防火墙管理
文章目录
防火墙管理1、直接关闭防火墙2、firewalld防火墙的基本使用3、防火墙端口管理4、参考资料CentOS7防火墙
CentOS7默认安装了firewalld防火墙
利用防火墙,我们可以允许或是限制传输的数据通过
firewall
1、直接关闭防火墙
systemctl status firewalld (查看防火墙状态)
systemctl stop firewalld (停止防火墙)
systemctl disable firewalld(禁止开机启动)
eg:
[root@liuawen ~]# systemctl status firewalld● firewalld.service - firewalld - dynamic firewall daemonLoaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)Active: active (running) since Sun -05-10 16:04:31 CST; 41min agoDocs: man:firewalld(1)Main PID: 31591 (firewalld)CGroup: /system.slice/firewalld.service└─31591 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopidMay 10 16:04:31 liuawen systemd[1]: Starting firewalld - dynamic firewall daemon...May 10 16:04:31 liuawen systemd[1]: Started firewalld - dynamic firewall daemon.May 10 16:04:32 liuawen firewalld[31591]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP'...chain?).May 10 16:04:32 liuawen firewalld[31591]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP'...chain?).May 10 16:29:05 liuawen firewalld[31591]: WARNING: NOT_ENABLED: 8010-8015:tcpMay 10 16:32:04 liuawen firewalld[31591]: WARNING: NOT_ENABLED: 2181:tcpMay 10 16:37:21 liuawen firewalld[31591]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP'...chain?).May 10 16:37:21 liuawen firewalld[31591]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP'...chain?).Hint: Some lines were ellipsized, use -l to show in full.[root@liuawen ~]# systemctl stop firewalld[root@liuawen ~]# systemctl disable firewalldRemoved symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.[root@liuawen ~]# systemctl is-enabled firewalld.servicedisabled[root@liuawen ~]#
2、firewalld防火墙的基本使用
开启、关闭、重启、禁用、查看防火墙
firewall-cmd --state 查看防火墙的状态state firewall-cmd --state 停止防火墙: systemctl stop firewalld开启防火墙: systemctl start firewalld查看防火墙状态:systemctl status firewalld重新启动防火墙:systemctl restart firewalld开机禁用就是开机不启动防火墙服务 : systemctl disable firewalld开机启用防火墙服务 : systemctl enable firewalld查看防火墙服务是否开机启动:systemctl is-enabled firewalld.service查看版本: firewall-cmd --version显示状态: firewall-cmd --state查看帮助: firewall-cmd --help更新防火墙规则: firewall-cmd --reload查看所有打开的端口: firewall-cmd --zone=public --list-ports
eg:
[root@liuawen ~]# firewall-cmd --reloadsuccess[root@liuawen ~]# firewall-cmd --version0.6.3[root@liuawen ~]# firewall-cmd --state running[root@liuawen ~]# systemctl stop firewalld[root@liuawen ~]# systemctl start firewalld[root@liuawen ~]# systemctl status firewalld● firewalld.service - firewalld - dynamic firewall daemonLoaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)Active: active (running) since Sun -05-10 16:03:38 CST; 45s agoDocs: man:firewalld(1)Main PID: 31323 (firewalld)Tasks: 2Memory: 21.9MCGroup: /system.slice/firewalld.service└─31323 /usr/bin/python2 -Es /usr/sbin/firewalld --nofork --nopidMay 10 16:03:38 liuawen systemd[1]: Starting firewalld - dynamic firewall daemon...May 10 16:03:38 liuawen systemd[1]: Started firewalld - dynamic firewall daemon.May 10 16:03:38 liuawen firewalld[31323]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP'...chain?).May 10 16:03:39 liuawen firewalld[31323]: WARNING: COMMAND_FAILED: '/usr/sbin/iptables -w10 -D FORWARD -i docker0 -o docker0 -j DROP'...chain?).Hint: Some lines were ellipsized, use -l to show in full.[root@liuawen ~]# systemctl restart firewalld[root@liuawen ~]# systemctl disable firewalldRemoved symlink /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service.Removed symlink /etc/systemd/system/multi-user.target.wants/firewalld.service.