参考文献：
https://access.redhat.com/documentation/zh-cn/red_hat_enterprise_linux/7/html/security_guide/sec-using_firewalls
firewall-cmd --state
firewall-cmd --get-active-zones
firewall-cmd --zone=public --list-all
firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --remove-service=dhcpv6-client --permanent
firewall-cmd --reload
firewall-cmd --add-rich-rule="rule family=‘ipv4‘ source address=‘7.2.1.3‘ port port=‘22‘ protocol=‘tcp‘ drop" --permanent
firewall-cmd --remove-rich-rule=‘rule family=‘ipv4‘ source address=‘7.2.1.3‘ port port=‘22‘ protocol=‘tcp‘ drop‘ --permanent
firewall-cmd --add-rich-rule="rule family=‘ipv4‘ source address=‘192.168.1.1‘ port port=‘22‘ protocol=‘tcp‘ accept" --permanent
firewall-cmd --remove-rich-rule=‘rule family=‘ipv4‘ source address=‘192.168.1.1‘ port port=‘22‘ protocol=‘tcp‘ accept‘ --permanent
firewall-cmd --zone=public --remove-service=dhcpv6-client --permanent
firewall-cmd --zone=public --remove-service=ssh --permanent
firewall-cmd --add-rich-rule="rule family=‘ipv4‘ source address=‘192.168.0.0/16‘ port port=‘22‘ protocol=‘tcp‘ accept" --permanent
firewall-cmd --add-rich-rule="rule family=‘ipv4‘ source address=‘2.9.58.24/29‘ port port=‘22‘ protocol=‘tcp‘ accept" --permanent
firewall-cmd --add-rich-rule="rule family=‘ipv4‘ port port=‘80‘ protocol=‘tcp‘ accept" --permanent
firewall-cmd --add-rich-rule="rule family=‘ipv4‘ port port=‘443‘ protocol=‘tcp‘ accept" --permanent
firewall-cmd --add-rich-rule=‘rule protocol value=icmp drop‘ --permanent
vi /etc/ssh/sshd_config
ListenAddress X.X.X.X
关闭sel
sed -i s#SELINUX=enforcing#SELINUX=disable#g /etc/selinux/config
centos7开机添加静态路由的唯一方法！
vi /etc/sysconfig/network-scripts/route-eth0
192.168.0.0/16 via 172.16.16.200
10.0.0.0/8 via 172.16.16.200
原文地址：https://www.cnblogs.com/itfat/p/9073561.html