• Linux防火墙和firewall-cmd命令应用

    记录：341

    场景：在CentOS 7.9操作系统上，操作防火墙firewalld，主要是查看、开启、关闭以及禁用等。firewall-cmd命令查看防火墙和修改防火墙相关配置。

    版本：

    操作系统：CentOS 7.9

    1.使用systemctl命令操作防火服务

    (1)查看防火墙状态

    查看状态：systemctl status firewalld

    解析：查看防火墙状态，如果是Active: active (running)，则已经开启防火墙。如果是Active: inactive (dead)，则已关闭防火墙。

    (2)开启防火墙

    开启防火墙：systemctl start firewalld

    解析：开启防火墙。

    (3)关闭防火墙

    关闭防火墙：systemctl stop firewalld

    解析：关闭防火墙。

    (4)重启防火墙

    重启防火墙：systemctl restart firewalld

    解析：重启防火墙。

    (5)设置开机启用防火墙

    开机启用防火墙：systemctl enable firewalld

    解析：开机启用防火墙。

    (6)设置开机禁用防火墙

    设置开机禁用防火墙：systemctl disable firewalld

    解析：设置开机禁用防火墙，主机启动时，就会关闭防火墙。

    2.firewall-cmd命令应用

    (1)查看防火墙已放行的端口号列表

    命令：firewall-cmd --zone=public --list-ports

    解析：查看防火墙已放行的端口号列表。

    (2)查看指定端口防火墙放行状态

    命令：firewall-cmd --permanent --query-port="18080"/tcp

    解析：查看端口防火墙已放行。

    (3)把端口18080添加到防火墙开放端口列表

    添加端口：firewall-cmd --zone=public --add-port="18080"/tcp --permanent

    解析：把18080端口持久化配置到开放端口列表中；--permanent，使用永久设置选项。

    (4)重新加载防火墙

    命令：firewall-cmd --reload

    解析：加载防火墙，使最新配置生效。

    (5)查看防火墙状态

    命令：firewall-cmd --state

    解析：查看防火墙状态。

    (6)查看防火墙版本

    命令：firewall-cmd --version

    解析：查看防火墙版本。

    (7)查看防火墙zone

    命令：firewall-cmd --get-default-zone

    解析：打印连接和接口的默认zone，本例打印：public，那么在给--zone添加参数时，可以是：--zone=public。

    3.firewall-cmd命令帮助手册

    命令：firewall-cmd --help

    解析：查看firewall-cmd支持全部命令和选项，在实际工作中，查看这个手册应该是必备之选。

    1. Usage: firewall-cmd [OPTIONS...]
    2.  
    3. General Options
    4.   -h, --help           Prints a short help text and exists
    5.   -V, --version        Print the version string of firewalld
    6.   -q, --quiet          Do not print status messages
    7.  
    8. Status Options
    9.   --state              Return and print firewalld state
    10.   --reload             Reload firewall and keep state information
    11.   --complete-reload    Reload firewall and lose state information
    12.   --runtime-to-permanent
    13.                        Create permanent from runtime configuration
    14.   --check-config       Check permanent configuration for errors
    15.  
    16. Log Denied Options
    17.   --get-log-denied     Print the log denied value
    18.   --set-log-denied=
    19.                        Set log denied value
    20.  
    21. Automatic Helpers Options
    22.   --get-automatic-helpers
    23.                        Print the automatic helpers value
    24.   --set-automatic-helpers=
    25.                        Set automatic helpers value
    26.  
    27. Permanent Options
    28.   --permanent          Set an option permanently
    29.                        Usable for options marked with [P]
    30.  
    31. Zone Options
    32.   --get-default-zone   Print default zone for connections and interfaces
    33.   --set-default-zone=
    34.                        Set default zone
    35.   --get-active-zones   Print currently active zones
    36.   --get-zones          Print predefined zones [P]
    37.   --get-services       Print predefined services [P]
    38.   --get-icmptypes      Print predefined icmptypes [P]
    39.   --get-zone-of-interface=
    40.                        Print name of the zone the interface is bound to [P]
    41.   --get-zone-of-source=<source>[/]||ipset:
    42.                        Print name of the zone the source is bound to [P]
    43.   --list-all-zones     List everything added for or enabled in all zones [P]
    44.   --new-zone=    Add a new zone [P only]
    45.   --new-zone-from-file= [--name=]
    46.                        Add a new zone from file with optional name [P only]
    47.   --delete-zone= Delete an existing zone [P only]
    48.   --load-zone-defaults=
    49.                        Load zone default settings [P only] [Z]
    50.   --zone=        Use this zone to set or query options, else default zone
    51.                        Usable for options marked with [Z]
    52.   --get-target         Get the zone target [P only] [Z]
    53.   --set-target=
    54.                        Set the zone target [P only] [Z]
    55.   --info-zone=   Print information about a zone
    56.   --path-zone=   Print file path of a zone [P only]
    57.  
    58. IPSet Options
    59.   --get-ipset-types    Print the supported ipset types
    60.   --new-ipset= --type=type> [--option=[=]]..
    61.                        Add a new ipset [P only]
    62.   --new-ipset-from-file= [--name=]
    63.                        Add a new ipset from file with optional name [P only]
    64.   --delete-ipset=
    65.                        Delete an existing ipset [P only]
    66.   --load-ipset-defaults=
    67.                        Load ipset default settings [P only]
    68.   --info-ipset= Print information about an ipset
