ethernet.cloned-mac-address: --
802-3-ethernet.generate-mac-address-mask:--
802-3-ethernet.mac-address-blacklist: --
802-3-ethernet.s390-subchannels: --
802-3-ethernet.s390-nettype: --
802-3-ethernet.s390-options: --
802-3-ethernet.wake-on-lan: default
802-3-ethernet.wake-on-lan-password: --
ipv4.addresses: 192.168.10.200/24, 192.168.10.250/24
ipv4.dhcp-timeout: 0 (default)
ipv4.dad-timeout: -1 (default)
2.查询防火墙生效ens33网卡在firewalld服务中的生效区域
[root@localhost ~]# firewall-cmd --get-active-zones #查看当前防火墙中生效的区域
[root@localhost ~]# firewall-cmd --set-default-zone=trusted #设定默认区域
3.把firewalld服务中ens33网卡的默认区域修改为external，并在系统重启后生效。分别查看当前生效模式与永久模式下的区域名称
[root@localhost ~]# firewall-cmd --list-all --zone=work #查看防火墙策略
[root@localhost ~]# firewall-cmd --permanent --zone=external --change-interface=ens33
[root@localhost ~]# firewall-cmd --get-zone-of-interface=ens33
[root@localhost ~]# firewall-cmd --permanent --get-zone-of-interface=ens33
4.把firewalld服务的当前默认区域设置为public
[root@localhost ~]# firewall-cmd --set-default-zone=public
[root@localhost ~]# firewall-cmd --get-default-zone
5.启动/关闭firewalld服务的应急状况模式，阻断一切网络连接（当远程控制服务器时请慎用）
[root@localhost ~]# firewall-cmd --panic-on #打开
[root@localhost ~]# firewall-cmd --panic-off #关闭
[root@localhost ~]# firewall-cmd --zone=public --query-service=ssh
[root@localhost ~]# firewall-cmd --zone=public --query-service=https
7.把firewalld服务中请求HTTPS的流量设置为永久允许，并立即生效
[root@localhost ~]# firewall-cmd --get-services #查看所有可以设定的服务
RH-Satellite-6 RH-Satellite-6-capsule amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client distcc dns docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server finger freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master git gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kerberos kibana klogin kpasswd kprop kshell ldap ldaps libvirt libvirt-tls lightning-network llmnr managesieve matrix mdns minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster quassel radius redis rpc-bind rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptrap spideroak-lansync squid ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server
[root@localhost ~]# firewall-cmd --zone=public --add-service=https
[root@localhost ~]# firewall-cmd --permanent --zone=public --add-service=https
[root@localhost ~]# firewall-cmd --reload
[root@localhost ~]# firewall-cmd --list-all #查看防火请策略
You're performing an operation over default zone ('public'),
but your connections/interfaces are in zone 'external' (see --get-active-zones)
You most likely need to use --zone=external option.
services: dhcpv6-client https ssh
8.把firewalld服务中请求HTTPS的流量设置为永久拒绝，并立即生效
[root@localhost ~]# firewall-cmd --permanent --zone=public --remove-service=https
[root@localhost ~]# firewall-cmd --reload
[root@localhost ~]# firewall-cmd --list-all #查看防火墙策略
You're performing an operation over default zone ('public'),
but your connections/interfaces are in zone 'external' (see --get-active-zones)
You most likely need to use --zone=external option.
9.把在firewalld服务中访问8088和8089端口的流量策略设置为允许，但仅限当前生效
[root@localhost ~]# firewall-cmd --zone=public --add-port=8088-8089/tcp
浙公网安备 33010602011771号