linux的firewalld防火墙规则配置

一、查看firewall规则

[root@localhost ~]# firewall-cmd --list-all

public (active)

  target: default

  icmp-block-inversion: no

  interfaces: enp0s3

  sources:

  services: dhcpv6-client ssh

  ports:

  protocols:

  masquerade: no

  forward-ports:

  sourceports:

  icmp-blocks:

  rich rules:

二、配置允许访问规则

（一）配置文件添加

    具体添加的内容：

[root@localhost zones]#  vim /etc/firewalld/zones/public.xml

<?xml version="1.0" encoding="utf-8"?>

<zone>

  <short>Public</short>

  <description>For use in public areas. You do not trust the other computers on networks to not harm your computer. Only selected incoming connections are accepted.</description>

  <service name="dhcpv6-client"/>

  <service name="http"/>

  <service name="ssh"/>

  <rule family="ipv4">

    <source address="10.10.10.10"/>

    <port protocol="tcp" port="80"/>

    <drop/>

  </rule>

  <rule family="ipv4">

    <source address="10.10.10.11"/>

    <port protocol="tcp" port="22"/>

    <accept/>

  </rule>

</zone>

    编辑文件保存后，要执行firewall-cmd --reload才生效。

（二）命令行添加

1. 开通所有源IP访问http服务

    方法一：

[root@localhost conf]# firewall-cmd --permanent --add-port=80/tcp

[root@localhost conf]# firewall-cmd --reload

    结果：

[root@localhost conf]# firewall-cmd --list-all

public (active)

target: default

icmp-block-inversion: no

interfaces: enp0s3

sources:

services: dhcpv6-client ssh

ports: 80/tcp

protocols:

masquerade: no

forward-ports:

sourceports:

icmp-blocks:

rich rules:

    方法二：

[root@localhost conf]# firewall-cmd --permanent --add-service=http

[root@localhost conf]# firewall-cmd --reload

    结果：

[root@localhost conf]# firewall-cmd --list-all

public (active)

target: default

icmp-block-inversion: no

interfaces: enp0s3

sources:

services: dhcpv6-client http ssh

ports:

protocols:

masquerade: no

forward-ports:

sourceports:

icmp-blocks:

rich rules:

2. 开通访问http服务，并限制源IP访问

firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=10.10.10.10 port port=80 protocol=tcp accept'

[root@localhost ~]# firewall-cmd --reload

    参数说明：

            family 对哪个协议；

            source address 源地址； 

            accept 允许；

            drop 拒绝；

三、配置禁止访问规则

    禁止某个源IP访问：

[root@localhost conf]# firewall-cmd --permanent --add-rich-rule 'rule family=ipv4 source address=10.10.10.10 port port=80 protocol=tcp drop'

[root@localhost conf]# firewall-cmd --reload

    结果：

[root@localhost conf]# firewall-cmd --list-all

public (active)

target: default

icmp-block-inversion: no

interfaces: enp0s3

sources:

services: dhcpv6-client http ssh

ports:

protocols:

masquerade: no

forward-ports:

sourceports:

icmp-blocks:

rich rules:

    rule family="ipv4" source address="10.10.10.10" port port="80" protocol="tcp" drop

四、删除规则

    删除访问规则命令：

firewall-cmd --permanent --remove-rich-rule 'rule family=ipv4 source address=10.10.10.10 port port=80 protocol=tcp accept'

[root@localhost ~]# firewall-cmd --reload

五、备注

    同一规则允许及拒绝时，效果为拒绝，不会跟iptables一样，没有先后顺序优先匹配，为全文匹配，拒绝大于允许。