    69.   --path-ipset= Print file path of an ipset [P only]
    70.   --get-ipsets         Print predefined ipsets
    71.   --ipset= --set-description=
    72.                        Set new description to ipset [P only]
    73.   --ipset= --get-description
    74.                        Print description for ipset [P only]
    75.   --ipset= --set-short=
    76.                        Set new short description to ipset [P only]
    77.   --ipset= --get-short
    78.                        Print short description for ipset [P only]
    79.   --ipset= --add-entry=
    80.                        Add a new entry to an ipset [P]
    81.   --ipset= --remove-entry=
    82.                        Remove an entry from an ipset [P]
    83.   --ipset= --query-entry=
    84.                        Return whether ipset has an entry [P]
    85.   --ipset= --get-entries
    86.                        List entries of an ipset [P]
    87.   --ipset= --add-entries-from-file=
    88.                        Add a new entries to an ipset [P]
    89.   --ipset= --remove-entries-from-file=
    90.                        Remove entries from an ipset [P]
    91.  
    92. IcmpType Options
    93.   --new-icmptype=
    94.                        Add a new icmptype [P only]
    95.   --new-icmptype-from-file= [--name=]
    96.                        Add a new icmptype from file with optional name [P only]
    97.   --delete-icmptype=
    98.                        Delete an existing icmptype [P only]
    99.   --load-icmptype-defaults=
    100.                        Load icmptype default settings [P only]
    101.   --info-icmptype=
    102.                        Print information about an icmptype
    103.   --path-icmptype=
    104.                        Print file path of an icmptype [P only]
    105.   --icmptype= --set-description=
    106.                        Set new description to icmptype [P only]
    107.   --icmptype= --get-description
    108.                        Print description for icmptype [P only]
    109.   --icmptype= --set-short=
    110.                        Set new short description to icmptype [P only]
    111.   --icmptype= --get-short
    112.                        Print short description for icmptype [P only]
    113.   --icmptype= --add-destination=
    114.                        Enable destination for ipv in icmptype [P only]
    115.   --icmptype= --remove-destination=
    116.                        Disable destination for ipv in icmptype [P only]
    117.   --icmptype= --query-destination=
    118.                        Return whether destination ipv is enabled in icmptype [P only]
    119.   --icmptype= --get-destinations
    120.                        List destinations in icmptype [P only]
    121.  
    122. Service Options
    123.   --new-service=
    124.                        Add a new service [P only]
    125.   --new-service-from-file= [--name=]
    126.                        Add a new service from file with optional name [P only]
    127.   --delete-service=
    128.                        Delete an existing service [P only]
    129.   --load-service-defaults=
    130.                        Load icmptype default settings [P only]
    131.   --info-service=
    132.                        Print information about a service
    133.   --path-service=
    134.                        Print file path of a service [P only]
    135.   --service= --set-description=
    136.                        Set new description to service [P only]
    137.   --service= --get-description
    138.                        Print description for service [P only]
    139.   --service= --set-short=
    140.                        Set new short description to service [P only]
    141.   --service= --get-short
    142.                        Print short description for service [P only]
    143.   --service= --add-port=[-]/
    144.                        Add a new port to service [P only]
    145.   --service= --remove-port=[-]/
    146.                        Remove a port from service [P only]
    147.   --service= --query-port=[-]/
    148.                        Return whether the port has been added for service [P only]
    149.   --service= --get-ports
    150.                        List ports of service [P only]
    151.   --service= --add-protocol=
    152.                        Add a new protocol to service [P only]
    153.   --service= --remove-protocol=
    154.                        Remove a protocol from service [P only]
    155.   --service= --query-protocol=
    156.                        Return whether the protocol has been added for service [P only]
    157.   --service= --get-protocols
    158.                        List protocols of service [P only]
    159.   --service= --add-source-port=[-]/
    160.                        Add a new source port to service [P only]
    161.   --service= --remove-source-port=[-]/
