Centos防火墙的配置

Selinux的三种模式：enforcing，passive，disable

临时更改模式：setengorce 1|0        1:enforcing,   0:passive

 [root@Centos7-Server html]#
 [root@Centos7-Server html]# setenforce
 [root@Centos7-Server html]# getenforce
 Permissive

 [root@Centos7-Server html]#
 [root@Centos7-Server html]# setenforce
 [root@Centos7-Server html]# getenforce
 Enforcing
 [root@Centos7-Server html]# 

查询当前seLinux模式：getenforce

 [root@Centos7-Server html]#
 [root@Centos7-Server html]# getenforce
 Enforcing
 [root@Centos7-Server html]#
 [root@Centos7-Server html]# 

selinux 的服务是firewalld。

防火墙的预定义区域：

public：只允许访问本机的某几种服务，如ping，dhcp，ssh等。

block：阻塞所有来访的请求

drop：将所有来访的请求数据包丢弃。

trusted：允许所有的访问请求。

查看默认区域：

 [root@Centos7-Server html]# firewall-cmd --get-default-zone
 public
 [root@Centos7-Server html]# 

修改默认区域：

 [root@Centos7-Server html]#
 [root@Centos7-Server html]# firewall-cmd --set-default-zone=trusted
 success
 [root@Centos7-Server html]# firewall-cmd --get-default-zone
 trusted
 [root@Centos7-Server html]# 

查看区域详细信息：

 [root@Centos7-Server html]#
 [root@Centos7-Server html]# firewall-cmd --zone=public --list-all
 public (active)
   target: default
   icmp-block-inversion: no
   interfaces: ens33
   sources:
   services: ssh dhcpv6-client ftp http
   ports:
   protocols:
   masquerade: no
   forward-ports:
   source-ports:
   icmp-blocks:
   rich rules: 

 [root@Centos7-Server html]# 

向区域中添加服务：

 [root@Centos7-Server html]#
 [root@Centos7-Server html]# firewall-cmd --zone=public --add-service=dns
 success
 [root@Centos7-Server html]# firewall-cmd --zone=public --list-all
 public (active)
   target: default
   icmp-block-inversion: no
   interfaces: ens33
   sources:
   services: ssh dhcpv6-client ftp http dns
   ports:
   protocols:
   masquerade: no
   forward-ports:
   source-ports:
   icmp-blocks:
   rich rules: 

 [root@Centos7-Server html]# 

重新加载防火墙的配置：

 [root@Centos7-Server html]#
 [root@Centos7-Server html]# firewall-cmd --reload
 success
 [root@Centos7-Server html]#
 [root@Centos7-Server html]#
 [root@Centos7-Server html]# 

 [root@Centos7-Server html]#
 [root@Centos7-Server html]# firewall-cmd --zone=public --list-all
 public (active)
   target: default
   icmp-block-inversion: no
   interfaces: ens33
   sources:
   services: ssh dhcpv6-client
   ports:
   protocols:
   masquerade: no
   forward-ports:
   source-ports:
   icmp-blocks:
   rich rules: 

 [root@Centos7-Server html]# 

永久配置防火墙策略：--permanent这个选项的作用是永久配置防火墙，配置后需要重新加载防火墙配置文件才能生效。

 [root@Centos7-Server html]#
 [root@Centos7-Server html]# firewall-cmd --permanent --zone=public --add-service=ftpsuccess
 [root@Centos7-Server html]# firewall-cmd --permanent --zone=public --add-service=http
 success
 [root@Centos7-Server html]#
 [root@Centos7-Server html]#
 [root@Centos7-Server html]#
 [root@Centos7-Server html]#
 [root@Centos7-Server html]# firewall-cmd --zone=public --list-all
 public (active)
   target: default
   icmp-block-inversion: no
   interfaces: ens33
   sources:
   services: ssh dhcpv6-client
   ports:
   protocols:
   masquerade: no
   forward-ports:
   source-ports:
   icmp-blocks:
   rich rules: 

 [root@Centos7-Server html]# firewall-cmd --reload
 success
 [root@Centos7-Server html]# firewall-cmd --zone=public --list-all
 public (active)
   target: default
   icmp-block-inversion: no
   interfaces: ens33
   sources:
   services: ssh dhcpv6-client ftp http
   ports:
   protocols:
   masquerade: no
   forward-ports:
   source-ports:
   icmp-blocks:
   rich rules: 

 [root@Centos7-Server html]# 

端口重定向：

服务器将访问端口转换成另一个端口，如：192。168.0.50:5324 --》192.168.0.50:80通过5324端口访问网页。

 [root@Centos7-Server ~]# firewall-cmd --permanent --zone=public --add-forward-port=port=:proto=tcp:toport=
 success
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]# firewall-cmd --reload
 success
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]# firewall-cmd --zone=public --list-all
 public (active)
   target: default
   icmp-block-inversion: no
   interfaces: ens33
   sources:
   services: ssh dhcpv6-client ftp http
   ports:
   protocols:
   masquerade: no
   forward-ports: port=:proto=tcp:toport=:toaddr=
   source-ports:
   icmp-blocks:
   rich rules: 

 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#
 [root@Centos7-Server ~]#