firewalld默认有9个区域zone
常用4个区域：
public——只能访问ssh、dhcp、ping
trusted——任何都允许访问
block——拒绝任何来访请求
drop——丢弃任何来访数据
firewalld匹配原则
数据包包括源目IP，和数据
1.firewall首先看数据包源IP在哪个zone，就进入那个zone进行处理
2.如果不符合1，就进入默认public
常用命令与参数
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
| 查看默认区域
firewall-cmd --get-default
zone
查看可用区域
firewall-cmd --get-zones
block dmz drop external home internal public trusted work
查看预定义的服务
firewall-cmd --get-service
RH-Satellite-6 RH-Satellite-6-capsule amanda-client amanda-k5-client amqp amqps apcupsd audit bacula bacula-client bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc ceph ceph-mon cfengine condor-collector ctdb dhcp dhcpv6 dhcpv6-client distcc dns docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server finger freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp ganglia-client ganglia-master git gre high-availability http https imap imaps ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kerberos kibana klogin kpasswd kprop kshell ldap ldaps libvirt libvirt-tls lightning-network llmnr managesieve matrix mdns minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nfs nfs3 nmea-0183 nrpe ntp nut openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster quassel radius redis rpc-bind rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptrap spideroak-lansync squid ssh steam-streaming svdrp svn syncthing syncthing-gui synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client upnp-client vdsm vnc-server wbem-http wbem-https wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server
查看版本
firewall-cmd --version
0.6.3
参数添加（永久）
--permanent
查看帮助
firewall-cmd --help
查看伪装IP是否开启
firewall-cmd --query-masquerade
查看已打开的端口
firewall-cmd --list-ports
更新防火墙规则，重载/刷新配置
firewall-cmd --reload
添加一条富规则，自定义规则
firewall-cmd --add-rich-rule=
将源ip指向区域
firewall-cmd --add -source
加入端口
firewall-cmd --add -port
移除端口
firewall-cmd --remove-port=
移除区域
firewall-cmd --remove-source=
加入服务
firewall-cmd --add-server=... --zone=work
示例：
firewall-cmd --add-port=80/tcp
firewall-cmd --add-port=81-90/tcp
firewall-cmd --remove-port=80/tcp
firewall-cmd --zone=block --change-source=0.0.0.0/0
firewall-cmd --set-default-zone=work
firewall-cmd --add-service=http --zone=work --permanent
firewall-cmd --remove-service=http --zone=work --permanent
|
案例
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
| 案例：添加服务与端口
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --reload
firewall-cmd --zone=public --list-services
dhcpv6-client http ssh
firewall-cmd --zone=public --list-ports
80/tcp
案例：拉黑
（富规则）
firewall-cmd --add-rich-rule="rule family=ipv4 source address=192.168.100.100 reject" --permanent
firewall-cmd --reload
firewall-cmd --list-rich-rules
rule family="ipv4" source address="192.168.100.100" reject
firewall-cmd --remove-rich-rule="rule family=ipv4 source address=192.168.100.100 reject" --permanent
firewall-cmd --reload
firewall-cmd --list-rich-rules
案例：使用shell自动拉黑
!
ip=$(netstat -an | grep EST | awk -F '[: ]+' '{print $4}' | sort | uniq -c| awk '$1 >= 50 {print $2}')
for i in $(ip)
do
firewall-cmd --add-rich-rule="rule family=ipv4 source address=$(ip) reject" --permanent
echo "拉黑 $(ip)"
done
案例：端口转发、伪装IP
其实3000端口并没有被开放，这是一种伪装的手段
firewall-cmd --add-masquerade --permanent
firewall-cmd --add-forward-port=port=3000:proto=tcp:toaddr=192.168.10.102:toport=22 --permanent
firewall-cmd --reload
firewall-cmd --list-all | grep forward
forward-ports: port=3000:proto=tcp:toport=22:toaddr=192.168.10.102
测试：成功
ssh root@192.168.10.102 -p 3000
root@192.168.10.102's password:
Last login: Fri Aug 9 20:44:21 2024 from 192.168.10.254
|