    162.                        Remove a source port from service [P only]
    163.   --service= --query-source-port=[-]/
    164.                        Return whether the source port has been added for service [P only]
    165.   --service= --get-source-ports
    166.                        List source ports of service [P only]
    167.   --service= --add-module=
    168.                        Add a new module to service [P only]
    169.   --service= --remove-module=
    170.                        Remove a module from service [P only]
    171.   --service= --query-module=
    172.                        Return whether the module has been added for service [P only]
    173.   --service= --get-modules
    174.                        List modules of service [P only]
    175.   --service= --set-destination=:
      [/]
    176.                        Set destination for ipv to address in service [P only]
    177.   --service= --remove-destination=
    178.                        Disable destination for ipv i service [P only]
    179.   --service= --query-destination=:
      [/]
    180.                        Return whether destination ipv is set for service [P only]
    181.   --service= --get-destinations
    182.                        List destinations in service [P only]
    183.  
    184. Options to Adapt and Query Zones
    185.   --list-all           List everything added for or enabled in a zone [P] [Z]
    186.   --list-services      List services added for a zone [P] [Z]
    187.   --timeout=  Enable an option for timeval time, where timeval is
    188.                        a number followed by one of letters 's' or 'm' or 'h'
    189.                        Usable for options marked with [T]
    190.   --set-description=
    191.                        Set new description to zone [P only] [Z]
    192.   --get-description    Print description for zone [P only] [Z]
    193.   --set-short=
    194.                        Set new short description to zone [P only] [Z]
    195.   --get-short          Print short description for zone [P only] [Z]
    196.   --add-service=
    197.                        Add a service for a zone [P] [Z] [T]
    198.   --remove-service=
    199.                        Remove a service from a zone [P] [Z]
    200.   --query-service=
    201.                        Return whether service has been added for a zone [P] [Z]
    202.   --list-ports         List ports added for a zone [P] [Z]
    203.   --add-port=[-]/
    204.                        Add the port for a zone [P] [Z] [T]
    205.   --remove-port=[-]/
    206.                        Remove the port from a zone [P] [Z]
    207.   --query-port=[-]/
    208.                        Return whether the port has been added for zone [P] [Z]
    209.   --list-protocols     List protocols added for a zone [P] [Z]
    210.   --add-protocol=
    211.                        Add the protocol for a zone [P] [Z] [T]
    212.   --remove-protocol=
    213.                        Remove the protocol from a zone [P] [Z]
    214.   --query-protocol=
    215.                        Return whether the protocol has been added for zone [P] [Z]
    216.   --list-source-ports  List source ports added for a zone [P] [Z]
    217.   --add-source-port=[-]/
    218.                        Add the source port for a zone [P] [Z] [T]
    219.   --remove-source-port=[-]/
    220.                        Remove the source port from a zone [P] [Z]
    221.   --query-source-port=[-]/
    222.                        Return whether the source port has been added for zone [P] [Z]
    223.   --list-icmp-blocks   List Internet ICMP type blocks added for a zone [P] [Z]
    224.   --add-icmp-block=
    225.                        Add an ICMP block for a zone [P] [Z] [T]
    226.   --remove-icmp-block=
    227.                        Remove the ICMP block from a zone [P] [Z]
    228.   --query-icmp-block=
    229.                        Return whether an ICMP block has been added for a zone
    230.                        [P] [Z]
    231.   --add-icmp-block-inversion
    232.                        Enable inversion of icmp blocks for a zone [P] [Z]
    233.   --remove-icmp-block-inversion
    234.                        Disable inversion of icmp blocks for a zone [P] [Z]
    235.   --query-icmp-block-inversion
    236.                        Return whether inversion of icmp blocks has been enabled
    237.                        for a zone [P] [Z]
    238.   --list-forward-ports List IPv4 forward ports added for a zone [P] [Z]
    239.   --add-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=
      [/]]
    240.                        Add the IPv4 forward port for a zone [P] [Z] [T]
    241.   --remove-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=
      [/]]
    242.                        Remove the IPv4 forward port from a zone [P] [Z]
