Linux防火墙firewall的使用
CentOS 7新的防火墙服务firewalld的基本原理，它有个非常强大的过滤系统，称为 Netfilter，它内置于内核模块中，用于检查穿过系统的每个数据包。
这意味着它可以在到达目的地之前以编程方式检查、修改、拒绝或丢弃任何网络数据包，如传入、传出或转发，从 Centos-7 开始，firewalld 成为管理基于主机的防火墙服务的默认工具，firewalld 的守护进程是从 firewalld 包安装的，它将在操作系统的所有基本安装上可用，但在最小安装上不可用。
使用 FirewallD 优于“iptables”的优点
1.在运行时所做的任何配置更改都不需要重新加载或重新启动 firewalld 服务
2.通过将整个网络流量安排到区域中来简化防火墙管理
3.每个系统可以设置多个防火墙配置以更改网络环境
4.使用 D-Bus 消息系统来交互/维护防火墙设置
在 CentOS 7 或更高版本中，我们仍然可以使用经典的 iptables，如果要使用 iptables，需要停止并禁用 firewalld 服务。同时使用firewalld 和 iptables会使系统混乱，因为它们彼此不兼容。
每个区域都旨在根据指定的标准管理流量。如果没有进行任何修改，默认区域将设置为 public，并且关联的网络接口将附加到 public。
所有预定义的区域规则都存储在两个位置：系统指定的区域规则在“/usr/lib/firewalld/zones/”下，用户指定的区域规则在/etc/firewalld/zones/ 下。如果在系统区域配置文件中进行了任何修改，它将自动到 /etc/firewalld/zones/。
安装firewalld服务
[root@chenby ~]# yum install firewalld -y
[root@chenby ~]# systemctl start firewalld.service
查看服务状态
[root@chenby ~]# firewall-cmd --state
[root@chenby ~]# systemctl status firewalld -l
区域
Firewalld 为不同的目的引入了几个预定义的区域和服务，主要目的之一是更轻松地处理 firewalld 管理。
基于这些区域和服务，我们可以阻止任何形式的系统传入流量，除非它明确允许在区域中使用一些特殊规则。
查看firewalld中的所有可用区域
[root@chenby ~]# firewall-cmd --get-zones
block dmz docker drop external home internal nm-shared public trusted work
[root@chenby ~]#
查看默认区域
[root@chenby ~]# firewall-cmd --get-default-zone
public
[root@chenby ~]#
活动区域和相关网络接口
[root@chenby ~]# firewall-cmd --get-active-zones
docker
interfaces: br-31021b17396b br-53a24802cca1 docker0
public
interfaces: ens18
[root@chenby ~]#
公共区域的规则
[root@chenby ~]# firewall-cmd --list-all --zone="public"
public (active)
target: default
icmp-block-inversion: no
interfaces: ens18
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.250.0/24" accept
[root@chenby ~]#
查看所有可用区域
[root@chenby ~]# firewall-cmd --list-all-zones
block
target: %%REJECT%%
icmp-block-inversion: no
interfaces:
sources:
services:
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
dmz
target: default
icmp-block-inversion: no
interfaces:
sources:
services: ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
docker (active)
target: ACCEPT
icmp-block-inversion: no
interfaces: br-31021b17396b br-53a24802cca1 docker0
sources:
services:
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
drop
target: DROP
icmp-block-inversion: no
interfaces:
sources:
services:
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
external
target: default
icmp-block-inversion: no
interfaces:
sources:
services: ssh
ports:
protocols:
forward: yes
masquerade: yes
forward-ports:
source-ports:
icmp-blocks:
rich rules:
home
target: default
icmp-block-inversion: no
interfaces:
sources:
services: cockpit dhcpv6-client mdns samba-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
internal
target: default
icmp-block-inversion: no
interfaces:
sources:
services: cockpit dhcpv6-client mdns samba-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
nm-shared
target: ACCEPT
icmp-block-inversion: no
interfaces:
sources:
services: dhcp dns ssh
ports:
protocols: icmp ipv6-icmp
forward: no
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule priority="32767" reject
public (active)
target: default
icmp-block-inversion: no
interfaces: ens18
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
rule family="ipv4" source address="192.168.250.0/24" accept
trusted
target: ACCEPT
icmp-block-inversion: no
interfaces:
sources:
services:
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
work
target: default
icmp-block-inversion: no
interfaces:
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
forward: yes
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
[root@chenby ~]#
修改默认的区域
[root@chenby ~]# firewall-cmd --get-default-zone
public
[root@chenby ~]#
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --set-default-zone=work
success
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --get-default-zone
work
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --set-default-zone=public
success
[root@chenby ~]#
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --get-default-zone
public
[root@chenby ~]#
[root@chenby ~]#
网口和区域的操作
给指定网卡设置zone
[root@chenby ~]# firewall-cmd --zone=internal --change-interface=enp1s1
查看系统所有网卡所在的zone
