iptables firewalld
yum install iptables-services.x86_64 安装iptables服务
systemctl status iptables.service 查看iptables服务的状态 默认为关闭
systemctl status firewalld 查看firealld状态
systemctl disable firewalld 关闭防火墙的开机自动启动功能
systemctl mask firewalld 冻结防火墙
systemctl start iptables.service 开启iptables服务
[ sytemctl enable iptables 打开iptables服务的开机自动启动功能
systemctl status iptables.service 再次查看iptables服务的状态并确认已经启动
cat /etc/sysconfig/iptables
# sample configuration for iptables service
# you can edit this manually or use system-config-firewall
# please do not ask us to add additional ports/services to this default configuration
*filter
:INPUT ACCEPT [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p icmp -j ACCEPT
-A INPUT -i lo -j ACCEPT
-A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
-A INPUT -j REJECT --reject-with icmp-host-prohibited
-A FORWARD -j REJECT --reject-with icmp-host-prohibited
COMMIT
[[email protected] etc]# iptables -F 刷新
[[email protected] etc]# service iptables save 保存当前策略
iptables: Saving firewall rules to /etc/sysconfig/iptables:[ OK ]
iptables -t filter -nL
iptables -A INPUT -j REJECT 添加默认拒绝命令
iptables -I INPUT 1 -i lo -j ACCEPT 插入允许命令在第一行
iptables -D INPUT 3 删除第三行的命令
iptables -N WESTOS 创建WESTOS
iptables -E WESTOS redhat 将WESTOS 更名为redgat
iptables -X redhat 删除redhat
网络转换 来源为172.25.254.212 to 到 172.25.254.112
iptables -t nat -A POSTROUTING -o eth0 -j SNAT --to-source 172.25.254.212
iptables -t nat -A PREROUTING -i eth0 -j DNAT --to-dest 172.25.254.112firewalld
systemctl stop iptables.service 关闭iptable服务
systemctl disable iptables.service 关闭iptable开机自动启动功能
[[email protected] Desktop]# systemctl mask iptables.service 冻结iptables服务
ln -s '/dev/null' '/etc/systemd/system/iptables.service'
[[email protected] Desktop]# systemctl unmask firewalld 解除冻结firewall
rm '/etc/systemd/system/firewalld.service'
[[email protected] Desktop]# systemctl start firewalld 启动firwall
[[email protected] Desktop]# systemctl enable firewalld 开启开机自动启动功能
ln -s '/usr/lib/systemd/system/firewalld.service' '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'
ln -s '/usr/lib/systemd/system/firewalld.service' '/etc/systemd/system/basic.target.wants/firewalld.service'
firewall-cmd --get-default-zone 查看默认域
firewall-cmd --set-default-zone=trusted 设置默认域为trusted
firewall-cmd --get-default-zone 查看
firewall-cmd --list-all 查看当前信息
firewall-cmd --set-default-zone=block 设置默认域为block
vim /etc/firewalld/zones/public.xml 修改publc配置文件 可通过修改配置文件更改内容
firewall-cmd --reload 重新加载
firewall-cmd --permanent --add-port=8080/tcp --permanent 永久性 添加端口8080 tcp协议
systemctl restart firewalld.service 端口类的添加与删除 必须重启服务
firewall-cmd --permanent --remove-port=8080/tcp 删除8080端口
firewall-cmd --permanent --add-service=ssh 添加ssh服务
firewall-cmd --permanent --remove-service=ssh 删除ssh服务
firewall-cmd --permanent --add-source=172.25.254.12 添加来源172.25.254.12
firewall-cmd --reload
firewall-cmd --permanent --add-source=172.25.254.12 --zone=trusted 永久添加172.25.254.12
firewall-cmd --permanent --remove-interface=eth1 --zone=trusted
firewall-cmd --permanent --add-interface=eth1 --zone=trusted
systemctl restart firewall.service
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 1 -s 172.25.254.12/24 -p tcp --dport 80 -j REJET
firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 ! -s 172.25.254.212 -p tcp --dport 22 -j ACCEPT
firewall-cmd --direct --get-all-rules
ipv4 filter INPUT 0 '!' -s 172.25.254.212 -p tcp --dport 22 -j ACCEPT
伪装
firewall-cmd --permanent --add-masquerade
firewall-cmd --permanent --direct --remove-rule ipv4 filter INPUT 0 ! -s 172.25.254.212 -p tcp --dport 22 -j ACCEPT
firewall-cmd --zone=public --add-forward-port=port=22:proto=tcp:toport=22:toaddr=172.25.254.112