CentOS 7 防火墙 firewall指令

官方文档:REDHAT-USING FIREWALLS

安装

# 安装防火墙
yum install firewalld
# 查看版本
firewall-cmd --version
# 查看帮助
firewall-cmd --help

启动，自启动

# 开启，关闭，重启防火墙
systemctl start firewalld
systemctl stop firewalld
systemctl restart firewalld
# 设置/禁止开机启动
systemctl enable firewalld
systemctl disable firewalld

查看状态与端口设置

# 查看防火墙状态，以下两条指令均可
systemctl status firewalld
firewall-cmd --state

# 临时开放端口/关闭端口，无需reload立即生效
firewall-cmd --zone=public --add-port=1225/tcp
firewall-cmd --zone=public --remove-port=1225/tcp
# 永久开放/关闭端口，需更新防火墙规则方可生效，
firewall-cmd  --permanent --zone=public --add-port=1225/tcp
firewall-cmd  --permanent --zone=public --remove-port=1225/tcp
# 更新防火墙规则
firewall-cmd --reload

# 查看开放端口列表
firewall-cmd --list-ports
# 查看
firewall-cmd --list-all
public
  target: default
  icmp-block-inversion: no
  interfaces:
  sources:
  services: dhcpv6-client ss ssh
  ports: 2012/tcp 1225/tcp 80/tcp 8080/tcp
  protocols:
  masquerade: no
  forward-ports:
  sourceports:
  icmp-blocks:
  rich rules:

# 列出系统上可用的所有服务
firewall-cmd --get-services
# 输出大概如下
RH-Satellite-6 amanda-client amanda-k5-client bacula bacula-client ceph ceph-mon dhcp dhcpv6 dhcpv6-client dns docker-registry dropbox-lansync freeipa-ldap freeipa-ldaps freeipa-replication ftp high-availability http https imap imaps ipp ipp-client ipsec iscsi-target kadmin kerberos kpasswd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3 pop3s postgresql privoxy proxy-dhcp ptp pulseaudio puppetmaster radius rpc-bind rsyncd samba samba-client sane smtp smtps snmp snmptrap squid ss ssh synergy syslog syslog-tls telnet tftp tftp-client tinc tor-socks transmission-client vdsm vnc-server wbem-https xmpp-bosh xmpp-client xmpp-local xmpp-server

# 开启服务/关闭服务
firewall-cmd --add-service ftp
firewall-cmd --remove-service ftp
firewall-cmd --add-service ssh
firewall-cmd --remove-service ssh
# 查询服务的启用状态
firewall-cmd --query-service ftp
firewall-cmd --query-service ssh

# 列出系统服务或者用户创建的服务
ls /etc/firewalld/services/
# 增加新服务，在上述目录下生成新的文件
firewall-cmd --permanent --new-service=service-name
# 服务xml基本格式如下
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>SS</short>
  <description>Shadowsocks port
  </description>
  <port protocol="tcp" port="1225"/>
</service>