CentOS7、REHL7的firewalld防火墙使用简单说明

title: CentOS7、REHL7的firewalld防火墙使用简单说明
categories: Linux
tags:
- Linux
timezone: Asia/Shanghai
date: 2019-02-25


环境

[[email protected] zones]# cat /etc/centos-release
CentOS Linux release 7.6.1810 (Core)

[[email protected] home]# firewall-cmd -V
0.5.3

基本使用

1.启动和停止

systemctl start firewalld.service       # 启动firewalld服务
systemctl stop firewalld.service        # 停止firewalld服务
systemctl status firewalld.service      # 查看firewalld服务状态

systemctl enable firewalld.service      # 开机自动启动
systemctl disable firewalld.service     # 禁用开机自动启动

2.查看状态

firewall-cmd -V                     # 查看firewalld的版本信息
firewall-cmd --state                # 查看运行状态

firewall-cmd --list-services        # 查看允许访问的服务
firewall-cmd --list-ports           # 查看允许访问的端口
firewall-cmd --list-all             # 查看所有允许的

firewall-cmd --get-default-zone     # 查看默认zone
firewall-cmd --get-active-zones     # 查看当前生效的zone

firewall-cmd --list-all-zones       # 列出所有zone配置

3.开放服务

## 开放和删除端口
firewall-cmd --add-port=80/tcp
firewall-cmd --remove-port=80/tcp

## 批量开放和批量删除端口
firewall-cmd --add-port=100-500/tcp
firewall-cmd --add-port=100-500/udp

## 添加和删除服务
firewall-cmd --add-service=http
firewall-cmd --remove-service=http

## 允许指定IP/IP段访问某端口
firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.62" port protocol="tcp" port="80" accept"
firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.0/24" port protocol="tcp" port="80" accept"

## 允许某IP/IP段的所有访问
firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.62" accept"
firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.0/24" accept"

## 删除富规则
firewall-cmd --remove-rich-rule ‘rule family="ipv4" source address="11.11.11.0/24" accept‘

4.禁止某IP/IP段连接

firewall-cmd --add-rich-rule="rule family="ipv4"  source address="11.11.11.0/24" port port="22" protocol="tcp" drop"
firewall-cmd --add-rich-rule="rule family="ipv4"  source address="11.11.11.0/24" drop"

5.查看当前生效设置和已保存设置

firewall-cmd --list-all             # 查看所有允许的 - 当前已生效设置
firewall-cmd --get-active-zones     # 查看当前生效的zone

cat /etc/firewalld/zones/public.xml # 查看``public``区域的已保存设置

6.保存配置

firewall-cmd --runtime-to-permanent # 保存配置

firewall-cmd --reload               # 重新加载防火墙并保留状态信息
firewall-cmd --complete-reload      # 重新加载防火墙并丢失状态信息

7.使用流程说明

1.首先查看当前防火墙状态是否开放
2.查看当前允许访问的端口和服务
3.查看默认的zone和当前生效的zone(一般使用``public``作为平时使用的zone)
    这里说了是一般情况下都会使用``plulic``作为平时使用的zone
    所以不排除特殊情况或经过自己自定义的zone
    zone的设计本身就是为了切换不同网络的时候不用来回重新配置防火墙而设计的
    比如平时用``public``,但是服务器检修的时候使用``drop``
    或者平时使用``public``,但是这个是我自己笔记本上安装的系统,到单位以后需要切换``work``,所以直接全部指定``plulic``可能会出现异议
    所以这里使用命令的时候都没有像其他教程里一样添加``--zone=public``来指定需要设置的zone,而首先确认当前生效zone后直接设置
4.添加开放端口或服务
5.保存配置
    这里说明下,网上所有的教程里都有加``--permanent``选项以使当前命令直接保存到永久配置
    我这里是采用类似Cisco网络设备的调试方式,先开放或者关闭某端口
    然后确认没问题后,运行``firewall-cmd --runtime-to-permanent``命令保存配置
    如果刚才的命令执行有问题可以直接重新重启防火墙服务、重新加载配置或者重启服务器即可恢复到初始状态
    这样操作手法可以避免因为误操作造成自己都连不上服务器的问题。
    如果经常使用网络设备的小伙伴应该会很容易习惯这种方式
6.关于和``iptables``关系
    ``firewall``和``iptables``都只是Linux系统下的防火墙配置和管理工具
    通过``firewall-cmd``设置防火墙规则后同样支持使用``iptables -L -n``查看具体规则内容
    同时CentOS7和REHL7下同样可以禁用``firewalld``,而使用``iptables``服务来设置和管理防火墙

