CentOS7的firewall和安装iptables

前言：CentOS7 的防火墙默认使用是firewall，而我们通常使用iptables；

本文记录了firewall基础的命令和iptables的安装和使用。

firewall部分：

part1 : 服务命令

systemctl start firewalld#启动

systemctl status firewalld #查看运行状态

systemctl stop firewalld.service #停止firewall

systemctl disable firewalld.service #禁用：禁止firewall开机启动

firewall-cmd --state #

firewall-cmd--reload 重启

part2 : 端口命令：

添加

firewall-cmd --zone=public --add-port=80/tcp --permanent   （--permanent永久生效，没有此参数重启后失效）

重新载入

firewall-cmd --reload

查看

firewall-cmd --zone= public --query-port=80/tcp

删除

firewall-cmd --zone= public --remove-port=80/tcp --permanent

part3:示例

示例：firewall端口操作完之后需要重启服务生效

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
2. no
3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3307/tcp --permanent
4. success
5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
6. no
7. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload
8. success
9. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3307/tcp
10. yes

示例：mysql开放远程端口

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --add-port=3306/tcp --permanent
2. success
3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --reload
4. success
5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --state
6. running
7. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#
8. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# firewall-cmd --zone=public --query-port=3306/tcp
9. yes
10. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

iptables部分

part1 : 服务命令

systemctl start iptables #启动

systemctl status iptables #查看运行状态

systemctl restart iptables.service #停止iptables

systemctl stop iptables.service #停止iptables

systemctl disable iptables.service #禁用：禁止iptables开机启动

systemctl enable iptables.service #

part2 : 安装

step1 ： 查看是否安装

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
2. Unit iptables.service could not be found.
3. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

没有相关服务

step2 : yum install

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# yum install iptables-services
2. Loaded plugins: fastestmirror
3. base                                                                                                             | 3.6 kB  00:00:00
4. epel                                                                                                             | 4.3 kB  00:00:00
5. extras                                                                                                           | 3.4 kB  00:00:00
6. mysql-connectors-community                                                                                       | 2.5 kB  00:00:00
7. mysql-tools-community                                                                                            | 2.5 kB  00:00:00
8. mysql56-community                                                                                                | 2.5 kB  00:00:00
9. updates                                                                                                          | 3.4 kB  00:00:00
10. updates/7/x86_64/primary_db                                                                                      | 6.4 MB  00:00:06
11. Loading mirror speeds from cached hostfile
12. * base: mirrors.aliyuncs.com
13. * epel: mirrors.aliyuncs.com
14. * extras: mirrors.aliyuncs.com
15. * updates: mirrors.aliyuncs.com
16. Resolving Dependencies
17. --> Running transaction check
18. ---> Package iptables-services.x86_64 0:1.4.21-17.el7 will be installed
19. --> Finished Dependency Resolution
20. Dependencies Resolved
21. ========================================================================================================================================
22. Package                                Arch                        Version                             Repository                 Size
23. ========================================================================================================================================
24. Installing:
25. iptables-services                      x86_64                      1.4.21-17.el7                       base                       50 k
26. Transaction Summary
27. ========================================================================================================================================
28. Install  1 Package
29. Total download size: 50 k
30. Installed size: 24 k
31. Is this ok [y/d/N]: Y
32. Downloading packages:
33. iptables-services-1.4.21-17.el7.x86_64.rpm                                                                       |  50 kB  00:00:00
34. Running transaction check
35. Running transaction test
36. Transaction test succeeded
37. Running transaction
38. Installing : iptables-services-1.4.21-17.el7.x86_64                                                                               1/1
39. warning: /etc/sysconfig/iptables created as /etc/sysconfig/iptables.rpmnew
40. Verifying  : iptables-services-1.4.21-17.el7.x86_64                                                                               1/1
41. Installed:
42. iptables-services.x86_64 0:1.4.21-17.el7
43. Complete!
44. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

安装成功！

step3 : check

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
2. iptables.service - IPv4 firewall with iptables
3. Loaded: loaded (/usr/lib/systemd/system/iptables.service; disabled; vendor preset: disabled)
4. Active: inactive (dead)
5. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

step4 : start

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl start iptables
2. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl enable iptables.service
3. Created symlink from /etc/systemd/system/basic.target.wants/iptables.service to /usr/lib/systemd/system/iptables.service.
4. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

1. [root@iZ2zeczh9tfpmxmijw5qppZ ~]# systemctl status iptables
2. iptables.service - IPv4 firewall with iptables
3. Loaded: loaded (/usr/lib/systemd/system/iptables.service; enabled; vendor preset: disabled)
4. Active: active (exited) since Wed 2017-06-21 15:44:41 CST; 1min 17s ago
5. Main PID: 506 (code=exited, status=0/SUCCESS)
6. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Starting IPv4 firewall with iptables...
7. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ iptables.init[506]: iptables: Applying firewall rules: [  OK  ]
8. Jun 21 15:44:41 iZ2zeczh9tfpmxmijw5qppZ systemd[1]: Started IPv4 firewall with iptables.
9. [root@iZ2zeczh9tfpmxmijw5qppZ ~]#

step5 : 修改配置文件

vi /etc/sysconfig/iptables

systemctl restart iptables.service #重启防火墙使配置生效

step6 ： 关闭SELINUX

vi/etc/selinux/config

#SELINUX=enforcing #注释掉

#SELINUXTYPE=targeted #注释掉

SELINUX=disabled #增加

:wq! #保存退出

setenforce 0 #使配置立即生效

备注：

SELINUX不关闭时，iptables不读取配置文件，一般采取关闭SELINUX的方式避免这种冲突