跳至主要内容

CentOS 7 Firewalld防火墙说明

理论部分

  • firewalld 以 zone 的区域分割观念来建立，并以动态设定方式执行避免中断的问题，不能同时执行 iptables 跟 firewalld ，因为会造成冲突错误

配置文件

相关路径

/etc/firewalld    设定档位置
/usr/bin/：firewall-cmd 指令所在的位置
/usr/lib/firewalld/：firewall预设的设定资料（xml格式）
defalut zone在文档中有指定

有关zone

  • public：公开场所，不信任网域内所有连线，只有被允许的连线才能进入，一般只要设定这里就可以
  • external：公开的场所，应该是IP是NAT的网络
  • dmz：非军事区，允许对外连线，内部网络只有允许的才能进来
  • work：公司、工作的环境
  • home：家庭环境
  • internal：内部网路，应用在NAT设定时的对内网络
  • trusted：接受所有的连线
  • drop：任何进入的封包都丢弃，只有出去的是允许的
  • block：任何进入的封包全部拒绝，并以ICMP回复对方，只有对外的连线是允许的
--------------------------------------
预设主机是被放在public zone区域，并有开启两个服务dhcpv6-client ssh
在这样的预设下，任何来源都可以通过ssh服务连接到本机，但其他服务的service port都关闭

一些操作

显示目前的设定

# firewall-cmd --list-all

关闭DHCP服务

# sudo firewall-cmd --zone=public --remove-service dhcpv6-client

暂时开启DNS port 53

# sudo systemctl start named
# sudo systemctl enable named
# sudo firewall-cmd --add-service=dns
# sudo firewall-cmd --reload
# firewall-cmd --list-all

永久开启DNS port 53 

# sudo firewall-cmd --add-service=dns --permanent
# sudo firewall-cmd --reload

如何修改主机的预设zone 

前面说预设是public zone,但有些服务需要建立在DMZ下，我们可以透过修改 /etc/firewalld/firewalld.conf来将预设的zone改为DNZ
 # sudo vi /etc/firewalld/firewalld.conf    修改DefaultZone=dmz
 # sudo firewall-cmd --reload

加入自行指定的连接埠 

 # sudo firewall-cmd --add-port=8080/tcp --permanent
 # sudo firewall-cmd --reload
 # sudo firewall-cmd --list-all

设定暂时的rules

 # sudo firewall-cmd --add-port=8888/tcp
 # sudo firewall-cmd --list-all
 当你下一次执行reload时候，设定会被取消

修改服务的预设连接埠

 # sudo cp /usr/lib/firewalld/services/http.xml /etc/firewalld/services    以Web为例
 # sudo vi /etc/firewalld/services/http.xml
 修改对应连接埠 port protocol="tcp" port="8080"
 # sudo firewall-cmd --reload

限制某服务只能从哪些IP进入

 # sudo firewall-cmd --add-rich-rule="rule family="ipv4" source
    address="192.168.12.9" port port="8080" protocol="tcp" accept"

直接指定rule到INPUT chain

 # sudo firewall-cmd --permanent --direct --add-rule ipv4 filter INPUT 0 -p tcp -s "192.168.12.9" --dport 22 -j ACCEPT
 这样的写法使用 # firewall-cmd --list-all是看不到的，要用 iptables -L -n

查看预设载入的rule 

所有的zone设定档会放在 /etc/firewalld/zones和 /usr/lib/firewalld/zones/ ,你所执行的--permanent参数会放在 /etc/firewalld/zones 对应的zone档案里（如：public.xml）

从 /etc/sysconfig/iptables 转为 firewalld 的 direct 

 假设原有的 /etc/sysconfig/iptables 有规则
 -A INPUT -s 140.113.12.9 -j ACCEPT
 -A INPUT -m state --state NEW -m udp -p udp -s 140.113.0.0/16 --dport 123 -j    
  ACCEPT
 -A INPUT -m state --state NEW -m tcp -p tcp -s 140.114.88.0/24 --dport 161 -j ACCEPT
 要转换到 firewalld 的 direct 规则：
 新增 /etc/firewalld/direct.xml ,如果之前有执行过 # sudo firewall-cmd --permanent --direct ...则这个档案会自动生成