8.设置服务器只允许某IP/IP段连接服务器SSH

firewall-cmd --add-rich-rule="rule family="ipv4" source address="11.11.11.62" port protocol="tcp" port="22" accept"
firewall-cmd --remove-service=ssh
firewall-cmd --runtime-to-permanent # 保存配置
systemctl restart firewalld.service

常用选项

语法 释义
firewall-cmd -h 打印帮助信息
firewall-cmd -V 查看firewalld的版本信息
 
firewall-cmd --state 返回并打印firewalld状态
firewall-cmd --reload 重新加载防火墙并保留状态信息
firewall-cmd --complete-reload 重新加载防火墙并丢失状态信息
firewall-cmd --runtime-to-permanent 从运行时配置创建永久配置
 
firewall-cmd --panic-on 启用应急模式
firewall-cmd --panic-off 禁用应急模式
firewall-cmd --query-panic 查询是否启用了应急模式
 
firewall-cmd --list-services 查看允许访问的服务
firewall-cmd --list-ports 查看允许访问的端口
firewall-cmd --list-all 查看所有允许的
 
firewall-cmd --add-port=80/tcp 开放TCP的80端口
firewall-cmd --remove-port=80/tcp 删除TCP的80端口

安装图形界面和使用

yum install -y firewall-config
firewall-config

firewall-cmd用法

Usage: firewall-cmd [OPTIONS...]

1.常规选项 - General Options

-h, --help           Prints a short help text and exists      # 打印帮助信息
-V, --version        Print the version string of firewalld    # 查看firewalld的版本信息
-q, --quiet          Do not print status messages             # 不打印状态消息

2.状态选项 - Status Options

--state              Return and print firewalld state             # 返回并打印firewalld状态
--reload             Reload firewall and keep state information   # 重新加载防火墙并保留状态信息
--complete-reload    Reload firewall and lose state information   # 重新加载防火墙并丢失状态信息
--runtime-to-permanent
  Create permanent from runtime configuration                     # 从运行时配置创建永久,保存配置

3.记录拒绝选项 - Log Denied Options

--get-log-denied     Print the log denied value               # 打印拒绝日志
--set-log-denied=<value>   Set log denied value               # 设置日志拒绝值
--get-ipset-types    Print the supported ipset types          # 打印支持的ipset类型

4.永久选择 - Permanent Options

--permanent        Set an option permanently                # 永久设置选项
                   Usable for options marked with [P]       # 可用于标有[P]的选项

5.zone选项 - Zone Options

--get-default-zone   Print default zone for connections and interfaces    # 获取默认zone
--set-default-zone=<zone>               Set default zone                  # 获取默认zone
--get-active-zones   Print currently active zones                         # 获取当前活动zone
--get-zones          Print predefined zones [P]                           # 获取所有预定义zone
--get-services       Print predefined services [P]                        # 获取预定义区域
--get-icmptypes      Print predefined icmptypes [P]                       # 打印预定义的icmp类型
--get-zone-of-interface=<interface>
  Print name of the zone the interface is bound to [P]                    # 获取指定网卡绑定的zone
--get-zone-of-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
  Print name of the zone the source is bound to [P]    #
--list-all-zones
  List everything added for or enabled in all zones [P]                   # 列出在所有zond中添加或启用的所有内容
--new-zone=<zone>    Add a new zone [P only]                              # 添加新zone
--new-zone-from-file=<filename> [--name=<zone>]
  Add a new zone from file with optional name [P only]                    # 从文件创建新zone
--delete-zone=<zone> Delete an existing zone [P only]                     # 删除现有zone
--load-zone-defaults=<zone>
  Load zone default settings [P only] [Z]                                 # 加载zone默认设置
--zone=<zone>        Use this zone to set or query options, else default zone
  Usable for options marked with [Z]
--get-target         Get the zone target [P only] [Z]
--set-target=<target>   Set the zone target [P only] [Z]                  #
--info-zone=<zone>   Print information about a zone                       # 打印指定zone的相关信息
--path-zone=<zone>   Print file path of a zone [P only]                   # 

