防火墙firewall

#开放端口
firewall-cmd --zone=public --add-port=22/tcp --permanent
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="192.168.1.76"  accept"
firewall-cmd --permanent --add-rich-rule="rule family="ipv4" source address="10.159.1.7" port protocol="tcp" port="1572" accept"
#删除端口
firewall-cmd --zone=public --remove-port=5432/tcp  --permanent
firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="192.168.1.76"  accept"

firewall-cmd --permanent --remove-rich-rule="rule family="ipv4" source address="10.159.1.7" port protocol="tcp" port="1572" accept"

#端口转发
开启防火墙伪装：firewall-cmd --add-masquerade --permanent#开启后才能转发端口,配置完--reload才生效
firewall-cmd --permanent --add-forward-port=port=81:proto=tcp:toport=80

firewall-cmd --permanent --add-forward-port=port=80:proto=tcp:toaddr=192.168.0.1:toport=8080
#来源ip伪装
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address=10.8.0.0/24 masquerade' #将source为192.168.2.0网段来的数据包伪装成external(即ens33)的地址


firewall-cmd  --reload 
firewall-cmd   --list-all