新增/修改 direct.xml 增加对应上面的 rules：
 # sudo vi /etc/firewalld/direct.xml
 <?xml version="1.0" encoding="utf-8"?>
<direct>
   <rule priority="0" table="filter" ipv="ipv4" chain="INPUT">-p tcp -s 192.168.12.9 --dport 22 -j ACCEPT</rule>
   <rule priority="0" table="filter" ipv="ipv4" chain="INPUT">-s 140.113.12.9 -j ACCEPT</rule>
   <rule priority="0" table="filter" ipv="ipv4" chain="INPUT">-p udp -s 140.113.0.0/16 --dport 123 -j ACCEPT</rule>
   <rule priority="0" table="filter" ipv="ipv4" chain="INPUT">-p tcp -s 140.114.88.0/24 --dport 161 -j ACCEPT</rule>
</direct> 

从zone移除某项服务 

 # sudo firewall-cmd --zone=public --add-service=http --permanent
 # sudo firewall-cmd --zone=public --remove-service=http --permanent

 # sudo firewall-cmd --zone=public --add-port=8080/tcp --permanent
 # sudo firewall-cmd --zone=public --remove-port=8080/tcp --permanent

port forward 将从某个port number的封包转送给另外的port或其他主机

 将 80 port 收到的讯息转往 port 8080
 # sudo firewall-cmd --zone="public" --add-forward-port=port=80:proto=tcp:toport=8080

 将 80 port 收到的讯息转往其他主机的 
 # sudo fierwall-cmd --zone="public" -add-forward-port=port=80:proto=tcp:toport=8080:to addr=140.113.1.1
  




参考：

标签：

Popular posts from 产品随想的博客

Interview at the All Things Digital D5 Conference, Steve and Bill Gates spoke with journalists Kara Swisher and Walt Mossberg onstage in May 2007.

Kara Swisher: The first question I was interested in asking is what you think each has contributed to the computer and technology industry— starting with you, Steve, for Bill, and vice versa. Steve Jobs: Well, Bill built the first software company in the industry. And I think he built the first software company before anybody really in our industry knew what a software company was, except for these guys. And that was huge. That was really huge. And the business model that they ended up pursuing turned out to be the one that worked really well for the industry. I think the biggest thing was, Bill was really focused on software before almost anybody else had a clue that it was really the software that— KS: Was important? SJ: That’s what I see. I mean, a lot of other things you could say, but that’s the high-order bit. And I think building a company’s really hard, and it requires your greatest persuasive abilities to hire the best ...
阅读全文

Foobar2000 组件安装教程

 原作者 博客地址   汉化作者 Asion博客   关于foobar 2000的一些资源 前言 foobar2000 由于其软件架构特点以及开放的姿态，使得第三方很容易开发组件（component）来拓展它的功能。由于在官网下载的默认安装文件只带了少量几个默认的组件，满足不了使用的需求，例如：默认不带 ape，tta，tak 等音频文件格式的解码器，很多无损压缩格式音乐没法播放。所以自己下载安装组件是必备的基本技能。 foobar2000 的中文汉化版（Asion 汉化）为了方便使用，集成了无损压缩文件解码器以及一些其它有用的插件，安装时选上即可，不喜欢折腾的建议使用汉化版。 这里组件指的是 foobar2000 标准组件（*.dll 文件），而非 vst 插件等其它插件，姑且把组件分为两类： 官方组件： 英文版安装包自带，安装时可选择； 第三方组件：非官方自带的组件 除了 foo_input_std.dll 和 foo_ui_std.dll 这两个组件是必须的外，其它的所有组件都 非必需 的，可以随需要增删。第三方组件可以去 官网 、 官方论坛 或者 官方 wiki 去找，也可以去贴吧等地逛逛。 下载 还是要强调一下，这里说的是 foobar2000 component ，不是中文网上通常说的 vst 插件。 下载好的组件包一般是 xxx.zip 或 xxx.fb2k-component 格式的文件，也有用 7z 打包的。前两种都是 zip 压缩（只要把 fb2k-component 改成 zip 文件就变成了 zip： 包）。标准状况下压缩包里的内容结构应该是 xxx.zip yyy.dll README.txt (可能没有) LICENCE.txt (可能没有) (其它杂七杂八） 除少数外一般只有一个 xxx.dll 文件.一定要注意压缩包结构不能是: xxx.zip yy folder (文件夹） zzz.dll … 否则要解压缩，提取那个 dll 文件。 安装 方法一（推荐） 打开 foobar2000 的菜单 文件 > 首选项(file >preferences) 的 组件(components...
阅读全文