6.IPSet选项 - IPSet Options

--get-ipset-types    Print the supported ipset types
--new-ipset=<ipset> --type=<ipset type> [--option=<key>[=<value>]]..
                     Add a new ipset [P only]
--new-ipset-from-file=<filename> [--name=<ipset>]
                     Add a new ipset from file with optional name [P only]
--delete-ipset=<ipset>
                     Delete an existing ipset [P only]
--load-ipset-defaults=<ipset>
                     Load ipset default settings [P only]
--info-ipset=<ipset> Print information about an ipset
--path-ipset=<ipset> Print file path of an ipset [P only]
--get-ipsets         Print predefined ipsets
--ipset=<ipset> --set-description=<description>
                     Set new description to ipset [P only]
--ipset=<ipset> --get-description
                     Print description for ipset [P only]
--ipset=<ipset> --set-short=<description>
                     Set new short description to ipset [P only]
--ipset=<ipset> --get-short
                     Print short description for ipset [P only]
--ipset=<ipset> --add-entry=<entry>
                     Add a new entry to an ipset [P]
--ipset=<ipset> --remove-entry=<entry>
                     Remove an entry from an ipset [P]
--ipset=<ipset> --query-entry=<entry>
                     Return whether ipset has an entry [P]
--ipset=<ipset> --get-entries
                     List entries of an ipset [P]
--ipset=<ipset> --add-entries-from-file=<entry>
                     Add a new entries to an ipset [P]
--ipset=<ipset> --remove-entries-from-file=<entry>
                     Remove entries from an ipset [P]

7.IcmpType选项 - IcmpType Options

--new-icmptype=<icmptype>
  Add a new icmptype [P only]                   # 添加新的icmptype [仅限P]
--new-icmptype-from-file=<filename> [--name=<icmptype>]
  Add a new icmptype from file with optional name [P only]      # 从文件中添加一个带有可选名称的新icmptype [仅限P]
--delete-icmptype=<icmptype>
  Delete an existing icmptype [P only]          # 删除现有的icmptype [仅限P]
--load-icmptype-defaults=<icmptype>
  Load icmptype default settings [P only]       # 加载icmptype默认设置[仅限P]
--info-icmptype=<icmptype>
  Print information about an icmptype           # 打印有关icmptype的信息
--path-icmptype=<icmptype>
  Print file path of an icmptype [P only]       # 打印icmptype的文件路径[仅限P]
--icmptype=<icmptype> --set-description=<description>
  Set new description to icmptype [P only]      # 将新描述设置为icmptype [仅限P]
--icmptype=<icmptype> --get-description
  Print description for icmptype [P only]       # icmptype的打印说明[仅限P]
--icmptype=<icmptype> --set-short=<description>
  Set new short description to icmptype [P only]    # 将新的简短描述设置为icmptype [仅限P]
--icmptype=<icmptype> --get-short
  Print short description for icmptype [P only]     # 打印icmptype的简短描述[仅限P]
--icmptype=<icmptype> --add-destination=<ipv>
  Enable destination for ipv in icmptype [P only]   # 在icmptype中启用ipv的目标[仅限P]
--icmptype=<icmptype> --remove-destination=<ipv>
  Disable destination for ipv in icmptype [P only]  # 在icmptype中禁用ipv的目标[仅限P]
--icmptype=<icmptype> --query-destination=<ipv>
  Return whether destination ipv is enabled in icmptype [P only]    # 返回是否在icmptype中启用了目标ipv [仅限P]
--icmptype=<icmptype> --get-destinations
  List destinations in icmptype [P only]            # 在icmptype中列出目的地[仅限P]