[root@liuawen ~]# systemctl enable firewalld.serviceCreated symlink from /etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service to /usr/lib/systemd/system/firewalld.service.Created symlink from /etc/systemd/system/multi-user.target.wants/firewalld.service to /usr/lib/systemd/system/firewalld.service.[root@liuawen ~]# systemctl enable firewalld.service[root@liuawen ~]# systemctl is-enabled firewalld.serviceenabled[root@liuawen ~]#
CentOS7 我执行service firewall start
,错误信息[root@liuawen ~]# service firewall start Redirecting to /bin/systemctl start firewall.service Failed to start firewall.service: Unit not found. [root@liuawen ~]# systemctl start firewalld
可以执行systemctl start firewalld
这个。
3、防火墙端口管理
开放删除端口
firewall-cmd --permanent --add-port=2181/tcpfirewall-cmd -reloadfirewall-cmd --permanent --remove-port=2181/tcpfirewall-cmd --permanent --list-ports
–permanent参数是永久生效,没有此参数时,重新启动系统之前的开启或删除端口失效了。
–reload重新加载
firewall-cmd --permanent --add-port=8080-8085/tcp
设置一个范围 ,--remove-port=8080-8085
删除也是一个范围 。
查看开启的端口和服务
firewall-cmd --permanent --list-ports
eg:
[root@liuawen ~]# firewall-cmd --permanent --remove-port=2181/tcpWarning: NOT_ENABLED: 2181:tcpsuccess[root@liuawen ~]# firewall-cmd --permanent --add-port=2181/tcpsuccess[root@liuawen ~]# firewall-cmd --permanent --remove-port=2181/tcpsuccess[root@liuawen ~]# firewall-cmd --permanent --add-port=2181/tcpsuccess[root@liuawen ~]# firewall-cmd --permanent --list-ports 20/tcp 21/tcp 22/tcp 80/tcp 8888/tcp 39000-40000/tcp 888/tcp 3306/tcp 3306/udp 8001/tcp 8001/udp 8002/tcp 8002/udp 8003/tcp 8003/udp 8000/tcp 8000/udp 8080/tcp 2181/udp 2181/tcp[root@liuawen ~]# firewall-cmd --permanent --remove-port=2181/udpsuccess[root@liuawen ~]# firewall-cmd --permanent --remove-port=2181/tcpsuccess[root@liuawen ~]# firewall-cmd --permanent --list-ports 20/tcp 21/tcp 22/tcp 80/tcp 8888/tcp 39000-40000/tcp 888/tcp 3306/tcp 3306/udp 8001/tcp 8001/udp 8002/tcp 8002/udp 8003/tcp 8003/udp 8000/tcp 8000/udp 8080/tcp[root@liuawen ~]# firewall-cmd --reloadsuccess[root@liuawen ~]# firewall-cmd --version0.6.3[root@liuawen ~]# firewall-cmd --staterunning[root@liuawen ~]# firewall-cmd --zone=public --list-ports20/tcp 21/tcp 22/tcp 80/tcp 8888/tcp 39000-40000/tcp 888/tcp 3306/tcp 3306/udp 8001/tcp 8001/udp 8002/tcp 8002/udp 8003/tcp 8003/udp 8000/tcp 8000/udp 8080/tcp[root@liuawen ~]# firewall-cmd --get-active-zones[root@liuawen ~]# firewall-cmd --get-zone-of-interface=eth0no zone[root@liuawen ~]# firewall-cmd --get-zone-of-interface=8080no zone[root@liuawen ~]# firewall-cmd --get-zone-of-8080=eth0usage: see firewall-cmd man pagefirewall-cmd: error: unrecognized arguments: --get-zone-of-8080=eth0[root@liuawen ~]# firewall-cmd --zone= public --query-port=80/tcpusage: see firewall-cmd man pagefirewall-cmd: error: unrecognized arguments: public[root@liuawen ~]# firewall-cmd --zone=public --query-port=80/tcpyes[root@liuawen ~]# firewall-cmd --zone=public --query-port=2181/tcpno[root@liuawen ~]# firewall-cmd --permanent --add-port=2191/tcpsuccess[root@liuawen ~]# firewall-cmd --list-ports 20/tcp 21/tcp 22/tcp 80/tcp 8888/tcp 39000-40000/tcp 888/tcp 3306/tcp 3306/udp 8001/tcp 8001/udp 8002/tcp 8002/udp 8003/tcp 8003/udp 8000/tcp 8000/udp 8080/tcp[root@liuawen ~]#
4、参考资料
1、Docker环境下前后端分离项目部署与运维-防火墙管理