centos7设置firewalld

1. 常用命令

• 查看firewalld所有开放规则

# firewall-cmd --list-all        

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: dhcpv6-client http ssh
  ports: 9000/tcp 10250/tcp 10000/tcp
  protocols: 
  masquerade: yes
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
        rule family="ipv4" source address="36.111.180.187" port port="2380" protocol="tcp" accept
        rule family="ipv4" source address="36.111.180.188" port port="2380" protocol="tcp" accept
        rule family="ipv4" source address="10.0.0.2" port port="2380" protocol="tcp" accept
        rule family="ipv4" source address="10.0.0.119" port port="2380" protocol="tcp" accept
        rule family="ipv4" source address="10.0.0.0/24" port port="2379" protocol="tcp" accept
        rule family="ipv4" source address="36.111.180.187/25" port port="2379" protocol="tcp" accept
        rule family="ipv4" source address="10.0.0.0/24" port port="10250" protocol="tcp" accept
        rule family="ipv4" source address="10.0.0.0/24" port port="10256" protocol="tcp" accept
        rule family="ipv4" source address="10.0.0.0/24" port port="4194" protocol="tcp" accept
        rule family="ipv4" source address="10.0.0.0/24" port port="8472" protocol="udp" accept
        rule family="ipv4" source address="10.0.0.0/24" port port="80" protocol="tcp" accept
        rule family="ipv4" source address="10.0.0.0/24" port port="8580" protocol="tcp" accept
        rule family="ipv4" source address="36.111.140.26" port port="18091" protocol="tcp" accept
        rule family="ipv4" source address="36.111.140.26" port port="3306" protocol="tcp" accept
        rule family="ipv4" source address="36.111.140.26" port port="18080" protocol="tcp" accept
        rule family="ipv4" source address="36.111.140.30" port port="18080" protocol="tcp" accept
        rule family="ipv4" source address="36.111.140.30" port port="18091" protocol="tcp" accept

• 查看已经开放的服务，默认开放的服务只有ssh，ipv6，http

# firewall-cmd --list-services  

dhcpv6-client http ssh  

• 查看已经开放的端口

# firewall-cmd --list-port

9000/tcp 10250/tcp 10000/tcp

• 放开/关闭远程主机对本机某个端口的访问

// 开放8080端口（--permanent 永久生效，需要reload）
# firewall-cmd --add-port=8080/tcp --permanent    
# firewall-cmd --reload    


// 关闭8080端口
# firewall-cmd --remove-port=8080/tcp --permanent   

• 开启/关闭某项服务

// 开放http服务
# firewall-cmd --add-service=http --permanent    


// 移除http服务
# firewall-cmd --remove-service=http --permanent   

• 端口（映射）转发

// 将80端口的流量转发到8080
# firewall-cmd --add-forward-port=port=80:proto=tcp:toport=8080 --permanent    


// 将本地的80端口，转发到192.168.217.128机器的8080端口
# firewall-cmd --zone=public--add-forward-port=port=80:proto=tcp:toport=8080:toaddr=192.168.217.128 --permanent    

• 开启关闭firewalld服务

// 关闭firewalld
# systemctl stop firewalld.service  


// 开启firewalld
# systemctl start firewalld.service    


// 查看firewalld状态
# systemctl status firewalld.service    

2. 参考文章

https://www.jianshu.com/p/04e23d24e853