    243.   --query-forward-port=port=[-]:proto=[:toport=[-]][:toaddr=
      [/]]
    244.                        Return whether the IPv4 forward port has been added for
    245.                        a zone [P] [Z]
    246.   --add-masquerade     Enable IPv4 masquerade for a zone [P] [Z] [T]
    247.   --remove-masquerade  Disable IPv4 masquerade for a zone [P] [Z]
    248.   --query-masquerade   Return whether IPv4 masquerading has been enabled for a
    249.                        zone [P] [Z]
    250.   --list-rich-rules    List rich language rules added for a zone [P] [Z]
    251.   --add-rich-rule=
    252.                        Add rich language rule 'rule' for a zone [P] [Z] [T]
    253.   --remove-rich-rule=
    254.                        Remove rich language rule 'rule' from a zone [P] [Z]
    255.   --query-rich-rule=
    256.                        Return whether a rich language rule 'rule' has been
    257.                        added for a zone [P] [Z]
    258.  
    259. Options to Handle Bindings of Interfaces
    260.   --list-interfaces    List interfaces that are bound to a zone [P] [Z]
    261.   --add-interface=
    262.                        Bind the  to a zone [P] [Z]
    263.   --change-interface=
    264.                        Change zone the  is bound to [P] [Z]
    265.   --query-interface=
    266.                        Query whether  is bound to a zone [P] [Z]
    267.   --remove-interface=
    268.                        Remove binding of  from a zone [P] [Z]
    269.  
    270. Options to Handle Bindings of Sources
    271.   --list-sources       List sources that are bound to a zone [P] [Z]
    272.   --add-source=<source>[/]||ipset:
    273.                        Bind the source to a zone [P] [Z]
    274.   --change-source=<source>[/]||ipset:
    275.                        Change zone the source is bound to [Z]
    276.   --query-source=<source>[/]||ipset:
    277.                        Query whether the source is bound to a zone [P] [Z]
    278.   --remove-source=<source>[/]||ipset:
    279.                        Remove binding of the source from a zone [P] [Z]
    280.  
    281. Helper Options
    282.   --new-helper= --module= [--family=]
    283.                        Add a new helper [P only]
    284.   --new-helper-from-file= [--name=]
    285.                        Add a new helper from file with optional name [P only]
    286.   --delete-helper=
    287.                        Delete an existing helper [P only]
    288.   --load-helper-defaults=
    289.                        Load helper default settings [P only]
    290.   --info-helper= Print information about an helper
    291.   --path-helper= Print file path of an helper [P only]
    292.   --get-helpers         Print predefined helpers
    293.   --helper= --set-description=
    294.                        Set new description to helper [P only]
    295.   --helper= --get-description
    296.                        Print description for helper [P only]
    297.   --helper= --set-short=
    298.                        Set new short description to helper [P only]
    299.   --helper= --get-short
    300.                        Print short description for helper [P only]
    301.   --helper= --add-port=[-]/
    302.                        Add a new port to helper [P only]
    303.   --helper= --remove-port=[-]/
    304.                        Remove a port from helper [P only]
    305.   --helper= --query-port=[-]/
    306.                        Return whether the port has been added for helper [P only]
    307.   --helper= --get-ports
    308.                        List ports of helper [P only]
    309.   --helper= --set-module=
    310.                        Set module to helper [P only]
    311.   --helper= --get-module
    312.                        Get module from helper [P only]
    313.   --helper= --set-family={ipv4|ipv6|}
    314.                        Set family for helper [P only]
    315.   --helper= --get-family
    316.                        Get module from helper [P only]
    317.  
    318. Direct Options
    319.   --direct             First option for all direct options
    320.   --get-all-chains
    321.                        Get all chains [P]
    322.   --get-chains {ipv4|ipv6|eb} 
    323.                        Get all chains added to the table [P]
    324.   --add-chain {ipv4|ipv6|eb} 
    325.                        Add a new chain to the table [P]
    326.   --remove-chain {ipv4|ipv6|eb} 
      327.  
    327.                        Remove the chain from the table [P]
    328.   --query-chain {ipv4|ipv6|eb} 
      329.  
    329.                        Return whether the chain has been added to the table [P]
    330.   --get-all-rules
    331.                        Get all rules [P]
    332.   --get-rules {ipv4|ipv6|eb} 
      333.  
