centos7中防火墙的使用
#*#firewall防火墙详解和配置以及iptables防火墙(建议开启此防火墙,适应配置)
2,CentOS 7中防火墙是一个非常的强大的功能,是在CentOS 6.5中在iptables防火墙中进行的升级。
3,firewall配置
1,系统配置目录(目录中存放定义好的网络服务和端口参数,系统参数,不能修改)
/usr/lib/firewalld/services
2,用户配置目录
/etc/firewalld/
3,查询状态,开放端口,启用
查询服务状态 systemctl status firewalld 查看firewall状态 firewall-cmd --state查询哪些端口开放firewall-cmd --list-port 查询端口是否开放(eg:80) firewall-cmd --query-port=80/tcp 开放端口(eg:80)firewall-cmd --zone=public --add-port=80/tcp --permanent移除端口(eg:8080)firewall-cmd --permanent --remove-port=8080/tcp 重启防火墙(修改配置后要重启防火墙)systemctl start firewalld.service #firewall启动systemctl enable firewalld.service #firewall开机启动systemctl restart firewalld.service // firewall-cmd --reload关闭firewall: systemctl stop firewalld.service #停止firewall systemctl disable firewalld.service #禁止firewall开机启动 参数解释 1、firwall-cmd:是Linux提供的操作firewall的一个工具;2,--zone #作用域,Zone的概念,可以将具体的端口制定到具体的zone配置文件中 补:如果–zone=dmz 这样设置的话,会在dmz.xml文件中新增一条3,--add-port=80/tcp #添加端口,格式为:端口/通讯协议4,--permanent :表示设置为持久,永久生效,没有此参数重启后失效
4,通过配置文件添加端口
cd /etc/firewalld/zones vim public.xml
<?xml version="1.0" encoding="utf-8"?> <zone> <short>Public</short> <description>For use in public areas.</description> <rule family="ipv4"> <source address="122.10.70.234"/> <port protocol="udp" port="514"/> <accept/> </rule> <rule family="ipv4"> <source address="123.60.255.14"/> <port protocol="tcp" port="10050-10051"/> <accept/> </rule> <rule family="ipv4"> <source address="192.249.87.114"/> 放通指定ip,指定端口、协议 <port protocol="tcp" port="80"/> <accept/> </rule> <rule family="ipv4"> 放通任意ip访问服务器的9527端口 <port protocol="tcp" port="9527"/> <accept/> </rule> </zone>
------------------------------------------------------------------------------------------------------------------------
4,iptables配置
1,关闭firewall
systemctl stop firewalld.service或者service firewalld stop systemctl disable firewalld.service #禁止firewall开机启动
2,安装iptables
yum install iptables-services #安装
3,编辑配置
vi /etc/sysconfig/iptables #编辑防火墙配置文件Firewall configuration written by system-config-firewallManual customization of this file is not recommended.*filter:INPUT ACCEPT [0:0]:FORWARD ACCEPT [0:0]:OUTPUT ACCEPT [0:0]-A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT-A INPUT -p icmp -j ACCEPT-A INPUT -i lo -j ACCEPT-A INPUT -m state --state NEW -m tcp -p tcp --dport 21 -j ACCEPT#必须开启,否则nginx无法打开-A INPUT -m state --state NEW -m tcp -p tcp --dport 22 -j ACCEPT-A INPUT -m state --state NEW -m tcp -p tcp --dport 80 -j ACCEPT-A INPUT -m state --state NEW -m tcp -p tcp --dport 3306 -j ACCEPT-A INPUT -m state --state NEW -m udp -p udp --dport 8080 -j ACCEPT-A INPUT -j REJECT --reject-with icmp-host-prohibited-A FORWARD -j REJECT --reject-with icmp-host-prohibitedCOMMIT
4,查看,启用
iptables -L#查看规则是否生效systemctl start iptables.service或者service iptables start #开启 systemctl enable iptables.service #设置防火墙开机启动
Game Over !
相关推荐
89284553 2020-07-17
大老张学编程 2020-07-04
lizhengfa 2020-06-26
Aveiox 2020-06-25
85407718 2020-06-10
老谢的自留地 2020-05-29
yshlovelx 2020-05-27
大老张学编程 2020-05-09
summerinsist 2020-04-23
89284553 2020-04-10
yshlovelx 2020-03-27
hickwu 2020-10-23
Wepe0 2020-10-30
Lostinthewoods 2020-10-29
focusforce 2020-10-10
summerinsist 2020-08-21
winki 2020-08-19