[root@chenby ~]# firewall-cmd --get-active-zones
针对网卡删除zone
[root@chenby ~]# firewall-cmd --zone=internal --remove-interface=enp1s1
自定义 zone
[root@chenby ~]# vi /etc/firewalld/zones/cby.xml
<?xml version="1.0" encoding="utf-8"?>
<zone>
<short>linuxtecksecure</short>
<description>用于企业领域。</description>
<service name="ssh"/>
<port protocol="tcp" port="80"/>
<port protocol="tcp" port="22"/>
</zone>
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --reload
success
[root@chenby ~]#
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --get-zones
block cby dmz docker drop external home internal nm-shared public trusted work
[root@chenby ~]#
[root@chenby ~]#
服务
查看所有可用的服务
[root@chenby ~]# firewall-cmd --get-services
RH-Satellite-6 RH-Satellite-6-capsule afp amanda-client amanda-k5-client amqp amqps apcupsd audit ausweisapp2 bacula bacula-client bareos-director bareos-filedaemon bareos-storage bb bgp bitcoin bitcoin-rpc bitcoin-testnet bitcoin-testnet-rpc bittorrent-lsd ceph ceph-exporter ceph-mon cfengine checkmk-agent cockpit collectd condor-collector cratedb ctdb dds dds-multicast dds-unicast dhcp dhcpv6 dhcpv6-client distcc dns dns-over-tls docker-registry docker-swarm dropbox-lansync elasticsearch etcd-client etcd-server finger foreman foreman-proxy freeipa-4 freeipa-ldap freeipa-ldaps freeipa-replication freeipa-trust ftp galera ganglia-client ganglia-master git gpsd grafana gre high-availability http http3 https ident imap imaps ipfs ipp ipp-client ipsec irc ircs iscsi-target isns jenkins kadmin kdeconnect kerberos kibana klogin kpasswd kprop kshell kube-api kube-apiserver kube-control-plane kube-control-plane-secure kube-controller-manager kube-controller-manager-secure kube-nodeport-services kube-scheduler kube-scheduler-secure kube-worker kubelet kubelet-readonly kubelet-worker ldap ldaps libvirt libvirt-tls lightning-network llmnr llmnr-client llmnr-tcp llmnr-udp managesieve matrix mdns memcache minidlna mongodb mosh mountd mqtt mqtt-tls ms-wbt mssql murmur mysql nbd nebula netbios-ns netdata-dashboard nfs nfs3 nmea-0183 nrpe ntp nut opentelemetry openvpn ovirt-imageio ovirt-storageconsole ovirt-vmconsole plex pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy prometheus prometheus-node-exporter proxy-dhcp ps2link ps3netsrv ptp pulseaudio puppetmaster quassel radius rdp redis redis-sentinel rpc-bind rquotad rsh rsyncd rtsp salt-master samba samba-client samba-dc sane sip sips slp smtp smtp-submission smtps snmp snmptls snmptls-trap snmptrap spideroak-lansync spotify-sync squid ssdp ssh steam-streaming svdrp svn syncthing syncthing-gui syncthing-relay synergy syslog syslog-tls telnet tentacle tftp tile38 tinc tor-socks transmission-client upnp-client vdsm vnc-server warpinator wbem-http wbem-https wireguard ws-discovery ws-discovery-client ws-discovery-tcp ws-discovery-udp wsman wsmans xdmcp xmpp-bosh xmpp-client xmpp-local xmpp-server zabbix-agent zabbix-server zerotier
[root@chenby ~]#
查看特定区域内的所有可用服务
[root@chenby ~]# firewall-cmd --zone=work --list-services
cockpit dhcpv6-client ssh
[root@chenby ~]#
将现有服务添加到默认区域
[root@chenby ~]# firewall-cmd --add-service=samba
success
[root@chenby ~]#
# 验证
[root@chenby ~]# firewall-cmd --zone=public --list-services
cockpit dhcpv6-client samba ssh
[root@chenby ~]#
永久添加服务
[root@chenby ~]# firewall-cmd --permanent --add-service=ftp
success
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --reload
success
[root@chenby ~]#
将运行时设置迁移到永久设置
[root@chenby ~]# firewall-cmd --runtime-to-permanent
success
[root@chenby ~]#
如何在公共区域为samba服务开放端口
[root@chenby ~]# firewall-cmd --permanent --zone=public --add-port=137/udp
success
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --permanent --zone=public --add-port=138/udp
success
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --permanent --zone=public --add-port=139/tcp
success
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --permanent --zone=public --add-port=445/tcp
success
[root@chenby ~]#
[root@chenby ~]# firewall-cmd --list-ports
137/udp 138/udp 139/tcp 445/tcp
[root@chenby ~]#
设置规则生效时间
秒 (s)、分钟 (m) 或小时 (h) 为单位指定超时。
[root@chenby ~]# firewall-cmd --zone=public --add-service=ftp --timeout=5m