    333.                        Get all rules added to chain in table [P]
    334.   --add-rule {ipv4|ipv6|eb} 
      335.  
        ...
    335.                        Add rule to chain in table [P]
    336.   --remove-rule {ipv4|ipv6|eb} 
      337.  
        ...
    337.                        Remove rule with priority from chain in table [P]
    338.   --remove-rules {ipv4|ipv6|eb} 
      339.  
    339.                        Remove rules from chain in table [P]
    340.   --query-rule {ipv4|ipv6|eb} 
      341.  
        ...
    341.                        Return whether a rule with priority has been added to
    342.                        chain in table [P]
    343.   --passthrough {ipv4|ipv6|eb} ...
    344.                        Pass a command through (untracked by firewalld)
    345.   --get-all-passthroughs
    346.                        Get all tracked passthrough rules [P]
    347.   --get-passthroughs {ipv4|ipv6|eb} ...
    348.                        Get tracked passthrough rules [P]
    349.   --add-passthrough {ipv4|ipv6|eb} ...
    350.                        Add a new tracked passthrough rule [P]
    351.   --remove-passthrough {ipv4|ipv6|eb} ...
    352.                        Remove a tracked passthrough rule [P]
    353.   --query-passthrough {ipv4|ipv6|eb} ...
    354.                        Return whether the tracked passthrough rule has been
    355.                        added [P]
    356.  
    357. Lockdown Options
    358.   --lockdown-on        Enable lockdown.
    359.   --lockdown-off       Disable lockdown.
    360.   --query-lockdown     Query whether lockdown is enabled
    361.  
    362. Lockdown Whitelist Options
    363.   --list-lockdown-whitelist-commands
    364.                        List all command lines that are on the whitelist [P]
    365.   --add-lockdown-whitelist-command=<command>
    366.                        Add the command to the whitelist [P]
    367.   --remove-lockdown-whitelist-command=<command>
    368.                        Remove the command from the whitelist [P]
    369.   --query-lockdown-whitelist-command=<command>
    370.                        Query whether the command is on the whitelist [P]
    371.   --list-lockdown-whitelist-contexts
    372.                        List all contexts that are on the whitelist [P]
    373.   --add-lockdown-whitelist-context=
    374.                        Add the context context to the whitelist [P]
    375.   --remove-lockdown-whitelist-context=
    376.                        Remove the context from the whitelist [P]
    377.   --query-lockdown-whitelist-context=
    378.                        Query whether the context is on the whitelist [P]
    379.   --list-lockdown-whitelist-uids
    380.                        List all user ids that are on the whitelist [P]
    381.   --add-lockdown-whitelist-uid=
    382.                        Add the user id uid to the whitelist [P]
    383.   --remove-lockdown-whitelist-uid=
    384.                        Remove the user id uid from the whitelist [P]
    385.   --query-lockdown-whitelist-uid=
    386.                        Query whether the user id uid is on the whitelist [P]
    387.   --list-lockdown-whitelist-users
    388.                        List all user names that are on the whitelist [P]
    389.   --add-lockdown-whitelist-user=
    390.                        Add the user name user to the whitelist [P]
    391.   --remove-lockdown-whitelist-user=
    392.                        Remove the user name user from the whitelist [P]
    393.   --query-lockdown-whitelist-user=
    394.                        Query whether the user name user is on the whitelist [P]
    395.  
    396. Panic Options
    397.   --panic-on           Enable panic mode
    398.   --panic-off          Disable panic mode
    399.   --query-panic        Query whether panic mode is enabled
      400.  

      以上，感谢。
       

      2022年11月27日
      
                
                    
                

                
    400. 

                    相关阅读:
      
                    
数据结构题型7-删除结点方式1                            
      
计算机毕业设计（附源码）python智慧门诊综合管理系统                            
      
Raw格式的图片理解、读取、转换、显示、对raw10应用和COLOR_BayerBG2RGB理解                            
      
Dubbo3.0新特性                            
      
C语言经典100例题（50）--#include 的应用练习                            
      
【CSS】笔记1-基础选择器、样式引入                            
      
以沙箱的方式运行容器:安全容器Kata Containers                            
      
Linux常用命令——帮助命令                            
      
为什么我抓不到baidu的数据包                            
      
解决vs code终端无法执行命令的问题                            
      
                          
                
      401. 
                
    401. 
                    原文地址：https://blog.csdn.net/zhangbeizhen18/article/details/128062730
                
      402.