8.服务选项 - Service Options

--new-service=<service>
  Add a new service [P only]
--new-service-from-file=<filename> [--name=<service>]
  Add a new service from file with optional name [P only]
--delete-service=<service>
  Delete an existing service [P only]
--load-service-defaults=<service>
  Load icmptype default settings [P only]
--info-service=<service>
  Print information about a service
--path-service=<service>
  Print file path of a service [P only]
--service=<service> --set-description=<description>
  Set new description to service [P only]
--service=<service> --get-description
  Print description for service [P only]
--service=<service> --set-short=<description>
  Set new short description to service [P only]
--service=<service> --get-short
  Print short description for service [P only]
--service=<service> --add-port=<portid>[-<portid>]/<protocol>
  Add a new port to service [P only]
--service=<service> --remove-port=<portid>[-<portid>]/<protocol>
  Remove a port from service [P only]
--service=<service> --query-port=<portid>[-<portid>]/<protocol>
  Return whether the port has been added for service [P only]
--service=<service> --get-ports
  List ports of service [P only]
--service=<service> --add-protocol=<protocol>
  Add a new protocol to service [P only]
--service=<service> --remove-protocol=<protocol>
  Remove a protocol from service [P only]
--service=<service> --query-protocol=<protocol>
  Return whether the protocol has been added for service [P only]
--service=<service> --get-protocols
  List protocols of service [P only]
--service=<service> --add-source-port=<portid>[-<portid>]/<protocol>
  Add a new source port to service [P only]
--service=<service> --remove-source-port=<portid>[-<portid>]/<protocol>
  Remove a source port from service [P only]
--service=<service> --query-source-port=<portid>[-<portid>]/<protocol>
  Return whether the source port has been added for service [P only]
--service=<service> --get-source-ports
  List source ports of service [P only]
--service=<service> --add-module=<module>
  Add a new module to service [P only]
--service=<service> --remove-module=<module>
  Remove a module from service [P only]
--service=<service> --query-module=<module>
  Return whether the module has been added for service [P only]
--service=<service> --get-modules
  List modules of service [P only]
--service=<service> --set-destination=<ipv>:<address>[/<mask>]
  Set destination for ipv to address in service [P only]
--service=<service> --remove-destination=<ipv>
  Disable destination for ipv i service [P only]
--service=<service> --query-destination=<ipv>:<address>[/<mask>]
  Return whether destination ipv is set for service [P only]
--service=<service> --get-destinations
  List destinations in service [P only]

9.Options to Adapt and Query Zones:适应和查询区域的选项

--list-all           List everything added for or enabled in a zone [P] [Z]
--list-services      List services added for a zone [P] [Z]
--timeout=<timeval>
  Enable an option for timeval time, where timeval is a number followed by one of letters ‘s‘ or ‘m‘ or ‘h‘
  Usable for options marked with [T]
--set-description=<description>
  Set new description to zone [P only] [Z]
--get-description    Print description for zone [P only] [Z]
--set-short=<description>
  Set new short description to zone [P only] [Z]
--get-short          Print short description for zone [P only] [Z]
--add-service=<service>
  Add a service for a zone [P] [Z] [T]
--remove-service=<service>
  Remove a service from a zone [P] [Z]
--query-service=<service>
  Return whether service has been added for a zone [P] [Z]
--list-ports         List ports added for a zone [P] [Z]
--add-port=<portid>[-<portid>]/<protocol>
  Add the port for a zone [P] [Z] [T]
--remove-port=<portid>[-<portid>]/<protocol>
  Remove the port from a zone [P] [Z]
--query-port=<portid>[-<portid>]/<protocol>
  Return whether the port has been added for zone [P] [Z]
--list-protocols     List protocols added for a zone [P] [Z]
--add-protocol=<protocol>
  Add the protocol for a zone [P] [Z] [T]
--remove-protocol=<protocol>
  Remove the protocol from a zone [P] [Z]
--query-protocol=<protocol>
  Return whether the protocol has been added for zone [P] [Z]
--list-source-ports  List source ports added for a zone [P] [Z]
--add-source-port=<portid>[-<portid>]/<protocol>
  Add the source port for a zone [P] [Z] [T]
--remove-source-port=<portid>[-<portid>]/<protocol>
  Remove the source port from a zone [P] [Z]
--query-source-port=<portid>[-<portid>]/<protocol>
  Return whether the source port has been added for zone [P] [Z]
--list-icmp-blocks   List Internet ICMP type blocks added for a zone [P] [Z]
--add-icmp-block=<icmptype>
  Add an ICMP block for a zone [P] [Z] [T]
--remove-icmp-block=<icmptype>
  Remove the ICMP block from a zone [P] [Z]
--query-icmp-block=<icmptype>
  Return whether an ICMP block has been added for a zone [P] [Z]
--add-icmp-block-inversion
  Enable inversion of icmp blocks for a zone [P] [Z]
--remove-icmp-block-inversion
  Disable inversion of icmp blocks for a zone [P] [Z]
--query-icmp-block-inversion
  Return whether inversion of icmp blocks has been enabled for a zone [P] [Z]
--list-forward-ports List IPv4 forward ports added for a zone [P] [Z]
--add-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
  Add the IPv4 forward port for a zone [P] [Z] [T]
--remove-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
  Remove the IPv4 forward port from a zone [P] [Z]
--query-forward-port=port=<portid>[-<portid>]:proto=<protocol>[:toport=<portid>[-<portid>]][:toaddr=<address>[/<mask>]]
  Return whether the IPv4 forward port has been added for a zone [P] [Z]
--add-masquerade     Enable IPv4 masquerade for a zone [P] [Z] [T]
--remove-masquerade  Disable IPv4 masquerade for a zone [P] [Z]
--query-masquerade
Return whether IPv4 masquerading has been enabled for a zone [P] [Z]
--list-rich-rules    List rich language rules added for a zone [P] [Z]
--add-rich-rule=<rule>
  Add rich language rule ‘rule‘ for a zone [P] [Z] [T]
--remove-rich-rule=<rule>
  Remove rich language rule ‘rule‘ from a zone [P] [Z]
--query-rich-rule=<rule>
  Return whether a rich language rule ‘rule‘ has been added for a zone [P] [Z]

