1.区域

1）总共8个区域，查看区域的命令：

  1. [root@localhost ~]# firewall-cmd --get-zones
  2. block dmz drop external home internal public trusted work

trusted：白名单区域，方通进出的流量
public：默认拒绝进入方向的流量(ssh，dhcp除外)，放通出方向的流量
dmz：默认拒绝进入方向的流量(ssh)，放通出方向的流量
block：默认拒绝流入的流量

2）查看默认区域，接口默认在此区域

  1. [root@localhost ~]# firewall-cmd --get-default-zone 
  2. public
  4. [root@localhost ~]# firewall-cmd --get-active-zones 
  5. public
  6.   interfaces: eth1 eth0

3）查看当前配置的规则

  1. [root@localhost ~]# firewall-cmd --list-all
  2. public (active)
  3.   target: default
  4.   icmp-block-inversion: no
  5.   interfaces: eth0 eth1
  6.   sources: 
  7.   services: dhcpv6-client ssh
  8.   ports: 
  9.   protocols: 
  10.   masquerade: no
  11.   forward-ports: 
  12.   source-ports: 
  13.   icmp-blocks: 
  14.   rich rules:

4）变更区域

  1. [root@localhost ~]# firewall-cmd --set-default-zone=dmz
  2. success
  4. [root@localhost ~]# firewall-cmd --get-active-zones 
  5. dmz
  6.   interfaces: eth1 eth0

5）指定接口的区域

  1. [root@localhost ~]# firewall-cmd --zone=public --change-interface=eth1 
  2. success
  3. [root@localhost ~]# firewall-cmd --get-active-zones 
  4. dmz
  5.   interfaces: eth0
  6. public
  7.   interfaces: eth1

2.策略

1）指定IP白名单和删除IP白名单

  1. [root@localhost ~]# firewall-cmd --add-source=10.10.10.202/32 --zone=trusted
  3. [root@localhost ~]# firewall-cmd --list-all --zone=trusted 
  4. trusted (active)
  5.   target: ACCEPT
  6.   icmp-block-inversion: no
  7.   interfaces: 
  8.   sources: 10.10.100.202/32
  9.   services: 
  10.   ports: 
  11.   protocols: 
  12.   masquerade: no
  13.   forward-ports: 
  14.   source-ports: 
  15.   icmp-blocks: 
  16.   rich rules:
  18. [root@localhost ~]# firewall-cmd --zone=trusted --remove-source=10.10.100.202/32
  19. success
  20. [root@localhost ~]# firewall-cmd --list-all --zone=trusted 
  21. trusted
  22.   target: ACCEPT
  23.   icmp-block-inversion: no
  24.   interfaces: 
  25.   sources: 
  26.   services: 
  27.   ports: 
  28.   protocols: 
  29.   masquerade: no
  30.   forward-ports: 
  31.   source-ports: 
  32.   icmp-blocks: 
  33.   rich rules:

2）指定IP黑名单和删除IP黑名单

  1. [root@localhost ~]# firewall-cmd --zone=block --add-source=10.10.100.202/32 
  2. success
  4. [root@localhost ~]# firewall-cmd --zone=block --list-all 
  5. block (active)
  6.   target: %%REJECT%%
  7.   icmp-block-inversion: no
  8.   interfaces: 
  9.   sources: 10.10.100.202/32
  10.   services: 
  11.   ports: 
  12.   protocols: 
  13.   masquerade: no
  14.   forward-ports: 
  15.   source-ports: 
  16.   icmp-blocks: 
  17.   rich rules:
  19.  [root@localhost ~]# firewall-cmd --zone=block --remove-source=10.10.100.202/32 
  20. success

3）放通预定义的协议，预定义的协议放在 /usr/lib/firewalld/services/目录下。

  1. [root@localhost ~]# firewall-cmd --zone=dmz --add-service={http,https,mysql}
  2. success
  3. [root@localhost ~]# firewall-cmd --zone=dmz --list-all 
  4. dmz (active)
  5.   target: default
  6.   icmp-block-inversion: no
  7.   interfaces: eth0
  8.   sources: 
  9.   services: http https mysql ssh
  10.   ports: 
  11.   protocols: 
  12.   masquerade: no
  13.   forward-ports: 
  14.   source-ports: 
  15.   icmp-blocks: 
  16.   rich rules:
  19. 删除已放通的策略
  20. [root@localhost ~]# firewall-cmd --zone=dmz --remove-service={http,https,mysql}
  21. success
  23. [root@localhost ~]# firewall-cmd --zone=dmz --list-all 
  24. dmz (active)
  25.   target: default
  26.   icmp-block-inversion: no
  27.   interfaces: eth0
  28.   sources: 
  29.   services: ssh
  30.   ports: 
  31.   protocols: 
  32.   masquerade: no
  33.   forward-ports: 
  34.   source-ports: 
  35.   icmp-blocks: 
  36.   rich rules:

4）放通指定的端口。

  1. [root@localhost ~]# firewall-cmd --zone=dmz --add-port={3306,5432,80,443}/tcp
  2. success
  3. [root@localhost ~]# firewall-cmd --zone=dmz --list-all 
  4. dmz (active)
  5.   target: default
  6.   icmp-block-inversion: no
  7.   interfaces: eth0
  8.   sources: 
  9.   services: ssh
  10.   ports: 3306/tcp 5432/tcp 80/tcp 443/tcp
  11.   protocols: 
  12.   masquerade: no
  13.   forward-ports: 
  14.   source-ports: 
  15.   icmp-blocks: 
  16.   rich rules: 
  18. 删除已放通的端口  
  19. [root@localhost ~]# firewall-cmd --zone=dmz --remove-port=3306/tcp
  20. success
  21. [root@localhost ~]# firewall-cmd --zone=dmz --list-all 
  22. dmz (active)
  23.   target: default
  24.   icmp-block-inversion: no
  25.   interfaces: eth0
  26.   sources: 
  27.   services: ssh
  28.   ports: 5432/tcp 80/tcp 443/tcp
  29.   protocols: 
  30.   masquerade: no
  31.   forward-ports: 
  32.   source-ports: 
  33.   icmp-blocks: 
  34.   rich rules:

3.丰富规则

可以理解为高级的策略，支持源目IP，源目端口，动作

  1. firewall-cmd --zone=dmz --add-rich-rule 'rule family="ipv4" source address="192.168.1.10" port port=22 protocol=tcp reject'
  2. firewall-cmd --zone=dmz --add-rich-rule 'rule family="ipv4" source address="192.168.1.10" port port=22 protocol=tcp accept'