产品随想 | 周刊 第69期：Do not go gentle into that good night

Products Windows Apps That Amaze Us   https://amazing-apps.gitbook.io/windows-apps-that-amaze-us/ 令人精细的Windows App 文物出版社   https://book.douban.com/press/2456/ 这是一个宝藏出版社，出品书籍质量非常高，大开眼界 blind   https://www.teamblind.com/ 老外的匿名职场社交工具，挺有意思，看看硅谷的meme 中国科学技术大学测速网站   https://test.ustc.edu.cn/ 看着还不错，挺靠谱的 底层代码是LibreSpeed   https://github.com/librespeed/speedtest 能不能好好说话？   https://github.com/itorr/nbnhhsh 也是我的一个痛点 Tree Style Tab (aka TST)   https://github.com/piroor/treestyletab 一个超强的浏览器扩展插件，树状呈现浏览器标签 Failory Pitch Decks   https://www.failory.com/pitch-deck 超级多的融资计划投资板，Pitch Book AutoCut   https://github.com/mli/autocut 用文本编辑器剪视频 全网漫游指南   https://tagly.notion.site/tagly/a333efd8c3e54e12b123acd541e8d3e6 数字时代的指引，希望他们成功 IT eBooks   https://it-ebooks.info/ IT书籍下载 ToastFish   https://github.com/Uahh/ToastFish 一个利用摸鱼时间背单词的软件。 利用Win10通知栏，出现、背单词 Ideas 沈向洋：IDEA 如何找到创新的「甜区」   https://mp.weixin.qq.com/s/OlI5VUxQKU_ijWZClQCG0Q AIGC How Did Nor...
阅读全文

UNstudio实习经验分享

再过一周，我就将离开UNstudio阿姆斯特丹总部，到其上海分部了，鉴于上海分部目前还不承担设计任务，因此可以视为我UNstudio参与设计的体验即将告一段落。这个实习，原定3个月，后来被要求延长到了6个月，后来又延长到9个月，现在看来最终大概有11个月——那天一问，发现我的合同已经到了9月份了，赶紧声明不能这么长，我8月得回学校了。
阅读全文

巴菲特致股东信-1973年

 笔记： 在上一年度预测的今年竞争加剧导致利润下滑，真的发生了 翻译Link： 雪球：https://xueqiu.com/6217262310/131257618 备份：https://archive.ph/KIfdT 原文： To the Stockholders of Berkshire Hathaway Inc.: Our financial results for 1973 were satisfactory, with operating earnings of $11,930,592, producing a return of 17.4% on beginning stockholders' equity. Although operating earnings improved from $11.43 to $12.18 per share, earnings on equity decreased from the 19.8% of 1972. This decline occurred because the gain in earnings was not commensurate with the increase in shareholders' investment. We had forecast in last year's report that such a decline was likely. Unfortunately, our forecast proved to be correct. Our textile, banking, and most insurance operations had good years, but certain segments of the insurance business turned in poor results. Overall, our insurance business continues to be a most attractive area in which to employ capital. Management'...
阅读全文

巴菲特致股东信-1975年

 笔记： 华盛顿邮报已成为伯克希尔第一重仓股 翻译： 雪球：https://xueqiu.com/6217262310/131409324 备份：https://archive.ph/4hgK3 原文： To the Stockholders of Berkshire Hathaway Inc.: Last year, when discussing the prospects for 1975, we stated “the outlook for 1975 is not encouraging.” This forecast proved to be distressingly accurate. Our operating earnings for 1975 were $6,713,592, or $6.85 per share, producing a return on beginning shareholders ’ equity of 7.6%. This is the lowest return on equity experienced since 1967. Furthermore, as explained later in this letter, a large segment of these earnings resulted from Federal income tax refunds which will not be available to assist performance in 1976. On balance, however, current trends indicate a somewhat brighter 1976. Operations and prospects will be discussed in greater detail below, under specific industry titles. Our expectation is that significantly better results in textiles, earnings added from recent acquisitio...
阅读全文