10.Options to Handle Bindings of Interfaces:处理接口绑定的选项

--list-interfaces
  List interfaces that are bound to a zone [P] [Z]      # 列出绑定到区域的接口[P] [Z]
--add-interface=<interface>
  Bind the <interface> to a zone [P] [Z]            # 将<interface>绑定到区域[P] [Z]
--change-interface=<interface>
  Change zone the <interface> is bound to [Z]       # 更改区域<interface>绑定到[Z]
--query-interface=<interface>
  Query whether <interface> is bound to a zone [P] [Z]  # 查询<interface>是否绑定到区域[P] [Z]
--remove-interface=<interface>
  Remove binding of <interface> from a zone [P] [Z]     # 从区域[P] [Z]中删除<interface>的绑定

11.Options to Handle Bindings of Sources:处理来源绑定的选项

--list-sources       List sources that are bound to a zone [P] [Z]  # 列出绑定到区域的源[P] [Z]
--add-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
  Bind the source to a zone [P] [Z]                     # 将源绑定到区域[P] [Z]
--change-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
  Change zone the source is bound to [Z]                # 更改区域源绑定到[Z]
--query-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
  Query whether the source is bound to a zone [P] [Z]   # 查询源是否绑定到区域[P] [Z]
--remove-source=<source>[/<mask>]|<MAC>|ipset:<ipset>
  Remove binding of the source from a zone [P] [Z]      # 从区域中删除源的绑定[P] [Z]

12.Direct Options

--direct             First option for all direct options        # 所有直接选项的第一选择
--get-all-chains     Get all chains [P]                         # 获取所有链[P]
--get-chains {ipv4|ipv6|eb} <table>
  Get all chains added to the table [P]                         # 将所有链添加到表中[P]
--add-chain {ipv4|ipv6|eb} <table> <chain>
  Add a new chain to the table [P]                              # 在表中添加一个新链[P]
--remove-chain {ipv4|ipv6|eb} <table> <chain>
  Remove the chain from the table [P]                           # 从表中删除链[P]
--query-chain {ipv4|ipv6|eb} <table> <chain>
  Return whether the chain has been added to the table [P]      # 返回是否已将链添加到表中[P]
--get-all-rules
  Get all rules [P]                                             # 获取所有规则[P]
--get-rules {ipv4|ipv6|eb} <table> <chain>
  Get all rules added to chain in table [P]                     # 将所有规则添加到表中的链[P]
--add-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
  Add rule to chain in table [P]                                # 在表[P]中添加规则到链
--remove-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
  Remove rule with priority from chain in table [P]             # 从表[P]中的链中删除具有优先级的规则
--remove-rules {ipv4|ipv6|eb} <table> <chain>
  Remove rules from chain in table [P]                          # 从表[P]中的链中删除规则
--query-rule {ipv4|ipv6|eb} <table> <chain> <priority> <arg>...
  Return whether a rule with priority has been added to chain in table [P]      # 返回是否已将具有优先级的规则添加到表[P]中的链
--passthrough {ipv4|ipv6|eb} <arg>...
  Pass a command through (untracked by firewalld)               # 通过命令(未触发过firewalld)
--get-all-passthroughs
  Get all tracked passthrough rules [P]                         # 获取所有跟踪的直通规则[P]
--get-passthroughs {ipv4|ipv6|eb} <arg>...
  Get tracked passthrough rules [P]                             # 跟踪直通规则[P]
--add-passthrough {ipv4|ipv6|eb} <arg>...
  Add a new tracked passthrough rule [P]                        # 添加新的跟踪直通规则[P]
--remove-passthrough {ipv4|ipv6|eb} <arg>...
  Remove a tracked passthrough rule [P]                         # 删除跟踪的直通规则[P]
--query-passthrough {ipv4|ipv6|eb} <arg>...
  Return whether the tracked passthrough rule has been added [P]    # 返回是否添加了跟踪的直通规则[P]

