Centos7的firewalld配置

紅帽官方的使用文檔:

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Security_Guide/sec-Using_Firewalls.html

常用命令

# 查看版本
[root@osboxes java]# firewall-cmd --version
0.3.9
# 查看狀態
[root@osboxes java]# systemctl status firewalld.service 
OR
[root@osboxes java]# firewall-cmd --state
running
# 獲取啟用的zone
[root@osboxes java]# firewall-cmd --get-active-zones
public
  interfaces: eno16777984

修改網卡的zone

firewall-cmd --permanent --zone=external --change-interface=eth0
firewall-cmd --permanent --zone=internal --change-interface=eth1

查看指定zone中開放的端口和服務

[root@osboxes java]# firewall-cmd --zone=public --list-all
public (default, active)
  interfaces: eno16777984
  sources:
  services: dhcpv6-client mdns ssh
  ports:
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules: 

查看系統中可用的服務

# 列出已配置好可用的服務, 位於 /usr/lib/firewalld/services/ 下
[root@osboxes java]# firewall-cmd --get-services
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https

# 強制列出包含用戶設置在/etc/firewalld/services/, 但尚未loaded的服務
[root@osboxes java]# firewall-cmd --get-services --permanent
amanda-client bacula bacula-client dhcp dhcpv6 dhcpv6-client dns ftp high-availability http https imaps ipp ipp-client ipsec kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s postgresql proxy-dhcp radius rpc-bind samba samba-client smtp ssh telnet tftp tftp-client transmission-client vnc-server wbem-https

對指定的zone添加端口

# 不要忘記 --permanent 
[root@osboxes java]# firewall-cmd --zone=public --add-port=8080/tcp --permanent
# OR 添加一個地址段
[root@osboxes java]# firewall-cmd --zone=public --add-port=5060-5061/udp --permanent
success
# 需要reload后才啟用, 熱加載
[root@osboxes java]# firewall-cmd --reload
# OR 冷加載
[root@osboxes java]# firewall-cmd --complete-reload
success
# 能看到新端口已經添加
[root@osboxes java]# firewall-cmd --zone=public --list-all
public (default, active)
  interfaces: eno16777984
  sources:
  services: dhcpv6-client mdns ssh
  ports: 8080/tcp
  masquerade: no
  forward-ports:
  icmp-blocks:
  rich rules: 
# 刪除一個端口
firewall-cmd --permanent --zone=public --remove-port=8080/tcp
firewall-cmd --permanent --zone=public --remove-port=8080/udp

添加服務(默認端口)

firewall-cmd --zone=public  --add-service=ftp --permanent

添加NAT

首先要加上ip forward

vim /etc/sysctl.conf 
net.ipv4.ip_forward = 1

打開IP偽裝

firewall-cmd --zone=external --add-masquerade --permanent

.內網其他機器, 要把網關配置為當前服務器

#設置網關
route add default  gw 192.168.100.1

#或修改/etc/sysconf/network/network-scripts/ifcfg-網卡名

.

添加端口轉發

首先要打開IP偽裝

firewall-cmd --zone=external --query-masquerade # 檢查是否允許偽裝IP
firewall-cmd --zone=external --add-masquerade # 允許防火牆偽裝IP, 記得加上 --permanent
firewall-cmd --zone=external --remove-masquerade# 禁止防火牆偽裝IP

配置端口轉發, 轉本機端口, 轉他機端口. 未填toaddr則默認本機, 未填toport則使用相同端口

# 將80端口的流量轉發至8080
firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toport=8080
# 將80端口的流量轉發至
firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toaddr=192.168.1.0.1
# 將80端口的流量轉發至192.168.0.1的8080端口
firewall-cmd --zone=external --add-forward-port=port=80:proto=tcp:toaddr=192.168.0.1:toport=8080

.