产品随想 | 周刊 第43期：历史上的今天

Products Huberman Lab   https://hubermanlab.com/ 一款聚焦于健康的播客 今日热榜   https://tophub.today/ 聚合展示，国内各热门榜单，对跟进热点非常有帮助，热点运营的好帮手 SketchyBar   https://github.com/FelixKratz/SketchyBar A highly customizable macOS status bar replacement Mac菜单栏定制 自定义程度很高，看作者展示的案例，暂时没想出这样的好处（不过应用本身的编辑，确实也没啥意义）生命在于折腾吧！ Thanks-Mirror   https://github.com/eryajf/Thanks-Mirror 整理记录各个包管理器，系统镜像，以及常用软件的好用镜像，Thanks Mirror。 Musicn   https://github.com/zonemeen/musicn 一个下载高品质音乐的命令行工具，音乐来源: 咪咕 Planet Minecraft A creative Minecraft community fansite sharing maps, minecraft skins, resource packs, servers, mods, and more. 里面有很多动人的故事 可能是世界上最大的Minecraft社区，从2010年至今 The Uncensored Library   https://www.uncensoredlibrary.com/en blockworks   https://www.blockworks.uk/ "Distinctive maps for Minecraft that have educated players and risen to the level of art" 游戏也可以让人有更高的实现，而不仅仅是沉迷其中，国外游戏厂商比我们做的好太多 Minecraft_Memory_Bypass_GUI   https://github.com/xingchuanzhen/Minecraft_Memory_Bypass_GUI 绕过Minecraft...
阅读全文

巴菲特致股东信-1976年

 笔记： 为什么选择轻资产行业：当竞争疯狂时，不会强迫加入降价大战 最终选择了费雪的思想，选择能理解的优秀企业，以合理的价格买入并长期拥有 翻译： 雪球：https://xueqiu.com/6217262310/131440258 备份：https://archive.ph/XLK0S 原文： To the Stockholders of Berkshire Hathaway Inc, After two dismal years, operating results in 1976 improved significantly. Last year we said the degree of progress in insurance underwriting would determine whether our gain in earnings would be "moderate" or "major." As it turned out, earnings exceeded even the high end of our expectations. In large part, this was due to the outstanding efforts of Phil Liesche's managerial group at National Indemnity Company. In dollar terms, operating earnings came to $16,073,000, or $16.47 per share. While this is a record figure, we consider return on shareholders' equity to be a much more significant yardstick of economic performance. Here our result was 17.3%, moderately above our long-term average and even further above the average o...
阅读全文

Commencement Address at Stanford University--“Stay hungry. Stay foolish.”

I am honored to be with you today for your commencement from one of the finest universities in the world. Truth be told— I never graduated from college. This is the closest I’ve ever gotten to a college graduation. Today I want to tell you three stories from my life. That’s it. No big deal. Just three stories. The first story is about connecting the dots. I dropped out of Reed College after the first six months but then stayed around as a drop-in for another eighteen months or so before I really quit. So why did I drop out? It started before I was born. My biological mother was a young, unwed graduate student, and she decided to put me up for adoption. She felt very strongly that I should be adopted by college graduates, so everything was all set for me to be adopted at birth by a lawyer and his wife. Except that when I popped out they decided at the last minute that they really wanted a girl. So my parents, who were on a waiting...
阅读全文

Steve Jobs introduced the iPhone on January 9, 2007.

This is a day I’ve been looking forward to for two and a half years. Link Every once in a while, a revolutionary product comes along that changes everything. And Apple has been— well, first of all, one’s very fortunate if you get to work on just one of these in your career. Apple’s been very fortunate. It’s been able to introduce a few of these into the world. In 1984, we introduced the Macintosh. It didn’t just change Apple, it changed the whole computer industry. In 2001, we introduced the first iPod, and it didn’t just change the way we all listen to music, it changed the entire music industry. Well, today, we’re introducing three revolutionary products of this class. The first one is a widescreen iPod with touch controls. The second is a revolutionary mobile phone. And the third is a breakthrough internet communications device. So, three things: a widescreen iPod with touch controls; a revolutionary mobile phone; and a breakthrough internet communicat...
阅读全文