13.Lockdown Options:锁定选项

--lockdown-on        Enable lockdown.       # 启用锁定。
--lockdown-off       Disable lockdown.      # 禁用锁定
--query-lockdown     Query whether lockdown is enabled      # 查询是否启用了锁定

14.Lockdown Whitelist Options:锁定白名单选项

--list-lockdown-whitelist-commands
  List all command lines that are on the whitelist [P]      # 列出白名单中的所有命令行[P]#
--add-lockdown-whitelist-command=<command>
  Add the command to the whitelist [P]                      # 将命令添加到白名单[P]
--remove-lockdown-whitelist-command=<command>
  Remove the command from the whitelist [P]                 # 从白名单中删除命令[P]
--query-lockdown-whitelist-command=<command>
  Query whether the command is on the whitelist [P]         # 查询命令是否在白名单中[P]
--list-lockdown-whitelist-contexts
  List all contexts that are on the whitelist [P]           # 列出白名单中的所有上下文[P]
--add-lockdown-whitelist-context=<context>
  Add the context context to the whitelist [P]              #  将上下文上下文添加到白名单[P]
--remove-lockdown-whitelist-context=<context>
  Remove the context from the whitelist [P]                 # 从白名单中删除上下文[P]
--query-lockdown-whitelist-context=<context>
  Query whether the context is on the whitelist [P]         #  查询上下文是否在白名单中[P]
--list-lockdown-whitelist-uids
  List all user ids that are on the whitelist [P]           # 列出白名单中的所有用户ID [P]
--add-lockdown-whitelist-uid=<uid>
  Add the user id uid to the whitelist [P]                  # 将用户ID uid添加到白名单[P]
--remove-lockdown-whitelist-uid=<uid>
  Remove the user id uid from the whitelist [P]             # 从白名单中删除用户ID uid [P]
--query-lockdown-whitelist-uid=<uid>
  Query whether the user id uid is on the whitelist [P]     # 查询用户id uid是否在白名单中[P]
--list-lockdown-whitelist-users
  List all user names that are on the whitelist [P]         # 列出白名单中的所有用户名[P]
--add-lockdown-whitelist-user=<user>
  Add the user name user to the whitelist [P]               # 将用户名用户添加到白名单[P]
--remove-lockdown-whitelist-user=<user>
  Remove the user name user from the whitelist [P]          # 从白名单中删除用户名用户[P]
--query-lockdown-whitelist-user=<user>
  Query whether the user name user is on the whitelist [P]  # 从白名单中删除用户名用户[P]

15.应急模式 - Panic Options

--panic-on           Enable panic mode                    # 启用应急模式
--panic-off          Disable panic mode                   # 禁用应急模式
--query-panic        Query whether panic mode is enabled  # 查询是否启用了应急模式

作者:小六的昵称已被使用
链接:https://www.jianshu.com/p/463332787dde

原文地址:https://www.cnblogs.com/linyouyi/p/10740321.html

时间: 2024-10-20 03:48:20

CentOS7、REHL7的firewalld防火墙使用简单说明的相关文章

centos7 firewall-cmd 用活firewalld防火墙中的zone

原文:http://www.excelib.com/article/290/show/ firewalld中zone的含义学生前面已经给大家介绍过了,说白了一个zone就是一套规则集.可是什么时候该用哪个zone.每个zone中的规则具体是怎么设置呢?下面学生就来给大家详细讲解. 名词解释 在具体介绍zone之前学生先给大家介绍几个相关的名词,因为如果不理解这几个名词zone就无从入手. target:目标,这个前面学生也已经给大家介绍过了,可以理解为默认行为,有四个可选值:default.AC

