# firewalld的基本使用
# 启动
systemctl start firewalld
# 关闭
systemctl stop firewalld
# 重启
systemctl restart firewalld
# 查看状态
systemctl status firewalld
# 开机禁用
systemctl disable firewalld
# 开机启用
systemctl enable firewalld
# 查看服务是否开机启动
systemctl is-enabled firewalld
# 查看已启动的服务列表
systemctl list-unit-files|grep enabled
# 查看启动失败的服务列表
systemctl --failed
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
# firewalld-cmd
# 查看版本
firewall-cmd --version
# 查看帮助
firewall-cmd --help
# 显示状态
firewall-cmd --state
# 查看所有打开的端口:
firewall-cmd --zone=public --list-ports
# 更新防火墙规则
firewall-cmd --reload
# 查看区域信息
firewall-cmd --get-active-zones
# 查看指定接口所属区域
firewall-cmd --get-zone-of-interface=eth0
# 拒绝所有包
firewall-cmd --panic-on
# 取消拒绝状态
firewall-cmd --panic-off
# 查看是否拒绝
firewall-cmd --query-panic
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# 开墙
# 添加
firewall-cmd --zone=public --add-port=80/tcp --permanent （--permanent永久生效）
# 重新载入
firewall-cmd --reload
# 查看
firewall-cmd --zone= public --query-port=80/tcp
# 删除
firewall-cmd --zone= public --remove-port=80/tcp --permanent
1
2
3
4
5
6
7
8
2
3
4
5
6
7
8
# 禁ping(icmp)
# 禁止所有源icmp
firewall-cmd --permanent --add-rich-rule='rule protocol value=icmp drop'
# 允许192.168.188.30 ping
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address="192.168.188.30" accept'
# 禁止所有源ping
firewall-cmd --permanent --add-icmp-block-inversion
# 允许192.168.188.30 ping
firewall-cmd --permanent --add-rich-rule='rule family=ipv4 source address="192.168.188.30" icmp-type name="echo-request" accept'
firewall-cmd --list-rich-rules
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16