centos7 firewalld防火墙

使用 FirewallD 构建动态防火墙 FirewallD 提供了支持网络/防火墙区域(zone)定义网络链接以及接口安全等级的动态防火墙管理工具.它支持 IPv4, IPv6 防火墙设置以及以太网桥接,并且拥有运行时配置和永久配置选项.它也支持允许服务或者应用程序直接添加防火墙规则的接口. 以前的 system-config-firewall/lokkit 防火墙模型是静态的,每次修改都要求防火墙完全重启.这个过程包括内核 netfilter 防火墙模块的卸载和新配置所需模块的装载等.而模块

linux firewalld 防火墙简单命令

linux firewalld 防火墙简单命令: firewall-cmd --get-default-zone  #查看当前默认区域 firewall-cmd –-set-default-zone=public  #设置public为默认接口区域 systemctl start firewalld  #启动 systemctl status firewalld  #或者firewall-cmd –state 查看状态 sytemctl disable firewalld  #停止并禁用开机启动

centos7 firewall-cmd 理解多区域配置中的 firewalld 防火墙

原文:https://www.linuxidc.com/Linux/2017-11/148795.htm 现在的新闻里充斥着服务器被攻击和数据失窃事件.对于一个阅读过安全公告博客的人来说,通过访问错误配置的服务器,利用最新暴露的安全漏洞或通过窃取的密码来获得系统控制权,并不是件多困难的事情.在一个典型的 Linux 服务器上的任何互联网服务都可能存在漏洞,允许未经授权的系统访问. 因为在应用程序层面上强化系统以防范任何可能的威胁是不可能做到的事情,而防火墙可以通过限制对系统的访问提供了安全保证.

Centos7 firewalld防火墙学习使用记录

1.firewalld防火墙简介. FirewallD 提供了支持网络/防火墙区域(zone)定义网络链接以及接口安全等级的动态防火墙管理工具.它支持 IPv4, IPv6 防火墙设置以及以太网桥接,并且拥有运行时配置和永久配置选项.它也支持允许服务或者应用程序直接添加防火墙规则的接口. 以前的 system-config-firewall/lokkit 防火墙模型是静态的,每次修改都要求防火墙完全重启.这个过程包括内核 netfilter 防火墙模块的卸载和新配置所需模块的装载等.而模块的卸载

firewalld防火墙的配置及应用

            防火墙(centos7)的配置及应用 1:防火墙有基本的三类 iptables.firewalld.ip6tables Systemctl   status   {firewalld,iptables,ip6tables}  查看三类的状态,这里主要介绍firewalld防火墙的配置以及基本应用功能 2:firewalld提供支持区域定义网络连接的防火墙 3:拥有运行时配置和永久性配置(临时和永久性配置) 4:之前是静态,现在是动态,不用重新启动防火墙,不用卸载防火墙的模

第8章 Iptables与Firewalld防火墙

章节简述: 红帽RHEL7系统已经用firewalld服务替代了iptables服务,新的防火墙管理命令firewall-cmd与图形化工具firewall-config. 本章节基于数十个防火墙需求,使用规则策略完整演示对数据包的过滤.SNAT/SDAT技术.端口转发以及负载均衡等实验. 不光光学习iptables命令与firewalld服务,还新增了Tcp_wrappers防火墙服务小节,简单配置即可保证系统与服务的安全. 本章目录结构 [收起] 8.1 了解防火墙管理工具 8.2 Ipta

第7章 Iptables与Firewalld防火墙。

第7章 Iptables与Firewalld防火墙. Chapter7_听较强节奏的音乐能够让您更长时间的投入在学习中. <Linux就该这么学> 00:00/00:00 104:01 204:13 304:12 402:47 502:57 605:39 702:52 803:55 903:59 1003:59 1102:56 1203:44 1303:19 1403:08 章节简述: 红帽RHEL7系统已经用firewalld服务替代了iptables服务,新的防火墙管理命令firewall

centos7 关闭默认firewalld,开启iptables

编者按: 对于使用了centos6系列系统N年的运维来说,在使用centos7的时候难免会遇到各种不适应.比如防火墙问题.本文主要记录怎么关闭默认的firewalld防火墙,重新启用iptables. 1.关闭firewalld防火墙 systemctl stop firewalld systemctl mask firewalld 2.安装iptables yum install iptables-services 3.设置开机启动 systemctl enable iptables.serv